Edit tour

Windows Analysis Report
regsvr.exe

Overview

General Information

Sample name:	regsvr.exe
Analysis ID:	1591253
MD5:	e05f460eb752d40392f1d75d75716276
SHA1:	38320c10449e636fab9c7649454b52248957ee1e
SHA256:	804465598e1edc091a4ec8844cd7d8c81063ebad37339a1d646e0e0f242c5b89
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Disables the Windows registry editor (regedit)

Disables the Windows task manager (taskmgr)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Sigma detected: Interactive AT Job

Uses schtasks.exe or at.exe to add and modify task schedules

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

regsvr.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\regsvr.exe" MD5: E05F460EB752D40392F1D75D75716276)

cmd.exe (PID: 5404 cmdline: C:\Windows\system32\cmd.exe /C AT /delete /yes MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 7056 cmdline: AT /delete /yes MD5: 2AE20048111861FA09B709D3CC551AD6)

cmd.exe (PID: 2812 cmdline: C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

at.exe (PID: 1812 cmdline: AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe MD5: 2AE20048111861FA09B709D3CC551AD6)

regsvr.exe (PID: 3168 cmdline: "C:\Windows\regsvr.exe" MD5: E05F460EB752D40392F1D75D75716276)

cleanup

Sigma Signatures

System Summary

Sigma detected: Interactive AT Job

Source: Process started

Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community: Data: Command: AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe, CommandLine: AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\at.exe, NewProcessName: C:\Windows\SysWOW64\at.exe, OriginalFileName: C:\Windows\SysWOW64\at.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2812, ParentProcessName: cmd.exe, ProcessCommandLine: AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe, ProcessId: 1812, ