Analysis Report

Overview

General Information

Joe Sandbox Version:	14.0.0
Analysis ID:	118315
Start time:	11:15:50
Joe Sandbox Product:	Cloud
Start date:	20/04/2016
Overall analysis duration:	0h 15m 56s
Report type:	full
Sample file name:	885.exe
Cookbook file name:	Changes the system date - mod1.jbs
Analysis system description:	Windows 7 (Office 2003 SP1, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 41, Firefox 36)
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	3
Technologies	HCA enabled EGA enabled
Detection:	MAL
Classification:	mal56.evad.winEXE@3/10@5/2
HCA Informations:	Success: true, ratio: 90% Number of executed functions: 258 Number of non-executed functions: 26
EGA Information:	Success: true, ratio: 50%
Cookbook Comments:	Found application associated with file extension: .exe 4/6/2016
Warnings:	Show All Max analysis timeout: 600s exceeded, the analysis took too long Exclude process from analysis (whitelisted): mscorsvw.exe, sppsvc.exe, WmiApSrv.exe, WMIADAP.exe Execution Graph export aborted for target rundll32.exe, PID 3276 because it is empty

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	56	0 - 100	Report FP / FN

Classification

Analysis Advice

Sample has functionality to log and monitor keystrokes, analyze it with the keystroke simulation cookbook

Sample sleeps for a long time, analyze it with the fake sleep cookbook

Signature Overview

Click to jump to signature section

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a raw input device (often for capturing keystrokes)

Show sources

Source: C:\885.exe

Code function: 0_1_00404E82 GetRawInputData,GetRawInputData,MultiByteToWideChar,SetWindowTextA,DefWindowProcA,LoadMenuA,GetSubMenu,TrackPopupMenu,DestroyMenu,CoInitialize,CoCreateInstance,FindResourceExA,GetDlgItem,GetWindowRect,GetDC,LoadResource,SizeofResource,LockResource,UpdateResourceA,LoadImageA,GetWindowLongA,FreeResource,EnumResourceTypesA,PostQuitMessage,

0_1_00404E82

Networking:

Urls found in memory or binary data

Show sources

Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/autoit3/autoit3.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/autoit3/autoit3.exe8
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/common%20files/adobe/arm/1.0/adobearm.exe
Source: explorer.exe	String found in binary or memory: file:///c:/program%20files/common%20files/adobe/arm/1.0/adobearm.exen
Source: explorer.exe	String found in binary or memory: file:///c:/users/admin/appdata/local/microsoft/windows/wer/erc/responsestatecache.xml
Source: explorer.exe	String found in binary or memory: file:///c:/users/admin/appdata/local/microsoft/windows/wer/erc/responsestatecache.xmlinfo
Source: explorer.exe	String found in binary or memory: file://c:
Source: explorer.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=125824-http://go.microsoft.com/fwlink/?linkid=125723-http://g
Source: explorer.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=3448&clcid=%#04lx
Source: taskhost.exe	String found in binary or memory: http://go.microsoft.com/fwlink/?linkid=92362.
Source: explorer.exe	String found in binary or memory: http://java.com/
Source: explorer.exe	String found in binary or memory: http://java.com/c
Source: explorer.exe	String found in binary or memory: http://java.com/help
Source: explorer.exe	String found in binary or memory: http://java.com/help2d
Source: explorer.exe	String found in binary or memory: http://java.com/helphttp://java.com/help
Source: explorer.exe	String found in binary or memory: http://java.com/helpmda
Source: explorer.exe	String found in binary or memory: http://java.com/http://java.com/
Source: explorer.exe	String found in binary or memory: http://java.com/q
Source: explorer.exe	String found in binary or memory: http://schemas.microsoft.com/win/2004/08/events/event
Source: explorer.exe	String found in binary or memory: http://schemas.microsoft.com/windows/2009/library
Source: explorer.exe	String found in binary or memory: http://schemas.microsoft.com/windows/2009/library&o
Source: explorer.exe	String found in binary or memory: http://schemas.microsoft.com/windows/2009/librarye
Source: explorer.exe	String found in binary or memory: http://www.%s.compa

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: microsoft.com

Persistence and Installation Behavior:

May use bcdedit to modify the Windows boot settings

Show sources

Source: explorer.exe

Binary or memory string: c:\windows\system32\bcdedit.exej

Data Obfuscation:

Binary may include packed or encrypted code

Show sources

Source: initial sample

Static PE information: section name: .text entropy: 7.92187263893

Contains functionality to dynamically determine API calls

Show sources

Source: C:\885.exe

Code function: 0_1_0040F6AD LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_1_0040F6AD

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\885.exe	Code function: 0_2_00407C8D pushfd ; retf	0_2_00407C8E
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_005A518C push ECE0h; retf	3_2_005A5191
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_005A6C6D pushfd ; retf	3_2_005A6C6E

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: mal56.evad.winEXE@3/10@5/2

Contains functionality to instantiate COM classes

Show sources

Source: C:\885.exe

0_1_00404E82

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\885.exe

0_1_00404E82

Creates files inside the program directory

Show sources

Source: C:\885.exe

File created: C:\ProgramData\3zm

Creates files inside the user directory

Show sources

Source: C:\885.exe

File created: C:\Users\admin\AppData\Roaming\604k7

Creates temporary files

Show sources

Source: C:\885.exe

File created: C:\Users\admin\AppData\Local\Temp\qibkbj.nqu

PE file has an executable .text section and no other executable section

Show sources

Source: 885.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Show sources

Source: C:\885.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Runs a DLL by calling functions

Show sources

Source: C:\885.exe

Process created: C:\Windows\System32\rundll32.exe -p gzua.dll

Spawns processes

Show sources

Source: unknown	Process created: C:\885.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe
Source: C:\885.exe	Process created: C:\Windows\System32\rundll32.exe -p gzua.dll

Uses an in-process (OLE) Automation server

Show sources

Source: C:\885.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{228D9A82-C302-11cf-9AA4-00AA004A5691}\InprocServer32

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Show sources

Source: 885.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Found potential string decryption / allocating functions

Show sources

Source: C:\885.exe	Code function: String function: 0047DD2D appears 48 times
Source: C:\885.exe	Code function: String function: 00408D02 appears 122 times
Source: C:\885.exe	Code function: String function: 00484813 appears 42 times

PE file contains strange resources

Show sources

Source: 885.exe

Static PE information: Resource name: RT_ICON type: ump; GLS_BINARY_LSB_FIRST

Reads the hosts file

Show sources

Source: C:\Windows\explorer.exe

File read: C:\Windows\System32\drivers\etc\hosts

Sample file is different than original file name gathered from version info

Show sources

Source: 885.exe

Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs 885.exe

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: explorer.exe	Binary or memory string: Progmanp
Source: rundll32.exe, winlogon.exe, explorer.exe, taskhost.exe	Binary or memory string: Progman
Source: rundll32.exe, winlogon.exe, explorer.exe, taskhost.exe	Binary or memory string: Program Manager
Source: rundll32.exe, winlogon.exe, explorer.exe, taskhost.exe	Binary or memory string: Shell_TrayWnd

Allocates memory in foreign processes

Show sources

Source: C:\885.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 900000 protect: page execute and read and write
Source: C:\885.exe	Memory allocated: C:\Windows\System32\taskhost.exe base: DC0000 protect: page execute and read and write

Changes memory attributes in foreign processes to executable or writable

Show sources

Source: C:\885.exe	Memory protected: C:\Windows\System32\winlogon.exe base: 900000 protect: page execute and read and write
Source: C:\885.exe	Memory protected: C:\Windows\System32\winlogon.exe base: 900000 protect: page execute and read and write
Source: C:\885.exe	Memory protected: C:\Windows\System32\taskhost.exe base: DC0000 protect: page execute and read and write
Source: C:\885.exe	Memory protected: C:\Windows\System32\taskhost.exe base: DC0000 protect: page execute and read and write

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\885.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 900000
Source: C:\885.exe	Thread created: C:\Windows\System32\taskhost.exe EIP: DC0000

Writes to foreign memory regions

Show sources

Source: C:\885.exe	Memory written: C:\Windows\System32\winlogon.exe base: 900000
Source: C:\885.exe	Memory written: C:\Windows\System32\taskhost.exe base: DC0000

Anti Debugging:

Contains functionality to register its own exception handler

Show sources

Source: C:\885.exe	Code function: 0_1_0040BD5C SetUnhandledExceptionFilter,	0_1_0040BD5C
Source: C:\885.exe	Code function: 0_1_004072D4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_1_004072D4
Source: C:\885.exe	Code function: 0_1_0041126F SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	0_1_0041126F
Source: C:\885.exe	Code function: 0_1_00406ECD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_1_00406ECD

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\885.exe

Code function: 0_1_004072D4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_1_004072D4

Contains functionality to dynamically determine API calls

Show sources

Source: C:\885.exe

Code function: 0_1_0040F6AD LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_1_0040F6AD

Enables debug privileges

Show sources

Source: C:\885.exe

Process token adjusted: Debug

Malware Analysis System Evasion:

Queries a list of all running processes

Show sources

Source: C:\885.exe

Process information queried: ProcessInformation

Contains long sleeps (>= 3 min)

Show sources

Source: C:\885.exe

Thread delayed: delay time: -922337203685477

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\885.exe TID: 2900	Thread sleep time: -922337203685477ms >= -60000ms
Source: C:\Windows\System32\rundll32.exe TID: 3280	Thread sleep time: -191384ms >= -60000ms
Source: C:\Windows\explorer.exe TID: 1320	Thread sleep time: -120000ms >= -60000ms
Source: C:\Windows\explorer.exe TID: 3336	Thread sleep time: -467972ms >= -60000ms

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\885.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX

Stores large binary data to the registry

Show sources

Source: C:\885.exe

Key value created or modified: HKEY_USERS\Software\Microsoft\QIB zuv

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Show sources

Source: C:\885.exe

Code function: 0_1_0040C97D GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_1_0040C97D

Contains functionality to query time zone information

Show sources

Source: C:\885.exe

Code function: 0_1_0040AD94 GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_1_0040AD94

Contains functionality to query windows version

Show sources

Source: C:\885.exe

Code function: 0_1_00401399 GetLastError,CreateFileA,GetFileInformationByHandle,GetEnvironmentStringsW,lstrlenA,KiUserExceptionDispatcher,CloseHandle,GetWindowLongA,CreateWindowExA,SetWindowLongA,GetClientRect,DestroyWindow,DefWindowProcA,KiUserCallbackDispatcher,TrackMouseEvent,DefWindowProcA,GetDlgItem,GetWindowPlacement,SetWindowPlacement,Rectangle,MoveToEx,GlobalMemoryStatusEx,GetPerformanceInfo,K32GetPerformanceInfo,EnumProcesses,K32EnumProcesses,GetCurrentProcess,OpenProcessToken,CloseHandle,GetVersionExA,GetOpenFileNameA,_lopen,ExitProcess,#185,GetCurrentProcess,SymInitialize,SymLoadModuleEx,SymCleanup,SymEnumSymbols,GetLastError,SymCleanup,GetDlgItem,GetClassNameA,FindWindowExA,PostMessageA,PostMessageA,ShowWindow,PostMessageA,PostMessageA,ShowWindow,PostMessageA,#9,CreateCompatibleDC,SelectObject,GetDCEx,ClientToScreen,ClientToScreen,PatBlt,ReleaseDC,GetObjectA,CreateBitmapIndirect,CreateCompatibleDC,CreateCompatibleDC,SelectObject,SelectObject,BitBlt,DeleteDC,DeleteDC,DeleteDC,LoadImageA,GetObjectA,GetDC,CreateComp

0_1_00401399

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\885.exe

Code function: GetLocaleInfoA,

0_1_00413655

Contains functionality to detect query CPU information (cpuid)

Show sources

Source: C:\885.exe

Code function: 0_2_00466B02 cpuid

0_2_00466B02

Queries the cryptographic machine GUID

Show sources

Source: C:\885.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\885.exe	Queries volume information: 2896 VolumeInformation
Source: C:\Windows\explorer.exe	Queries volume information: C:\ VolumeInformation

Behavior Graph

Legend:

Process
Signature
Created File
DNS/IP Info

Yara Overview

No Yara matches

Screenshot

Startup

system is w7

885.exe (PID: 2896 MD5: F1A12884B999B9E572F91A94043D6E01)

rundll32.exe (PID: 3276 cmdline: -p gzua.dll MD5: 51138BEEA3E2C21EC44D0932C71762A8)

winlogon.exe (PID: 348 MD5: 52449FD429D6053B78AE564DEF303870)

explorer.exe (PID: 1244 MD5: 8B88EBBB05A0E56B7DCC708498C02B3E)

taskhost.exe (PID: 1296 MD5: 72E953215CADE1A726C04AAFDF6B463D)

cleanup

Created / dropped Files

File Path	Type and Hashes
C:\ProgramData\0pdg52	Type: data MD5: 3F2829B2FFE8434D67F98A2A98968652 SHA: C259E771B237769CB6BCE9A5AB734C576A6DA3E1 SHA-256: 3E7077FD2F66D689E0CEE6A7CF5B37BF2DCA7C979AF356D0A31CBC5C85605C7D SHA-512: A85DE39409374651002C84CBA7C928EB96FB82F88ACC2AEAC392985DEF3E1389346122B82C9C47B743A5C2764BB0E3F5C309AF7202DBE723E69A5193E84FCBC4
C:\ProgramData\sie\koggfc.tmh	Type: data MD5: F5B405EE4D202B518E055677471F464F SHA: 6349FAB8B384982A5C1EC0EC39DA82061FBFAB7C SHA-256: 792D1B1BC3E03E693EB560FAEF279593523A8EBB11A8E10AE871745A4B7C0679 SHA-512: 6730D03513D828564DB850BB2A562D19EF5C53A1B03EE054E3845C16F4B8CB83142627D5509384B487B073892AA7E711EAE08101B5D5F6531FCC5EEEC1083608
C:\Users\admin\AppData\Local\Temp\A5FA.tmp	Type: data MD5: CA9C491AC66B2C62500882E93F3719A8 SHA: A10909C2CDCAF5ADB7E6B092A4FABA558B62BD96 SHA-256: 8855508AADE16EC573D21E6A485DFD0A7624085C1A14B5ECDD6485DE0C6839A4 SHA-512: 65FAA9D920E0E9CFF43FC3F30AB02BA2E8CF6F4643B58F7C1E64583FBEC8A268E677B0EC4D54406E748BECB53FDA210F5D4F39CF2A5014B1CA496B0805182649
C:\Users\admin\AppData\Local\Temp\A61A.tmp	Type: data MD5: 36DF9540A5EF4996A9737657E4A8929C SHA: 4595C5B7AC9F265CDF89ACEC0069630697680F96 SHA-256: E7ECEBBC590BC88B3761FA6CD03D749F87463DABB67021A5C6768C25EC68B3F2 SHA-512: 7CF95CDE6D8D85F13497DDBABC60A56BCA0ABEABD2BC3E723C0A4A8C0784B14C4EE3317620B79D260D42608C8B907571499187078D14304A5E7A84BC55193CE9
C:\Users\admin\AppData\Local\Temp\g0a4ceb	Type: data MD5: A63C90CC3684AD8B0A2176A6A8FE9005 SHA: 9694C4EBD673A5E2FD26E4B2E64F92E914EBD95F SHA-256: 01D448AFD928065458CF670B60F5A594D735AF0172C8D67F22A81680132681CA SHA-512: 19BD3CBB62B1937957A11CABD0D39860582B6928E77D0E0EA5EE7F3B2F8CACB3DEA8EA0972651ADC3245FD10926F2F31E80377196E4E6C7EE2BD74051E58BCBA
C:\Users\admin\AppData\Local\Temp\qibkbj.nqu	Type: data MD5: 510BA332CAC185E38D3977AA7A254A5B SHA: D52E526D1CF301C62AFDC5C877D0E0EBBAB41E38 SHA-256: AD325B8D903D0E1CB6ABCAA5DA2307A0CA53E57A0ECF81B486CCE7E5730CA66C SHA-512: 2EF8826CE81358405F1A13BAD84E40FE49D43E7371B4CA5E06186F9CCDB52EC65DB4023ED7F3429A5C08A73AC40DA491CC6BBE3333DFF87C0AC7FCBC0D1FB2C5
C:\Users\admin\AppData\Local\zx7jj88	Type: data MD5: F1D3FF8443297732862DF21DC4E57262 SHA: 9069CA78E7450A285173431B3E52C5C25299E473 SHA-256: DF3F619804A92FDB4057192DC43DD748EA778ADC52BC498CE80524C014B81119 SHA-512: EC2D57691D9B2D40182AC565032054B7D784BA96B18BCB5BE0BB4E70E3FB041EFF582C8AF66EE50256539F2181D7F9E53627C0189DA7E75A4D5EF10EA93B20B3
C:\Users\admin\AppData\Roaming\7wi9	Type: data MD5: D310A40483F9399DD7ED1712E0FDD702 SHA: 77CE0377DEFBD11B77B1F4AD54CA40EA5EF28490 SHA-256: 837885C8F8091AEAEB9EC3C3F85A6FF470A415E610B8BA3E49F9B33C9CF9D619 SHA-512: 76AFCA18A9B81FFB967FFCF0460ED221C3605D3820057214D785FA88259BB5CB729576178E6EDB0134F645D2E2E92CBABF1333462F3B9058692C950F51C64A92
\{7B1FF608-039A-4900-3907-722A4A8C8051}	Type: data MD5: 8EBC04349BC1AA24102FF0941F0BFD9F SHA: 00DDAE088C837920873F9BECC62DB0E9D709AEB5 SHA-256: EE409CCCFF91FA62EF983E3F153C555E092089D958BED885A7A3F7E9AF81B95F SHA-512: 7911F9BE47C0243577B43005B8A0DEA4B8FEB93F0F9943A940F2AF0F6EF06DDBCC16891F406C0B5B03D3EC86D744C43C99F28A8832558EAE3DCF252558D9A5FC

Contacted Domains/Contacted IPs

Contacted Domains

Name	IP	Active
microsoft.com	191.239.213.197	true
kcrznhnlpw.com	unknown	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	Flag	ASN	ASN Name
8.8.8.8	United States		15169	GoogleInc
8.8.4.4	United States		15169	GoogleInc

Static File Info

General
File type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	885.exe
File size:	618496
MD5:	f1a12884b999b9e572f91a94043d6e01
SHA1:	531b4d8d4406c547cd3c13a8a249f0d7f00e41b9
SHA256:	2bbf482b40605e0f00b370a29ce05fdbd428a37a9d4333ec1ff48aaf3085886b
SHA512:	eebb2cf8182451872ebc4a17f00906aafa5cf65bbd3fd170fe087d393f1eac46ebe6719acdc0d10123d3491d9ea032b4bd8f580bc97fe2ba9c27188600b6f8e7

File Icon

Static PE Info

General
Entrypoint:	0x4069fa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x57043CD3 [Tue Apr 05 22:31:47 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	7363916e8c62b29a160220e94a08ed74

Entrypoint Preview

Instruction
call 0CB460A3h
jmp 0CB3FF9Dh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 0CB40146h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 0CB40170h
test ecx, 00000003h
jne 0CB40111h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 0CB4010Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 0CB40154h
test ah, ah
je 0CB40146h
test eax, 00FF0000h
je 0CB40135h
test eax, FF000000h
je 0CB40124h
jmp 0CB400EFh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 004786D8h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7efd4	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x85000	0x15dec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x7b0c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x78000	0x31c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Xored PE	ZLIB Complexity	File Type	Characteristics
.text	0x1000	0x76f3e	0x77000	False	0.927391757484	ump; data	7.92187263893	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x78000	0x8126	0x8200	False	0.680919471154	ump; data	6.881285733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x81000	0x37e4	0x1c00	False	0.452427455357	ump; data	4.38260550111	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x85000	0x15dec	0x15e00	False	0.243995535714	ump; data	5.57599365085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x85490	0x838	ump; data	English	United States
RT_BITMAP	0x85cc8	0x1b4	ump; data	English	United States
RT_ICON	0x85e7c	0x4c28	ump; data	English	United States
RT_ICON	0x8aaa4	0x16e8	ump; data	English	United States
RT_ICON	0x8c18c	0x5488	ump; data	English	United States
RT_ICON	0x91614	0x4228	ump; data	English	United States
RT_ICON	0x9583c	0x25a8	ump; data	English	United States
RT_ICON	0x97de4	0x10a8	ump; data	English	United States
RT_ICON	0x98e8c	0x468	ump; GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x992f4	0xee	ump; data	English	United States
RT_DIALOG	0x993e4	0x1d4	ump; data	English	United States
RT_DIALOG	0x995b8	0x1ec	ump; data	English	United States
RT_DIALOG	0x997a4	0x2b8	ump; data	English	United States
RT_STRING	0x99a5c	0x160	ump; data	English	United States
RT_STRING	0x99bbc	0x23e	ump; data	English	United States
RT_STRING	0x99dfc	0x378	ump; data	English	United States
RT_STRING	0x9a174	0x252	ump; data	English	United States
RT_STRING	0x9a3c8	0x1f4	ump; data	English	United States
RT_STRING	0x9a5bc	0x66c	ump; data	English	United States
RT_GROUP_ICON	0x9ac28	0x68	ump; MS Windows icon resource - 7 icons, 256-colors	English	United States
RT_MANIFEST	0x9ac90	0x15a	ump; ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetLocaleInfoA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, HeapSize, FlushFileBuffers, InitializeCriticalSectionAndSpinCount, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, GetConsoleMode, GetConsoleCP, SetFilePointer, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, InterlockedDecrement, GetCurrentThreadId, ReadFile, InterlockedIncrement, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetTimeZoneInformation, GetFileType, SetHandleCount, GetModuleFileNameA, GetStdHandle, WriteFile, Sleep, GetModuleHandleW, HeapCreate, HeapReAlloc, VirtualAlloc, VirtualFree, CompareStringA, CompareStringW, LocalFileTimeToFileTime, lstrcpyA, GetFileInformationByHandle, GetVersion, CloseHandle, GetVersionExA, _lopen, GetModuleHandleA, GlobalMemoryStatusEx, LockResource, LoadLibraryA, GetProcAddress, GetLastError, MultiByteToWideChar, lstrcatA, CreateEventA, SizeofResource, WideCharToMultiByte, FindResourceExA, EnumResourceTypesA, SetFileTime, ExitProcess, WaitForSingleObject, GetEnvironmentStringsW, GetCurrentProcess, SystemTimeToFileTime, UpdateResourceA, LoadResource, lstrlenA, FreeResource, DeleteCriticalSection, HeapFree, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, RtlUnwind, RaiseException, GetStartupInfoA, GetCommandLineA, LeaveCriticalSection, EnterCriticalSection, HeapAlloc, CreateFileA, SetLastError, SetEnvironmentVariableA
USER32.dll	CheckMenuItem, LoadCursorA, DestroyMenu, LoadImageA, SetWindowTextA, mouse_event, PostMessageA, ShowWindow, GetCursorPos, EnumDisplaySettingsA, EndPaint, ClientToScreen, DestroyWindow, SetWindowPlacement, SetCursor, GetClassNameA, GetWindowRect, PostQuitMessage, SendDlgItemMessageA, TrackPopupMenu, GetRawInputData, GetSubMenu, GetDesktopWindow, SetForegroundWindow, CopyImage, TrackMouseEvent, LoadMenuA, DrawIconEx, IsWindowEnabled, FindWindowExA, GetClientRect, SendMessageA, BeginPaint, GetIconInfo, GetDC, GetMenu, GetWindowPlacement, GetCursorInfo, CopyIcon, SetWindowLongA, MessageBoxA, GetWindowLongA, CreateWindowExA, GetDCEx, ReleaseDC, EnableMenuItem, GetDlgItem, DefWindowProcA
GDI32.dll	MoveToEx, BitBlt, PatBlt, SetViewportOrgEx, DeleteDC, CreateDIBSection, SetPixel, DeleteObject, SelectObject, SelectClipRgn, CreateCompatibleDC, CombineRgn, Rectangle, CreateBitmapIndirect, CreateRectRgn, ChoosePixelFormat, SetPixelFormat, GetPixel, GetObjectA, CreateSolidBrush, CreateEllipticRgn
COMDLG32.dll	GetOpenFileNameA
ADVAPI32.dll	IsValidSid, GetSidSubAuthorityCount, OpenProcessToken, GetSidIdentifierAuthority
SHELL32.dll	Shell_NotifyIconA
ole32.dll	CoCreateInstance, CoInitialize
OLEAUT32.dll	SysAllocStringLen, VariantTimeToSystemTime, VariantInit
PSAPI.DLL	GetPerformanceInfo, EnumProcesses
ACTIVEDS.dll
gdiplus.dll	GdipDisposeImage, GdipCreateBitmapFromHBITMAP, GdipSaveImageToFile, GdiplusStartup
OPENGL32.dll	wglCreateContext
dbghelp.dll	SymLoadModuleEx, SymCleanup, SymInitialize, SymEnumSymbols

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2016 11:17:58.798954010 MESZ	52165	53	192.168.1.12	8.8.8.8
Apr 20, 2016 11:17:58.974076033 MESZ	53	52165	8.8.8.8	192.168.1.12
Apr 20, 2016 11:17:59.356739998 MESZ	52166	53	192.168.1.12	8.8.8.8
Apr 20, 2016 11:17:59.559509993 MESZ	53	52166	8.8.8.8	192.168.1.12
Apr 20, 2016 11:17:59.560205936 MESZ	52167	53	192.168.1.12	8.8.4.4
Apr 20, 2016 11:17:59.756835938 MESZ	53	52167	8.8.4.4	192.168.1.12
Apr 20, 2016 11:17:59.827270031 MESZ	51187	53	192.168.1.12	8.8.8.8
Apr 20, 2016 11:18:00.015878916 MESZ	53	51187	8.8.8.8	192.168.1.12
Apr 20, 2016 11:18:02.436335087 MESZ	55317	53	192.168.1.12	8.8.8.8
Apr 20, 2016 11:18:02.436441898 MESZ	53	55317	8.8.8.8	192.168.1.12

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2016 11:17:58.798954010 MESZ	52165	53	192.168.1.12	8.8.8.8
Apr 20, 2016 11:17:58.974076033 MESZ	53	52165	8.8.8.8	192.168.1.12
Apr 20, 2016 11:17:59.356739998 MESZ	52166	53	192.168.1.12	8.8.8.8
Apr 20, 2016 11:17:59.559509993 MESZ	53	52166	8.8.8.8	192.168.1.12
Apr 20, 2016 11:17:59.560205936 MESZ	52167	53	192.168.1.12	8.8.4.4
Apr 20, 2016 11:17:59.756835938 MESZ	53	52167	8.8.4.4	192.168.1.12
Apr 20, 2016 11:17:59.827270031 MESZ	51187	53	192.168.1.12	8.8.8.8
Apr 20, 2016 11:18:00.015878916 MESZ	53	51187	8.8.8.8	192.168.1.12
Apr 20, 2016 11:18:02.436335087 MESZ	55317	53	192.168.1.12	8.8.8.8
Apr 20, 2016 11:18:02.436441898 MESZ	53	55317	8.8.8.8	192.168.1.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 20, 2016 11:17:58.798954010 MESZ	192.168.1.12	8.8.8.8	0x6a96	Standard query (0)	microsoft.com	A (IP address)	IN (0x0001)
Apr 20, 2016 11:17:59.356739998 MESZ	192.168.1.12	8.8.8.8	0x5178	Standard query (0)	kcrznhnlpw.com	A (IP address)	IN (0x0001)
Apr 20, 2016 11:17:59.560205936 MESZ	192.168.1.12	8.8.4.4	0x56d8	Standard query (0)	kcrznhnlpw.com	A (IP address)	IN (0x0001)
Apr 20, 2016 11:17:59.827270031 MESZ	192.168.1.12	8.8.8.8	0x3a33	Standard query (0)	kcrznhnlpw.com	A (IP address)	IN (0x0001)
Apr 20, 2016 11:18:02.436335087 MESZ	192.168.1.12	8.8.8.8	0x3b86	Standard query (0)	microsoft.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	CName	Address	Type	Class
Apr 20, 2016 11:17:58.974076033 MESZ	8.8.8.8	192.168.1.12	0x6a96	No error (0)	microsoft.com		191.239.213.197	A (IP address)	IN (0x0001)
Apr 20, 2016 11:17:59.559509993 MESZ	8.8.8.8	192.168.1.12	0x5178	Name error (3)	kcrznhnlpw.com	none	none	A (IP address)	IN (0x0001)
Apr 20, 2016 11:17:59.756835938 MESZ	8.8.4.4	192.168.1.12	0x56d8	Name error (3)	kcrznhnlpw.com	none	none	A (IP address)	IN (0x0001)
Apr 20, 2016 11:18:00.015878916 MESZ	8.8.8.8	192.168.1.12	0x3a33	Name error (3)	kcrznhnlpw.com	none	none	A (IP address)	IN (0x0001)
Apr 20, 2016 11:18:02.436441898 MESZ	8.8.8.8	192.168.1.12	0x3b86	No error (0)	microsoft.com		191.239.213.197	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: 885.exe PID: 2896 Parent PID: 2364

General

Start time:	11:17:02
Start date:	06/04/2016
Path:	C:\885.exe
Wow64 process (32bit):	false
Commandline:	unknown
Imagebase:	0x400000
File size:	618496 bytes
MD5 hash:	F1A12884B999B9E572F91A94043D6E01
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 3276 Parent PID: 2896

General

Start time:	11:18:37
Start date:	06/04/2016
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	-p gzua.dll
Imagebase:	0x766b0000
File size:	44544 bytes
MD5 hash:	51138BEEA3E2C21EC44D0932C71762A8
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: winlogon.exe PID: 348 Parent PID: 2896

General

Start time:	11:18:38
Start date:	06/04/2016
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x8b0000
File size:	304128 bytes
MD5 hash:	52449FD429D6053B78AE564DEF303870
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: explorer.exe PID: 1244 Parent PID: 348

General

Start time:	11:18:38
Start date:	06/04/2016
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0xec0000
File size:	2616320 bytes
MD5 hash:	8B88EBBB05A0E56B7DCC708498C02B3E
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskhost.exe PID: 1296 Parent PID: 348

General

Start time:	11:18:39
Start date:	06/04/2016
Path:	C:\Windows\System32\taskhost.exe
Wow64 process (32bit):	false
Commandline:	taskhost.exe
Imagebase:	0xee0000
File size:	49152 bytes
MD5 hash:	72E953215CADE1A726C04AAFDF6B463D
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 885.exe PID: 2896 Parent PID: 2364

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	99.2%
Signature Coverage:	0%
Total number of Nodes:	125
Total number of Limit Nodes:	10

Executed Functions

Function 00401399, Relevance: 165.4, APIs: 77, Strings: 17, Instructions: 879

APIs

Part of subcall function 00405DC9: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,00409B83,?,00000001,?,?,0040856B,00000018,0047B4B0,0000000C,004085FC), ref: 00405E40

GetLastError.KERNEL32(?,00000000,00000103), ref: 004013F1
CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,02000001,00000000), ref: 00401414
GetFileInformationByHandle.KERNELBASE(?,?), ref: 0040143F
GetEnvironmentStringsW.KERNEL32 ref: 0040144F
lstrlenA.KERNEL32(?), ref: 00401499
KiUserExceptionDispatcher.NTDLL(?), ref: 004014E7
CloseHandle.KERNEL32(?), ref: 00401539
GetWindowLongA.USER32(00000000,00000000), ref: 0040155E
CreateWindowExA.USER32(00000000,RICHEDIT,0047A1E6,50004004,00000000,0000001E,?,?,00000000,00000000,00000000,00000000), ref: 004015AB
SetWindowLongA.USER32(00000000,00000000,00000000), ref: 004015B5
GetClientRect.USER32(00000000,?), ref: 004015D9
DestroyWindow.USER32(00000000), ref: 004015F2
KiUserCallbackDispatcher.NTDLL(00000000,00000000,?,?), ref: 0040162A
TrackMouseEvent.USER32 ref: 00401662
DefWindowProcA.USER32(00000000,00000000,000020CF,0000001C), ref: 00401678
GetDlgItem.USER32(00000000,0000001C), ref: 004016C5
GetWindowPlacement.USER32 ref: 004016E4
SetWindowPlacement.USER32(00000000,?), ref: 0040171A
Rectangle.GDI32(00000000,00000000,00000000,000020CF,0000001C), ref: 0040173A
MoveToEx.GDI32(00000000,000020CF,00000000,00000000), ref: 00401747
GlobalMemoryStatusEx.KERNELBASE ref: 00401760
GetPerformanceInfo.PSAPI(?,00000038), ref: 0040177D
EnumProcesses.PSAPI(?,00001000,?,?,00000038), ref: 0040179E
GetCurrentProcess.KERNEL32(00000028,?,?,00001000,?,?,00000038), ref: 004017B4
OpenProcessToken.ADVAPI32(00000000), ref: 004017BB
CloseHandle.KERNEL32(?), ref: 004017D6
GetVersionExA.KERNEL32 ref: 0040180F
GetOpenFileNameA.COMDLG32(00000058), ref: 0040190F
_lopen.KERNEL32(?,00000000), ref: 00401922
ExitProcess.KERNEL32 ref: 00401983
#185.OLEAUT32 ref: 004019BE
GetCurrentProcess.KERNEL32 ref: 004019FD
SymInitialize.DBGHELP(00000000,00000000,00000000), ref: 00401A0A
SymLoadModuleEx.DBGHELP(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401A35
SymCleanup.DBGHELP(00000000), ref: 00401A51
SymEnumSymbols.DBGHELP(00000000,00000000,?,0047A1E4,Function_00001090,00000000), ref: 00401A66
GetLastError.KERNEL32(?,0047A1E4,Function_00001090,00000000), ref: 00401A74
SymCleanup.DBGHELP(00000000,?,0047A1E4,Function_00001090,00000000), ref: 00401A81
GetDlgItem.USER32(?,000020CF), ref: 00401AA9
GetClassNameA.USER32(00000000,?,00000080), ref: 00401AC1
FindWindowExA.USER32(?,00000000,DirectUIHWND,00000000), ref: 00401B1E
PostMessageA.USER32(?,00000007,00000001,00000000), ref: 00401B33
ShowWindow.USER32(00000000,00000000), ref: 00401B38
PostMessageA.USER32(00000000,00000102,?,00000000), ref: 00401B81
PostMessageA.USER32(00000000,00000100,0000000D,00000000), ref: 00401BB0
ShowWindow.USER32(00000000,00000001), ref: 00401BB5
PostMessageA.USER32(?,00000008,00000001,00000000), ref: 00401BCF
#9.ACTIVEDS(LDAP:,00000000,00000000,00000001,004783D8,?), ref: 00401C41
GetDCEx.USER32(00000000,00000000,00000402), ref: 00401CDB
ClientToScreen.USER32(?,?), ref: 00401CF2
ClientToScreen.USER32(?,?), ref: 00401D02
PatBlt.GDI32(?,?,?,?,?,00550009), ref: 00401D30
ReleaseDC.USER32(00000000,?), ref: 00401D3C
GetObjectA.GDI32(00000000,00000018,?), ref: 00401D4E
CreateBitmapIndirect.GDI32(?), ref: 00401D5C
CreateCompatibleDC.GDI32(00000000), ref: 00401D68
CreateCompatibleDC.GDI32(00000000), ref: 00401D6E
SelectObject.GDI32(00000000,00000000), ref: 00401D77
SelectObject.GDI32(?,?), ref: 00401D83
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00401DA8
DeleteDC.GDI32(00000000), ref: 00401DB5
DeleteDC.GDI32(?), ref: 00401DBC
LoadImageA.USER32(00000000,?,00000000,00000000,00000000,00000010), ref: 00401DE4
GetObjectA.GDI32(00000000,00000018,?), ref: 00401DF7
GetDC.USER32(?), ref: 00401E02
CreateCompatibleDC.GDI32(00000000), ref: 00401E09
SelectObject.GDI32(00000000,00000000), ref: 00401E11
LoadImageA.USER32(00000000,?,00000000,00000000,00000000,00000010), ref: 00401E25
GetObjectA.GDI32(00000000,00000018,?), ref: 00401E3C
GetDC.USER32(?), ref: 00401E47
CreateCompatibleDC.GDI32(00000000), ref: 00401E52
SelectObject.GDI32(00000000,00000000), ref: 00401E5A
GetPixel.GDI32(?,?,?), ref: 00401E8B
SetPixel.GDI32(00000000,00000000,00000000,00000000), ref: 00401E9D
DeleteDC.GDI32(?), ref: 00401EBF
ReleaseDC.USER32(?,?), ref: 00401ECF
DeleteObject.GDI32(?), ref: 00401EDA

Strings

8, xrefs: 00401772
gfff, xrefs: 00401FA2
X, xrefs: 004018B6
Text Files, xrefs: 00401851
QPj, xrefs: 00401673
@, xrefs: 00401755
LDAP:, xrefs: 00401C34
jjj, xrefs: 00401E15
jjj, xrefs: 00401400
RICHEDIT, xrefs: 0040159A
jjj, xrefs: 00401DCC
jjj, xrefs: 00401580
,, xrefs: 004016D9
IMWindowClass, xrefs: 00401AD5
2, xrefs: 004015C3
DirectUIHWND, xrefs: 00401B16
defaultNamingContext, xrefs: 00401C58

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00404E82, Relevance: 36.3, APIs: 24, Instructions: 277

APIs

GetRawInputData.USER32(?,10000003,00000000,?,00000010), ref: 00404F8C
GetRawInputData.USER32(?,10000003,00000000,?,00000010), ref: 00404FB3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000004,?,00000004), ref: 00405002
SetWindowTextA.USER32(?,?), ref: 00405015
DefWindowProcA.USER32(?,?,?,?), ref: 00405034
LoadMenuA.USER32(?,00000000), ref: 00405046
GetSubMenu.USER32(00000000,00000000), ref: 00405051
TrackPopupMenu.USER32(00000000,00000000,?,?,00000000,?,00000000), ref: 00405073
DestroyMenu.USER32(00000000), ref: 0040507A
CoInitialize.OLE32(00000000), ref: 0040508B
CoCreateInstance.OLE32(00478370,00000000,00000001,00478360,?), ref: 004050A7
FindResourceExA.KERNEL32(?,?,?), ref: 00405106
GetDlgItem.USER32(?), ref: 00405114
GetWindowRect.USER32(00000000,?), ref: 00405123
GetDC.USER32(00000000), ref: 0040512B
LoadResource.KERNEL32(?,00000000), ref: 0040513F
SizeofResource.KERNEL32(Function_00001090,00000000), ref: 00405151
LockResource.KERNEL32(00000000), ref: 0040515C
UpdateResourceA.KERNEL32(Function_00001090,?,?,?,00000000,?), ref: 0040517A
LoadImageA.USER32(?,?,00000001,00000010,00000010,00000000), ref: 00405197
GetWindowLongA.USER32(00000000,000000F0), ref: 004051A0
FreeResource.KERNEL32(00000000), ref: 004051A7
EnumResourceTypesA.KERNEL32(?,Function_00001090,00000000), ref: 004051CB
PostQuitMessage.USER32(00000000), ref: 004051E1

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040BD5C, Relevance: 1.5, APIs: 1, Instructions: 4

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000BD1A), ref: 0040BD61

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040C7F0, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 112

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 0040C7FA
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0040C821
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0040C82E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0040C83B
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0040C848
TlsAlloc.KERNEL32 ref: 0040C898
TlsSetValue.KERNEL32(00000000), ref: 0040C8B3

Part of subcall function 0040C3E0: TlsGetValue.KERNEL32(00000000,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C3F2
Part of subcall function 0040C3E0: TlsGetValue.KERNEL32(00000004,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C409
Part of subcall function 0040C3E0: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C41F
Part of subcall function 0040C3E0: GetProcAddress.KERNEL32(00000000,EncodePointer,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C43A
Part of subcall function 0040C3E0: RtlEncodePointer.NTDLL(00000000,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C447

Part of subcall function 0040C45B: TlsGetValue.KERNEL32(00000000,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C46D
Part of subcall function 0040C45B: TlsGetValue.KERNEL32(00000004,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C484
Part of subcall function 0040C45B: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C49A
Part of subcall function 0040C45B: GetProcAddress.KERNEL32(00000000,DecodePointer,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C4B5
Part of subcall function 0040C45B: RtlDecodePointer.NTDLL(?,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C4C2

Part of subcall function 00409BB7: Sleep.KERNEL32(00000000), ref: 00409BDF

Part of subcall function 0040C547: GetModuleHandleW.KERNEL32(KERNEL32.DLL,0047B638,0000000C,0040C682,00000000,00000000,?,00000000,00407469,004083B5), ref: 0040C559
Part of subcall function 0040C547: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0040C58D
Part of subcall function 0040C547: GetProcAddress.KERNEL32(?,DecodePointer), ref: 0040C59D
Part of subcall function 0040C547: InterlockedIncrement.KERNEL32(00481910), ref: 0040C5CC

GetCurrentThreadId.KERNEL32 ref: 0040C962

Part of subcall function 0040C50A: TlsFree.KERNEL32(0000001C,0040C978), ref: 0040C535

Part of subcall function 004092FC: Sleep.KERNEL32(000003E8,00000000,?,0040C4AA,KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 00409308
Part of subcall function 004092FC: GetModuleHandleW.KERNEL32(?,?,0040C4AA,KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 00409311

Strings

KERNEL32.DLL, xrefs: 0040C7F4, 0040C7F9, 0040C804
FlsGetValue, xrefs: 0040C823
FlsFree, xrefs: 0040C83D
FlsAlloc, xrefs: 0040C81B
FlsSetValue, xrefs: 0040C830

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040C3E0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42

APIs

TlsGetValue.KERNEL32(00000000,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C3F2
TlsGetValue.KERNEL32(00000004,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C409
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C41F
RtlEncodePointer.NTDLL(00000000,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C447

Part of subcall function 004092FC: Sleep.KERNEL32(000003E8,00000000,?,0040C4AA,KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 00409308
Part of subcall function 004092FC: GetModuleHandleW.KERNEL32(?,?,0040C4AA,KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 00409311

GetProcAddress.KERNEL32(00000000,EncodePointer,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C43A

Strings

KERNEL32.DLL, xrefs: 0040C419, 0040C41E, 0040C429
EncodePointer, xrefs: 0040C434

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040C45B, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42

APIs

TlsGetValue.KERNEL32(00000000,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C46D
TlsGetValue.KERNEL32(00000004,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C484
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C49A
RtlDecodePointer.NTDLL(?,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C4C2

Part of subcall function 004092FC: Sleep.KERNEL32(000003E8,00000000,?,0040C4AA,KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 00409308
Part of subcall function 004092FC: GetModuleHandleW.KERNEL32(?,?,0040C4AA,KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 00409311

GetProcAddress.KERNEL32(00000000,DecodePointer,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C4B5

Strings

KERNEL32.DLL, xrefs: 0040C494, 0040C499, 0040C4A4
DecodePointer, xrefs: 0040C4AF

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040991E, Relevance: 7.7, APIs: 5, Instructions: 190

APIs

GetStartupInfoA.KERNEL32(?), ref: 00409933

Part of subcall function 00409BB7: Sleep.KERNEL32(00000000), ref: 00409BDF

GetFileType.KERNEL32(00000040), ref: 00409A5D
GetStdHandle.KERNEL32(-000000F6), ref: 00409AE7
GetFileType.KERNEL32(00000000), ref: 00409AF9

Part of subcall function 0040F16F: InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0047B8C8,00000010,0040859B,00000000,00000FA0,0047B4B0,0000000C,004085FC,?,?,?,0040FA0B,00000004,0047B928), ref: 0040F185

SetHandleCount.KERNEL32 ref: 00409B51

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040687C, Relevance: 3.1, APIs: 2, Instructions: 100

APIs

GetStartupInfoA.KERNEL32(?), ref: 00406891

Part of subcall function 004092CC: HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 004092E1

Part of subcall function 0040C7F0: GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 0040C7FA
Part of subcall function 0040C7F0: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0040C821
Part of subcall function 0040C7F0: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0040C82E
Part of subcall function 0040C7F0: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0040C83B
Part of subcall function 0040C7F0: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0040C848
Part of subcall function 0040C7F0: TlsAlloc.KERNEL32 ref: 0040C898
Part of subcall function 0040C7F0: TlsSetValue.KERNEL32(00000000), ref: 0040C8B3
Part of subcall function 0040C7F0: GetCurrentThreadId.KERNEL32 ref: 0040C962

Part of subcall function 0040991E: GetStartupInfoA.KERNEL32(?), ref: 00409933
Part of subcall function 0040991E: GetFileType.KERNEL32(00000040), ref: 00409A5D
Part of subcall function 0040991E: GetStdHandle.KERNEL32(-000000F6), ref: 00409AE7
Part of subcall function 0040991E: GetFileType.KERNEL32(00000000), ref: 00409AF9
Part of subcall function 0040991E: SetHandleCount.KERNEL32 ref: 00409B51

GetCommandLineA.KERNEL32 ref: 00406926

Part of subcall function 0040C25D: GetEnvironmentStringsW.KERNEL32 ref: 0040C27B
Part of subcall function 0040C25D: GetLastError.KERNEL32 ref: 0040C28F
Part of subcall function 0040C25D: GetEnvironmentStringsW.KERNEL32 ref: 0040C2B6
Part of subcall function 0040C25D: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0040C2F0
Part of subcall function 0040C25D: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 0040C313
Part of subcall function 0040C25D: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0040C329
Part of subcall function 0040C25D: GetEnvironmentStrings.KERNEL32 ref: 0040C33C
Part of subcall function 0040C25D: FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0040C36E
Part of subcall function 0040C25D: FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0040C387

Part of subcall function 0040C1A2: GetModuleFileNameA.KERNEL32(00000000,C:\885.exe,00000104), ref: 0040C1CE

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0041BFC1, Relevance: 1.6, Strings: 1, Instructions: 346

Strings

+7rF, xrefs: 0041784C

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 033B3B44, Relevance: 1.5, APIs: 1, Instructions: 20

APIs

CreateThread.KERNEL32(?,?,?,?,?,?), ref: 033B3B6D

Memory Dump Source

Source File: 00000000.00000002.531958156.033B0000.00000040.sdmp, Offset: 033B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33b0000_885.jbxd

Function 004092CC, Relevance: 1.5, APIs: 1, Instructions: 20

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 004092E1

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 033B3CB4, Relevance: 1.5, APIs: 1, Instructions: 18

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 033B3CD7

Memory Dump Source

Source File: 00000000.00000002.531958156.033B0000.00000040.sdmp, Offset: 033B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33b0000_885.jbxd

Function 00425061, Relevance: 1.5, Strings: 1, Instructions: 249

Strings

, xrefs: 0041C893

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040111C, Relevance: 1.5, Strings: 1, Instructions: 242

Strings

]nz8, xrefs: 00401370

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00406781, Relevance: 1.4, Strings: 1, Instructions: 148

Strings

, xrefs: 004067F3

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040CDBB, Relevance: 1.4, Strings: 1, Instructions: 109

Strings

, xrefs: 0040CEDE

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00430FC1, Relevance: 1.3, Strings: 1, Instructions: 96

Strings

`=:, xrefs: 00431027

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040F98A, Relevance: 1.3, APIs: 1, Instructions: 93

APIs

HeapAlloc.KERNEL32(00000008,?,0047B928,0000000C,00409BCD,?,?,00000000,00000000,00000000,?,0040C659,00000001,00000214,?,00000000), ref: 0040FA48

Part of subcall function 004085E1: EnterCriticalSection.KERNEL32(?,?,?,0040FA0B,00000004,0047B928,0000000C,00409BCD,?,?,00000000,00000000,00000000,?,0040C659,00000001), ref: 0040860B

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0042BE86, Relevance: 1.3, Strings: 1, Instructions: 83

Strings

@, xrefs: 0042BF29

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00405DC9, Relevance: 1.3, APIs: 1, Instructions: 77

APIs

HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,00409B83,?,00000001,?,?,0040856B,00000018,0047B4B0,0000000C,004085FC), ref: 00405E40

Part of subcall function 00409634: GetModuleFileNameA.KERNEL32(00000000,00482CF1,00000104), ref: 004096D7
Part of subcall function 00409634: GetStdHandle.KERNEL32(000000F4,779B2DD6,?,00000000,00000003,00000003,?,0040980B,000000FC,00405DF1,?,00409B83,?,00000001,?), ref: 004097AA
Part of subcall function 00409634: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004097D4

Part of subcall function 00409380: ExitProcess.KERNEL32 ref: 00409391

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00409BB7, Relevance: 1.3, APIs: 1, Instructions: 30

APIs

Part of subcall function 0040F98A: HeapAlloc.KERNEL32(00000008,?,0047B928,0000000C,00409BCD,?,?,00000000,00000000,00000000,?,0040C659,00000001,00000214,?,00000000), ref: 0040FA48

Sleep.KERNEL32(00000000), ref: 00409BDF

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 033B0A50, Relevance: 1.3, APIs: 1, Instructions: 18

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 033B0A73

Memory Dump Source

Source File: 00000000.00000002.531958156.033B0000.00000040.sdmp, Offset: 033B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33b0000_885.jbxd

Function 033B3C74, Relevance: 1.3, APIs: 1, Instructions: 18

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 033B3C97

Memory Dump Source

Source File: 00000000.00000002.531958156.033B0000.00000040.sdmp, Offset: 033B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33b0000_885.jbxd

Function 033B09C0, Relevance: 1.3, APIs: 1, Instructions: 16

APIs

GlobalAlloc.KERNELBASE(?,?), ref: 033B09DD

Memory Dump Source

Source File: 00000000.00000002.531958156.033B0000.00000040.sdmp, Offset: 033B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33b0000_885.jbxd

Function 033B3B84, Relevance: 1.3, APIs: 1, Instructions: 16

APIs

GlobalAlloc.KERNELBASE(?,?), ref: 033B3BA1

Memory Dump Source

Source File: 00000000.00000002.531958156.033B0000.00000040.sdmp, Offset: 033B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33b0000_885.jbxd

Function 033B3B14, Relevance: 1.3, APIs: 1, Instructions: 13

APIs

Sleep.KERNELBASE(?), ref: 033B3B2E

Memory Dump Source

Source File: 00000000.00000002.531958156.033B0000.00000040.sdmp, Offset: 033B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33b0000_885.jbxd

Function 0041902F, Relevance: .5, Instructions: 476

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0041236E, Relevance: .5, Instructions: 463

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042FDA2, Relevance: .4, Instructions: 431

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042FDAC, Relevance: .4, Instructions: 429

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00431E54, Relevance: .3, Instructions: 343

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004293FF, Relevance: .3, Instructions: 340

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00417437, Relevance: .3, Instructions: 338

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00415869, Relevance: .3, Instructions: 300

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040319C, Relevance: .3, Instructions: 294

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042D590, Relevance: .3, Instructions: 290

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040BF90, Relevance: .3, Instructions: 258

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00412878, Relevance: .3, Instructions: 258

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040F9CA, Relevance: .2, Instructions: 238

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042DD66, Relevance: .2, Instructions: 238

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040F325, Relevance: .2, Instructions: 236

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00407BB7, Relevance: .2, Instructions: 235

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00405A3E, Relevance: .2, Instructions: 233

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00409299, Relevance: .2, Instructions: 230

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004202D8, Relevance: .2, Instructions: 227

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0043A33E, Relevance: .2, Instructions: 225

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040813E, Relevance: .2, Instructions: 224

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00420E03, Relevance: .2, Instructions: 223

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0041879C, Relevance: .2, Instructions: 216

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042C366, Relevance: .2, Instructions: 214

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004218FF, Relevance: .2, Instructions: 208

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0041BF1B, Relevance: .2, Instructions: 205

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00422026, Relevance: .2, Instructions: 202

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004073F6, Relevance: .2, Instructions: 187

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00421956, Relevance: .2, Instructions: 179

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042908E, Relevance: .2, Instructions: 170

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00413C00, Relevance: .2, Instructions: 167

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00409D33, Relevance: .2, Instructions: 166

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040C4F3, Relevance: .2, Instructions: 163

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00416EC8, Relevance: .2, Instructions: 162

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004371D3, Relevance: .2, Instructions: 161

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040B3C8, Relevance: .1, Instructions: 147

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0043AC02, Relevance: .1, Instructions: 147

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042A515, Relevance: .1, Instructions: 145

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00411995, Relevance: .1, Instructions: 141

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00412157, Relevance: .1, Instructions: 136

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042C1BA, Relevance: .1, Instructions: 133

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040FB7C, Relevance: .1, Instructions: 129

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00420FA8, Relevance: .1, Instructions: 129

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00403E3B, Relevance: .1, Instructions: 128

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040D339, Relevance: .1, Instructions: 126

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040C1A0, Relevance: .1, Instructions: 125

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040C526, Relevance: .1, Instructions: 120

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042B832, Relevance: .1, Instructions: 119

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042AA11, Relevance: .1, Instructions: 114

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004044AB, Relevance: .1, Instructions: 111

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004307F2, Relevance: .1, Instructions: 111

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040C304, Relevance: .1, Instructions: 106

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004021CF, Relevance: .1, Instructions: 103

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00417E14, Relevance: .1, Instructions: 101

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004232BA, Relevance: .1, Instructions: 98

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00426742, Relevance: .1, Instructions: 98

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004257FB, Relevance: .1, Instructions: 97

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00436C8C, Relevance: .1, Instructions: 95

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00436D92, Relevance: .1, Instructions: 91

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00417C4A, Relevance: .1, Instructions: 90

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040C7DF, Relevance: .1, Instructions: 89

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004399B4, Relevance: .1, Instructions: 88

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0041003F, Relevance: .1, Instructions: 88

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00437CA1, Relevance: .1, Instructions: 86

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042F312, Relevance: .1, Instructions: 86

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040DAA0, Relevance: .1, Instructions: 79

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042076F, Relevance: .1, Instructions: 78

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00418425, Relevance: .1, Instructions: 73

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00432479, Relevance: .1, Instructions: 72

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004345F9, Relevance: .1, Instructions: 69

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040747E, Relevance: .1, Instructions: 66

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040FD8B, Relevance: .1, Instructions: 66

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040996F, Relevance: .1, Instructions: 65

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040F4E3, Relevance: .1, Instructions: 65

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00404ECE, Relevance: .1, Instructions: 64

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00426D25, Relevance: .1, Instructions: 63

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0041B416, Relevance: .1, Instructions: 55

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004118BD, Relevance: .1, Instructions: 55

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004204B9, Relevance: .1, Instructions: 53

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004064F4, Relevance: .1, Instructions: 53

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004016CE, Relevance: .1, Instructions: 52

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00426473, Relevance: .1, Instructions: 51

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040FC40, Relevance: .0, Instructions: 49

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0041B1DA, Relevance: .0, Instructions: 48

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004262D8, Relevance: .0, Instructions: 48

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00412D59, Relevance: .0, Instructions: 48

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004311B4, Relevance: .0, Instructions: 48

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0041A0E7, Relevance: .0, Instructions: 47

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040EDAA, Relevance: .0, Instructions: 45

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042CA5F, Relevance: .0, Instructions: 43

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00402839, Relevance: .0, Instructions: 43

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00405F67, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040B540, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004025E4, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0041C6CE, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042A982, Relevance: .0, Instructions: 40

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0041CF0D, Relevance: .0, Instructions: 39

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0043A584, Relevance: .0, Instructions: 38

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004033E7, Relevance: .0, Instructions: 37

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042C6AE, Relevance: .0, Instructions: 37

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00401B26, Relevance: .0, Instructions: 37

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00406C6A, Relevance: .0, Instructions: 36

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0043B6CA, Relevance: .0, Instructions: 36

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00404E88, Relevance: .0, Instructions: 35

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040CD5C, Relevance: .0, Instructions: 35

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042CED0, Relevance: .0, Instructions: 35

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00401BD6, Relevance: .0, Instructions: 34

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00419C71, Relevance: .0, Instructions: 33

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00402CDC, Relevance: .0, Instructions: 32

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00427F8B, Relevance: .0, Instructions: 32

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00433E73, Relevance: .0, Instructions: 31

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040A7E7, Relevance: .0, Instructions: 30

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00411D6E, Relevance: .0, Instructions: 30

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0043B0E9, Relevance: .0, Instructions: 29

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004242B7, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004374E4, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00432253, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00414E40, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040D3D8, Relevance: .0, Instructions: 24

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00412B93, Relevance: .0, Instructions: 24

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00425C82, Relevance: .0, Instructions: 24

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040C8EE, Relevance: .0, Instructions: 24

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00405B60, Relevance: .0, Instructions: 23

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00410D28, Relevance: .0, Instructions: 23

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042B1B6, Relevance: .0, Instructions: 23

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00432435, Relevance: .0, Instructions: 23

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00420163, Relevance: .0, Instructions: 23

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00427136, Relevance: .0, Instructions: 22

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004206EC, Relevance: .0, Instructions: 22

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040CBCB, Relevance: .0, Instructions: 22

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004194FF, Relevance: .0, Instructions: 21

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040B1BE, Relevance: .0, Instructions: 21

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00408E11, Relevance: .0, Instructions: 21

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00423296, Relevance: .0, Instructions: 20

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0043AAC5, Relevance: .0, Instructions: 18

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040A4AF, Relevance: .0, Instructions: 17

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00423802, Relevance: .0, Instructions: 17

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042E522, Relevance: .0, Instructions: 16

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00415917, Relevance: .0, Instructions: 16

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00405C0E, Relevance: .0, Instructions: 15

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0040B173, Relevance: .0, Instructions: 15

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00405811, Relevance: .0, Instructions: 14

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0042E4F5, Relevance: .0, Instructions: 12

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00409FF1, Relevance: .0, Instructions: 10

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00401000, Relevance: .0, Instructions: 9

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00430978, Relevance: .0, Instructions: 2

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00430996, Relevance: .0, Instructions: 2

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 0043098C, Relevance: .0, Instructions: 2

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004309A0, Relevance: .0, Instructions: 2

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 00430982, Relevance: .0, Instructions: 2

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Non-executed Functions

Function 0040F6AD, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 128

APIs

LoadLibraryA.KERNEL32(USER32.DLL), ref: 0040F6D5
GetProcAddress.KERNEL32(00000000,MessageBoxA,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library), ref: 0040F6F1

Part of subcall function 0040C3E0: TlsGetValue.KERNEL32(00000000,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C3F2
Part of subcall function 0040C3E0: TlsGetValue.KERNEL32(00000004,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C409
Part of subcall function 0040C3E0: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C41F
Part of subcall function 0040C3E0: GetProcAddress.KERNEL32(00000000,EncodePointer,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C43A
Part of subcall function 0040C3E0: RtlEncodePointer.NTDLL(00000000,?,0040C459,00000000,0040F6BD,00482CD8,00000000,00000314,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C447

GetProcAddress.KERNEL32(00000000,00000000,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library), ref: 0040F70E
GetProcAddress.KERNEL32(00000000,00000000,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library), ref: 0040F723
GetProcAddress.KERNEL32(00000000,00000000,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library), ref: 0040F738
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library), ref: 0040F750

Part of subcall function 0040C45B: TlsGetValue.KERNEL32(00000000,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C46D
Part of subcall function 0040C45B: TlsGetValue.KERNEL32(00000004,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C484
Part of subcall function 0040C45B: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C49A
Part of subcall function 0040C45B: GetProcAddress.KERNEL32(00000000,DecodePointer,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C4B5
Part of subcall function 0040C45B: RtlDecodePointer.NTDLL(?,?,0040C4F6,?,00000000,00407469,004083B5), ref: 0040C4C2

Strings

USER32.DLL, xrefs: 0040F6D0
GetProcessWindowStation, xrefs: 0040F74A
MessageBoxA, xrefs: 0040F6EB

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00406ECD, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58

APIs

IsDebuggerPresent.KERNEL32 ref: 0040D877
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D88C
UnhandledExceptionFilter.KERNEL32(1H), ref: 0040D897
GetCurrentProcess.KERNEL32(C0000409), ref: 0040D8B3
TerminateProcess.KERNEL32(00000000), ref: 0040D8BA

Strings

1H, xrefs: 0040D892

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 004072D4, Relevance: 7.6, APIs: 5, Instructions: 67

APIs

IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 004073B0
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004073BA
UnhandledExceptionFilter.KERNEL32(?), ref: 004073C7
GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 004073E2
TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 004073E9

Part of subcall function 00406ECD: IsDebuggerPresent.KERNEL32 ref: 0040D877
Part of subcall function 00406ECD: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D88C
Part of subcall function 00406ECD: UnhandledExceptionFilter.KERNEL32(1H), ref: 0040D897
Part of subcall function 00406ECD: GetCurrentProcess.KERNEL32(C0000409), ref: 0040D8B3
Part of subcall function 00406ECD: TerminateProcess.KERNEL32(00000000), ref: 0040D8BA

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040C97D, Relevance: 7.6, APIs: 5, Instructions: 53

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0040C9B4
GetCurrentProcessId.KERNEL32 ref: 0040C9C0
GetCurrentThreadId.KERNEL32 ref: 0040C9C8
GetTickCount.KERNEL32 ref: 0040C9D0
QueryPerformanceCounter.KERNEL32(?), ref: 0040C9DC

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040AD94, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 304

APIs

Part of subcall function 004085E1: EnterCriticalSection.KERNEL32(?,?,?,0040FA0B,00000004,0047B928,0000000C,00409BCD,?,?,00000000,00000000,00000000,?,0040C659,00000001), ref: 0040860B

Part of subcall function 00409B72: Sleep.KERNEL32(00000000,00000001,?,?,0040856B,00000018,0047B4B0,0000000C,004085FC,?,?,?,0040FA0B,00000004,0047B928,0000000C), ref: 00409B93

GetTimeZoneInformation.KERNEL32(00483008,0047B578,0000002C,0040B4D7,0047B598,00000008,00406530), ref: 0040AEE0
WideCharToMultiByte.KERNEL32(?,00000000,0048300C,?,?,0000003F,00000000,?), ref: 0040AF5E
WideCharToMultiByte.KERNEL32(000000FF,00000000,00483060,000000FF,?,0000003F,00000000,?), ref: 0040AF92

Part of subcall function 004072D4: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 004073B0
Part of subcall function 004072D4: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004073BA
Part of subcall function 004072D4: UnhandledExceptionFilter.KERNEL32(?), ref: 004073C7
Part of subcall function 004072D4: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 004073E2
Part of subcall function 004072D4: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 004073E9

Part of subcall function 0040833E: HeapFree.KERNEL32(00000000,00000000,0047B490), ref: 004083A6
Part of subcall function 0040833E: GetLastError.KERNEL32 ref: 004083B7

Strings

0e@, xrefs: 0040ADE2, 0040ADE5

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0041126F, Relevance: 4.6, APIs: 3, Instructions: 82

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041136B
UnhandledExceptionFilter.KERNEL32(?), ref: 00411378
RtlUnwind.KERNEL32(00000003,004113A0,00000000,00000000,?,E06D7363,1FFFFFFF,00000000,?,00000003,1FFFFFFF), ref: 0041139B

Part of subcall function 00409634: GetModuleFileNameA.KERNEL32(00000000,00482CF1,00000104), ref: 004096D7
Part of subcall function 00409634: GetStdHandle.KERNEL32(000000F4,779B2DD6,?,00000000,00000003,00000003,?,0040980B,000000FC,00405DF1,?,00409B83,?,00000001,?), ref: 004097AA
Part of subcall function 00409634: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004097D4

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00413655, Relevance: 1.5, APIs: 1, Instructions: 27

APIs

GetLocaleInfoA.KERNEL32(7FFFFFFF,00001004,00000000,00000006,00000000,7FFFFFFF,00000000,?,?,?,00415CD5,002E1888,00000000,?), ref: 00413679

Part of subcall function 00406ECD: IsDebuggerPresent.KERNEL32 ref: 0040D877
Part of subcall function 00406ECD: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D88C
Part of subcall function 00406ECD: UnhandledExceptionFilter.KERNEL32(1H), ref: 0040D897
Part of subcall function 00406ECD: GetCurrentProcess.KERNEL32(C0000409), ref: 0040D8B3
Part of subcall function 00406ECD: TerminateProcess.KERNEL32(00000000), ref: 0040D8BA

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00466B02, Relevance: .0, Instructions: 40

Memory Dump Source

Source File: 00000000.00000002.415461750.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.415362241.00400000.00000002.sdmp
Associated: 00000000.00000002.416649048.0048C000.00000004.sdmp
Associated: 00000000.00000002.417065923.0048D000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_885.jbxd

Function 004118CB, Relevance: 16.8, APIs: 11, Instructions: 340

APIs

LCMapStringW.KERNEL32(00000000,00000100,00479870,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004118FD
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,00000000,00000000,00000000,7FFFFFFF,00000000,00000000,7FFFFFFF,00000000,00000000,00000000,002E1888), ref: 0041190F
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 0041199B
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,00000000,00000000,00000000,7FFFFFFF,00000000), ref: 00411A07
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,00000000,00000000,00000000,7FFFFFFF,00000000), ref: 00411A23
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00411A5D
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00411AC1
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 00411AE4

Part of subcall function 00413655: GetLocaleInfoA.KERNEL32(7FFFFFFF,00001004,00000000,00000006,00000000,7FFFFFFF,00000000,?,?,?,00415CD5,002E1888,00000000,?), ref: 00413679

LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 00411B74

Part of subcall function 00405DC9: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,00409B83,?,00000001,?,?,0040856B,00000018,0047B4B0,0000000C,004085FC), ref: 00405E40

LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 00411BE6
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00411C33

Part of subcall function 00406ECD: IsDebuggerPresent.KERNEL32 ref: 0040D877
Part of subcall function 00406ECD: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D88C
Part of subcall function 00406ECD: UnhandledExceptionFilter.KERNEL32(1H), ref: 0040D897
Part of subcall function 00406ECD: GetCurrentProcess.KERNEL32(C0000409), ref: 0040D8B3
Part of subcall function 00406ECD: TerminateProcess.KERNEL32(00000000), ref: 0040D8BA

Part of subcall function 0040833E: HeapFree.KERNEL32(00000000,00000000,0047B490), ref: 004083A6
Part of subcall function 0040833E: GetLastError.KERNEL32 ref: 004083B7

Part of subcall function 0041369E: GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,00411E9F,00000001,?,00000000,?,?,?), ref: 004136E9
Part of subcall function 0041369E: GetCPInfo.KERNEL32(?,00000001,?,00411E9F,00000001,?), ref: 00413702
Part of subcall function 0041369E: MultiByteToWideChar.KERNEL32(?,00000001,?,00411E9F,00000000,00000000,?,00411E9F,00000001,?,00000000,?,?,?,?,00000000), ref: 00413760
Part of subcall function 0041369E: MultiByteToWideChar.KERNEL32(?,00000001,?,00411E9F,?,00000000,?,?,?,?,?,?,?,00411E9F,00000001,?), ref: 004137AF
Part of subcall function 0041369E: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 004137CA
Part of subcall function 0041369E: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 004137F0
Part of subcall function 0041369E: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 00413815

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00409634, Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 161

APIs

GetModuleFileNameA.KERNEL32(00000000,00482CF1,00000104), ref: 004096D7

Part of subcall function 0040F6AD: LoadLibraryA.KERNEL32(USER32.DLL), ref: 0040F6D5
Part of subcall function 0040F6AD: GetProcAddress.KERNEL32(00000000,MessageBoxA,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library), ref: 0040F6F1
Part of subcall function 0040F6AD: GetProcAddress.KERNEL32(00000000,00000000,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library), ref: 0040F70E
Part of subcall function 0040F6AD: GetProcAddress.KERNEL32(00000000,00000000,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library), ref: 0040F723
Part of subcall function 0040F6AD: GetProcAddress.KERNEL32(00000000,00000000,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library), ref: 0040F738
Part of subcall function 0040F6AD: GetProcAddress.KERNEL32(00000000,GetProcessWindowStation,?,004097A3,00482CD8,Microsoft Visual C++ Runtime Library), ref: 0040F750

Part of subcall function 004072D4: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 004073B0
Part of subcall function 004072D4: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004073BA
Part of subcall function 004072D4: UnhandledExceptionFilter.KERNEL32(?), ref: 004073C7
Part of subcall function 004072D4: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 004073E2
Part of subcall function 004072D4: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 004073E9

GetStdHandle.KERNEL32(000000F4,779B2DD6,?,00000000,00000003,00000003,?,0040980B,000000FC,00405DF1,?,00409B83,?,00000001,?), ref: 004097AA
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004097D4

Strings

/H, xrefs: 00409721
..., xrefs: 00409726
Runtime Error!Program: , xrefs: 00409699
Microsoft Visual C++ Runtime Library, xrefs: 00409798
<program name unknown>, xrefs: 004096E1

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00415935, Relevance: 13.8, APIs: 9, Instructions: 328

APIs

CompareStringW.KERNEL32(00000000,00000000,00479870,00000001,00479870,00000001,00000000,7FFFFFFF,00000000,?,?,?,00415CD5,002E1888,00000000,?), ref: 0041596E
GetLastError.KERNEL32(?,?,?,00415CD5,002E1888,00000000,?,?,?,?,00000000,00000000,002E1888,00000000,00000000,0040B4D7), ref: 00415984
GetCPInfo.KERNEL32(002E1888,00000000,00000000,7FFFFFFF,00000000,?,?,?,00415CD5,002E1888,00000000,?), ref: 00415A36
MultiByteToWideChar.KERNEL32(002E1888,00000009,00000000,000000FF,00000000,00000000,?,?,?,00415CD5,002E1888,00000000,?), ref: 00415ABC
MultiByteToWideChar.KERNEL32(002E1888,00000001,?,000000FF,00000000,00000000), ref: 00415B31
MultiByteToWideChar.KERNEL32(002E1888,00000009,002E1888,00000000,00000000,00000000), ref: 00415B4A

Part of subcall function 00405DC9: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,00409B83,?,00000001,?,?,0040856B,00000018,0047B4B0,0000000C,004085FC), ref: 00405E40

MultiByteToWideChar.KERNEL32(002E1888,00000001,002E1888,00000000,00000000,00000000), ref: 00415BA9
CompareStringW.KERNEL32(?,?,00000000,?,00000000,00000000), ref: 00415BBD

Part of subcall function 00413655: GetLocaleInfoA.KERNEL32(7FFFFFFF,00001004,00000000,00000006,00000000,7FFFFFFF,00000000,?,?,?,00415CD5,002E1888,00000000,?), ref: 00413679

CompareStringA.KERNEL32(?,?,?,000000FF,002E1888,00000000,00000000,7FFFFFFF,00000000,?,?,?,00415CD5,002E1888,00000000,?), ref: 00415C77

Part of subcall function 0040833E: HeapFree.KERNEL32(00000000,00000000,0047B490), ref: 004083A6
Part of subcall function 0040833E: GetLastError.KERNEL32 ref: 004083B7

Part of subcall function 0041369E: GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,00411E9F,00000001,?,00000000,?,?,?), ref: 004136E9
Part of subcall function 0041369E: GetCPInfo.KERNEL32(?,00000001,?,00411E9F,00000001,?), ref: 00413702
Part of subcall function 0041369E: MultiByteToWideChar.KERNEL32(?,00000001,?,00411E9F,00000000,00000000,?,00411E9F,00000001,?,00000000,?,?,?,?,00000000), ref: 00413760
Part of subcall function 0041369E: MultiByteToWideChar.KERNEL32(?,00000001,?,00411E9F,?,00000000,?,?,?,?,?,?,?,00411E9F,00000001,?), ref: 004137AF
Part of subcall function 0041369E: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 004137CA
Part of subcall function 0041369E: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 004137F0
Part of subcall function 0041369E: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 00413815

Part of subcall function 00406ECD: IsDebuggerPresent.KERNEL32 ref: 0040D877
Part of subcall function 00406ECD: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D88C
Part of subcall function 00406ECD: UnhandledExceptionFilter.KERNEL32(1H), ref: 0040D897
Part of subcall function 00406ECD: GetCurrentProcess.KERNEL32(C0000409), ref: 0040D8B3
Part of subcall function 00406ECD: TerminateProcess.KERNEL32(00000000), ref: 0040D8BA

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040C25D, Relevance: 13.6, APIs: 9, Instructions: 132

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0040C27B
GetLastError.KERNEL32 ref: 0040C28F
GetEnvironmentStringsW.KERNEL32 ref: 0040C2B6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0040C2F0
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 0040C313

Part of subcall function 0040833E: HeapFree.KERNEL32(00000000,00000000,0047B490), ref: 004083A6
Part of subcall function 0040833E: GetLastError.KERNEL32 ref: 004083B7

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0040C329
GetEnvironmentStrings.KERNEL32 ref: 0040C33C

Part of subcall function 00409B72: Sleep.KERNEL32(00000000,00000001,?,?,0040856B,00000018,0047B4B0,0000000C,004085FC,?,?,?,0040FA0B,00000004,0047B928,0000000C), ref: 00409B93

FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0040C36E
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0040C387

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040C547, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0047B638,0000000C,0040C682,00000000,00000000,?,00000000,00407469,004083B5), ref: 0040C559
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0040C58D
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0040C59D

Part of subcall function 004085E1: EnterCriticalSection.KERNEL32(?,?,?,0040FA0B,00000004,0047B928,0000000C,00409BCD,?,?,00000000,00000000,00000000,?,0040C659,00000001), ref: 0040860B

InterlockedIncrement.KERNEL32(00481910), ref: 0040C5CC

Part of subcall function 0040ED79: InterlockedIncrement.KERNEL32(?,00000001,?,?,?,0040C603,?), ref: 0040ED8B
Part of subcall function 0040ED79: InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040ED98
Part of subcall function 0040ED79: InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040EDA5
Part of subcall function 0040ED79: InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040EDB2
Part of subcall function 0040ED79: InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040EDBF
Part of subcall function 0040ED79: InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040EDDB
Part of subcall function 0040ED79: InterlockedIncrement.KERNEL32(00000000,?,?,0040C603,?), ref: 0040EDEB
Part of subcall function 0040ED79: InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040EE01

Part of subcall function 004092FC: Sleep.KERNEL32(000003E8,00000000,?,0040C4AA,KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 00409308
Part of subcall function 004092FC: GetModuleHandleW.KERNEL32(?,?,0040C4AA,KERNEL32.DLL,?,0040C4F6,?,00000000,00407469,004083B5), ref: 00409311

Strings

KERNEL32.DLL, xrefs: 0040C553, 0040C558, 0040C563
DecodePointer, xrefs: 0040C595
EncodePointer, xrefs: 0040C581

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040EE08, Relevance: 12.1, APIs: 8, Instructions: 61

APIs

InterlockedDecrement.KERNEL32(?,00000000,?,00481E40,?,0040EEC3,00000000,00000000,0040EF38,0047B8A8,0000000C,00407651,?,?,004077A5,?), ref: 0040EE22
InterlockedDecrement.KERNEL32(?,?,0040EEC3,00000000,00000000,0040EF38,0047B8A8,0000000C,00407651,?,?,004077A5,?,?,?), ref: 0040EE2F
InterlockedDecrement.KERNEL32(?,?,0040EEC3,00000000,00000000,0040EF38,0047B8A8,0000000C,00407651,?,?,004077A5,?,?,?), ref: 0040EE3C
InterlockedDecrement.KERNEL32(?,?,0040EEC3,00000000,00000000,0040EF38,0047B8A8,0000000C,00407651,?,?,004077A5,?,?,?), ref: 0040EE49
InterlockedDecrement.KERNEL32(?,?,0040EEC3,00000000,00000000,0040EF38,0047B8A8,0000000C,00407651,?,?,004077A5,?,?,?), ref: 0040EE56
InterlockedDecrement.KERNEL32(?,?,0040EEC3,00000000,00000000,0040EF38,0047B8A8,0000000C,00407651,?,?,004077A5,?), ref: 0040EE72
InterlockedDecrement.KERNEL32(00000000,?,0040EEC3,00000000,00000000,0040EF38,0047B8A8,0000000C,00407651,?,?,004077A5,?), ref: 0040EE82
InterlockedDecrement.KERNEL32(?,?,0040EEC3,00000000,00000000,0040EF38,0047B8A8,0000000C,00407651,?,?,004077A5,?), ref: 0040EE98

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040ED79, Relevance: 12.1, APIs: 8, Instructions: 58

APIs

InterlockedIncrement.KERNEL32(?,00000001,?,?,?,0040C603,?), ref: 0040ED8B
InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040ED98
InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040EDA5
InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040EDB2
InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040EDBF
InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040EDDB
InterlockedIncrement.KERNEL32(00000000,?,?,0040C603,?), ref: 0040EDEB
InterlockedIncrement.KERNEL32(?,?,?,0040C603,?), ref: 0040EE01

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0041369E, Relevance: 10.7, APIs: 7, Instructions: 175

APIs

GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,00411E9F,00000001,?,00000000,?,?,?), ref: 004136E9
GetCPInfo.KERNEL32(?,00000001,?,00411E9F,00000001,?), ref: 00413702
MultiByteToWideChar.KERNEL32(?,00000001,?,00411E9F,00000000,00000000,?,00411E9F,00000001,?,00000000,?,?,?,?,00000000), ref: 00413760

Part of subcall function 00405DC9: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,00409B83,?,00000001,?,?,0040856B,00000018,0047B4B0,0000000C,004085FC), ref: 00405E40

MultiByteToWideChar.KERNEL32(?,00000001,?,00411E9F,?,00000000,?,?,?,?,?,?,?,00411E9F,00000001,?), ref: 004137AF
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 004137CA
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 004137F0

Part of subcall function 00409BB7: Sleep.KERNEL32(00000000), ref: 00409BDF

WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 00413815

Part of subcall function 0040833E: HeapFree.KERNEL32(00000000,00000000,0047B490), ref: 004083A6
Part of subcall function 0040833E: GetLastError.KERNEL32 ref: 004083B7

Part of subcall function 00406ECD: IsDebuggerPresent.KERNEL32 ref: 0040D877
Part of subcall function 00406ECD: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D88C
Part of subcall function 00406ECD: UnhandledExceptionFilter.KERNEL32(1H), ref: 0040D897
Part of subcall function 00406ECD: GetCurrentProcess.KERNEL32(C0000409), ref: 0040D8B3
Part of subcall function 00406ECD: TerminateProcess.KERNEL32(00000000), ref: 0040D8BA

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00411CB5, Relevance: 9.2, APIs: 6, Instructions: 166

APIs

GetStringTypeW.KERNEL32(00000001,00479870,00000001,?,00000002,00000000,00000000,?,?,?,00411E9F,00000001,?,00000000,?,?), ref: 00411CE4
GetLastError.KERNEL32(?,00411E9F,00000001,?,00000000,?,?,?,?,00000000,?,00000001,00000000,00000000), ref: 00411CF6
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000002,00000000,00000000,?,?,?,00411E9F,00000001,?,00000000), ref: 00411D5B

Part of subcall function 00405DC9: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,00409B83,?,00000001,?,?,0040856B,00000018,0047B4B0,0000000C,004085FC), ref: 00405E40

MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,00000000,?,00000001,00000000,00000000,?,?,00000000), ref: 00411DC5
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 00411DD3

Part of subcall function 00413655: GetLocaleInfoA.KERNEL32(7FFFFFFF,00001004,00000000,00000006,00000000,7FFFFFFF,00000000,?,?,?,00415CD5,002E1888,00000000,?), ref: 00413679

GetStringTypeA.KERNEL32(?,?,?,?,?,00000002,00000000,00000000,?,?,?,00411E9F,00000001,?,00000000,?), ref: 00411E48

Part of subcall function 00406ECD: IsDebuggerPresent.KERNEL32 ref: 0040D877
Part of subcall function 00406ECD: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D88C
Part of subcall function 00406ECD: UnhandledExceptionFilter.KERNEL32(1H), ref: 0040D897
Part of subcall function 00406ECD: GetCurrentProcess.KERNEL32(C0000409), ref: 0040D8B3
Part of subcall function 00406ECD: TerminateProcess.KERNEL32(00000000), ref: 0040D8BA

Part of subcall function 0040833E: HeapFree.KERNEL32(00000000,00000000,0047B490), ref: 004083A6
Part of subcall function 0040833E: GetLastError.KERNEL32 ref: 004083B7

Part of subcall function 0041369E: GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,00411E9F,00000001,?,00000000,?,?,?), ref: 004136E9
Part of subcall function 0041369E: GetCPInfo.KERNEL32(?,00000001,?,00411E9F,00000001,?), ref: 00413702
Part of subcall function 0041369E: MultiByteToWideChar.KERNEL32(?,00000001,?,00411E9F,00000000,00000000,?,00411E9F,00000001,?,00000000,?,?,?,?,00000000), ref: 00413760
Part of subcall function 0041369E: MultiByteToWideChar.KERNEL32(?,00000001,?,00411E9F,?,00000000,?,?,?,?,?,?,?,00411E9F,00000001,?), ref: 004137AF
Part of subcall function 0041369E: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 004137CA
Part of subcall function 0041369E: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 004137F0
Part of subcall function 0041369E: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00411E9F), ref: 00413815

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00411683, Relevance: 7.6, APIs: 5, Instructions: 69

APIs

WriteConsoleW.KERNEL32(FFFFFFFE,?,00000001,?,00000000), ref: 004116CB
GetLastError.KERNEL32(?,?,00000000), ref: 004116DE
GetConsoleOutputCP.KERNEL32 ref: 004116FE
WideCharToMultiByte.KERNEL32(00000000,?,?,00000000), ref: 00411705
WriteConsoleA.KERNEL32(FFFFFFFE,?,00000000,00000000,00000000), ref: 00411721

Part of subcall function 00406ECD: IsDebuggerPresent.KERNEL32 ref: 0040D877
Part of subcall function 00406ECD: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D88C
Part of subcall function 00406ECD: UnhandledExceptionFilter.KERNEL32(1H), ref: 0040D897
Part of subcall function 00406ECD: GetCurrentProcess.KERNEL32(C0000409), ref: 0040D8B3
Part of subcall function 00406ECD: TerminateProcess.KERNEL32(00000000), ref: 0040D8BA

Part of subcall function 00413609: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000), ref: 0041361C

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00410F00, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040AD4D), ref: 00410F05
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00410F15

Strings

KERNEL32, xrefs: 00410F00
IsProcessorFeaturePresent, xrefs: 00410F0F

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00409355, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16

APIs

GetModuleHandleW.KERNEL32(mscoree.dll,?,0040938D,?,?,00405E02,000000FF,0000001E,?,00409B83,?,00000001,?,?,0040856B,00000018), ref: 0040935F
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,0040938D,?,?,00405E02,000000FF,0000001E,?,00409B83,?,00000001,?,?,0040856B), ref: 0040936F

Strings

CorExitProcess, xrefs: 00409369
mscoree.dll, xrefs: 0040935A

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040FAA8, Relevance: 6.4, APIs: 5, Instructions: 181

APIs

GetLastError.KERNEL32(?,0040BC58,00000000,00000010,00000000,?,:h@,0040BCE4,:h@,0047B618,0000000C,0040BD10,0040683A,?,0040683A), ref: 0040FCB0

Part of subcall function 004085E1: EnterCriticalSection.KERNEL32(?,?,?,0040FA0B,00000004,0047B928,0000000C,00409BCD,?,?,00000000,00000000,00000000,?,0040C659,00000001), ref: 0040860B

Part of subcall function 0040833E: HeapFree.KERNEL32(00000000,00000000,0047B490), ref: 004083A6
Part of subcall function 0040833E: GetLastError.KERNEL32 ref: 004083B7

HeapAlloc.KERNEL32(00000000,?,0047B948,00000010,00409C17,0040683A,?,00000000,00000000,?,0040BC58,00000000,00000010,00000000,?,:h@), ref: 0040FB85

Part of subcall function 00408644: VirtualFree.KERNEL32(?,00008000,00004000,?,?,00000000), ref: 0040888D
Part of subcall function 00408644: VirtualFree.KERNEL32(?,00000000,00008000), ref: 004088E8
Part of subcall function 00408644: HeapFree.KERNEL32(00000000,?), ref: 004088FA

HeapReAlloc.KERNEL32(00000000,0040683A,?,0047B948,00000010,00409C17,0040683A,?,00000000,00000000,?,0040BC58,00000000,00000010,00000000), ref: 0040FBDC
GetLastError.KERNEL32(?,0040BC58,00000000,00000010,00000000,?,:h@,0040BCE4,:h@,0047B618,0000000C,0040BD10,0040683A,?,0040683A), ref: 0040FC23
HeapReAlloc.KERNEL32(00000000,0040683A,?,0047B948,00000010,00409C17,0040683A,?,00000000,00000000,?,0040BC58,00000000,00000010,00000000), ref: 0040FC5D

Part of subcall function 00405DC9: HeapAlloc.KERNEL32(00000000,?,00000001,00000000,00000000,?,00409B83,?,00000001,?,?,0040856B,00000018,0047B4B0,0000000C,004085FC), ref: 00405E40

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040EA78, Relevance: 6.1, APIs: 4, Instructions: 116

APIs

Part of subcall function 0040E773: InterlockedDecrement.KERNEL32(?,0047B868,0000000C,00407671,?,?,004077A5,?,?,?), ref: 0040E7CC
Part of subcall function 0040E773: InterlockedIncrement.KERNEL32(002E1640,0047B868,0000000C,00407671,?,?,004077A5,?,?,?), ref: 0040E7F7

Part of subcall function 0040E817: GetOEMCP.KERNEL32(00000000,?), ref: 0040E840
Part of subcall function 0040E817: GetACP.KERNEL32(00000000,?), ref: 0040E863

Part of subcall function 00409B72: Sleep.KERNEL32(00000000,00000001,?,?,0040856B,00000018,0047B4B0,0000000C,004085FC,?,?,?,0040FA0B,00000004,0047B928,0000000C), ref: 00409B93

Part of subcall function 0040E893: IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000), ref: 0040E906
Part of subcall function 0040E893: GetCPInfo.KERNEL32(00000000,?), ref: 0040E919

InterlockedDecrement.KERNEL32(?,?,?,0047B888,00000014,0040EC22,000000FD,0040BEDE), ref: 0040EAEE
InterlockedIncrement.KERNEL32(00000000,?,?,0047B888,00000014,0040EC22,000000FD,0040BEDE), ref: 0040EB13

Part of subcall function 004085E1: EnterCriticalSection.KERNEL32(?,?,?,0040FA0B,00000004,0047B928,0000000C,00409BCD,?,?,00000000,00000000,00000000,?,0040C659,00000001), ref: 0040860B

InterlockedDecrement.KERNEL32 ref: 0040EBA5
InterlockedIncrement.KERNEL32(00000000), ref: 0040EBC9

Part of subcall function 0040833E: HeapFree.KERNEL32(00000000,00000000,0047B490), ref: 004083A6
Part of subcall function 0040833E: GetLastError.KERNEL32 ref: 004083B7

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040E5E0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131

APIs

GetCPInfo.KERNEL32(?,?,00000000,?), ref: 0040E601

Part of subcall function 00406ECD: IsDebuggerPresent.KERNEL32 ref: 0040D877
Part of subcall function 00406ECD: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040D88C
Part of subcall function 00406ECD: UnhandledExceptionFilter.KERNEL32(1H), ref: 0040D897
Part of subcall function 00406ECD: GetCurrentProcess.KERNEL32(C0000409), ref: 0040D8B3
Part of subcall function 00406ECD: TerminateProcess.KERNEL32(00000000), ref: 0040D8BA

Strings

@, xrefs: 0040E765
, xrefs: 0040E628

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 00412EB3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,002E1888,00000000,?,?,?,00410F6A,?), ref: 00412EDD
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000008,00000000,00000000,?,?,?,00410F6A,?,00000000,?,0040AE3F), ref: 00412F03

Part of subcall function 00415E8D: SetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,?,00000000,766FEFAA,0000002C,0040B4D7,0047B598,00000008,00406530), ref: 00416088

Part of subcall function 0040833E: HeapFree.KERNEL32(00000000,00000000,0047B490), ref: 004083A6
Part of subcall function 0040833E: GetLastError.KERNEL32 ref: 004083B7

Part of subcall function 00409BB7: Sleep.KERNEL32(00000000), ref: 00409BDF

Strings

0e@, xrefs: 00412F3F, 00412F09, 00412F1E, 00412F0D

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 004084B0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35

APIs

DeleteCriticalSection.KERNEL32 ref: 004084CD

Part of subcall function 0040833E: HeapFree.KERNEL32(00000000,00000000,0047B490), ref: 004083A6
Part of subcall function 0040833E: GetLastError.KERNEL32 ref: 004083B7

DeleteCriticalSection.KERNEL32 ref: 004084F7

Strings

H+H, xrefs: 004084BA, 004084E4

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Function 0040895A, Relevance: 5.1, APIs: 4, Instructions: 53

APIs

HeapReAlloc.KERNEL32(00000000,-00000010,779B2DD6,00000000,00408EBA,779B2DD6,?,00000000), ref: 00408981
HeapAlloc.KERNEL32(00000008,000041C4,779B2DD6,00000000,00408EBA,779B2DD6,?,00000000), ref: 004089B7
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 004089D1
HeapFree.KERNEL32(00000000,?), ref: 004089E8

Memory Dump Source

Source File: 00000000.00000001.175322728.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.175301780.00400000.00000002.sdmp
Associated: 00000000.00000001.176027676.00478000.00000002.sdmp
Associated: 00000000.00000001.176839282.00481000.00000004.sdmp
Associated: 00000000.00000001.177205164.00485000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_885.jbxd

Analysis Process: rundll32.exe PID: 3276 Parent PID: 2896

Executed Functions

Function 005C4041, Relevance: 1.5, Strings: 1, Instructions: 249

Strings

, xrefs: 005BB873

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A01E8, Relevance: 1.4, Strings: 1, Instructions: 180

Strings

]nz8, xrefs: 005A0350

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CFFA1, Relevance: 1.3, Strings: 1, Instructions: 96

Strings

`=:, xrefs: 005D0007

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CAE66, Relevance: 1.3, Strings: 1, Instructions: 83

Strings

@, xrefs: 005CAF09

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005B800F, Relevance: .5, Instructions: 476

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005D0E34, Relevance: .3, Instructions: 343

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005D7321, Relevance: .3, Instructions: 267

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005AAF70, Relevance: .3, Instructions: 258

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C0CDB, Relevance: .2, Instructions: 241

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005AE305, Relevance: .2, Instructions: 236

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A6B97, Relevance: .2, Instructions: 235

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A4A1E, Relevance: .2, Instructions: 233

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A8279, Relevance: .2, Instructions: 230

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C330C, Relevance: .2, Instructions: 195

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005BA8B0, Relevance: .2, Instructions: 191

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A63D6, Relevance: .2, Instructions: 187

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005BBD44, Relevance: .2, Instructions: 173

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005B26EF, Relevance: .2, Instructions: 173

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005B2BE0, Relevance: .2, Instructions: 167

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A645F, Relevance: .2, Instructions: 162

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C94F5, Relevance: .1, Instructions: 145

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005AD99F, Relevance: .1, Instructions: 135

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005AEB5C, Relevance: .1, Instructions: 129

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CF7D2, Relevance: .1, Instructions: 111

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A348B, Relevance: .1, Instructions: 111

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005B6DF4, Relevance: .1, Instructions: 101

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C229A, Relevance: .1, Instructions: 98

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005D5D72, Relevance: .1, Instructions: 91

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005AB7BF, Relevance: .1, Instructions: 89

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CE2F2, Relevance: .1, Instructions: 86

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005B0337, Relevance: .1, Instructions: 84

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CAC28, Relevance: .1, Instructions: 75

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C5F1B, Relevance: .1, Instructions: 75

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005B7405, Relevance: .1, Instructions: 73

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A3EA8, Relevance: .1, Instructions: 70

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005AED6B, Relevance: .1, Instructions: 66

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A348A, Relevance: .1, Instructions: 63

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005AB389, Relevance: .1, Instructions: 54

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C5453, Relevance: .1, Instructions: 51

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005B4F5E, Relevance: .1, Instructions: 51

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005AEC20, Relevance: .0, Instructions: 49

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005BA1BA, Relevance: .0, Instructions: 48

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005ADD8A, Relevance: .0, Instructions: 45

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CBA3F, Relevance: .0, Instructions: 43

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A54F6, Relevance: .0, Instructions: 42

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005BB6AE, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A15C4, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A722C, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005BBEED, Relevance: .0, Instructions: 39

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A15BE, Relevance: .0, Instructions: 39

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005D9564, Relevance: .0, Instructions: 38

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A0BB0, Relevance: .0, Instructions: 38

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CB68E, Relevance: .0, Instructions: 37

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005DA6AA, Relevance: .0, Instructions: 36

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CBEB0, Relevance: .0, Instructions: 35

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A0BB6, Relevance: .0, Instructions: 34

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A5F3F, Relevance: .0, Instructions: 33

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005B8C51, Relevance: .0, Instructions: 33

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C6F6B, Relevance: .0, Instructions: 32

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005D16DA, Relevance: .0, Instructions: 30

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A97C7, Relevance: .0, Instructions: 30

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005D26C0, Relevance: .0, Instructions: 29

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005DA0C9, Relevance: .0, Instructions: 29

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005BA962, Relevance: .0, Instructions: 29

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A5F3E, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005D64C4, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C3172, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C4C62, Relevance: .0, Instructions: 24

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005B1B73, Relevance: .0, Instructions: 24

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C0C90, Relevance: .0, Instructions: 24

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005D2DD6, Relevance: .0, Instructions: 23

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C6116, Relevance: .0, Instructions: 22

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A7DF1, Relevance: .0, Instructions: 21

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005D9AA5, Relevance: .0, Instructions: 18

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A948F, Relevance: .0, Instructions: 17

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CD502, Relevance: .0, Instructions: 16

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A4BEE, Relevance: .0, Instructions: 15

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005A47F1, Relevance: .0, Instructions: 14

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005C3967, Relevance: .0, Instructions: 12

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CF962, Relevance: .0, Instructions: 2

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CF958, Relevance: .0, Instructions: 2

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Function 005CF96C, Relevance: .0, Instructions: 2

Memory Dump Source

Source File: 00000003.00000002.1401527185.005A0000.00000040.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a0000_rundll32.jbxd

Non-executed Functions

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Error!

Analysis Report

Overview

General Information

Detection

Classification

Analysis Advice

Signature Overview

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Networking:

Persistence and Installation Behavior:

Data Obfuscation:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Language, Device and Operating System Detection:

Behavior Graph

Yara Overview

Screenshot

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: 885.exe PID: 2896 Parent PID: 2364

General

Chronological Activities

Analysis Process: rundll32.exe PID: 3276 Parent PID: 2896

General

Chronological Activities

Analysis Process: winlogon.exe PID: 348 Parent PID: 2896

General

Chronological Activities

Analysis Process: explorer.exe PID: 1244 Parent PID: 348

General

Chronological Activities

Analysis Process: taskhost.exe PID: 1296 Parent PID: 348

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: 885.exe PID: 2896 Parent PID: 2364

Execution Graph

Graph

Executed Functions

Function 00401399, Relevance: 165.4, APIs: 77, Strings: 17, Instructions: 879

Function 00404E82, Relevance: 36.3, APIs: 24, Instructions: 277

Function 0040BD5C, Relevance: 1.5, APIs: 1, Instructions: 4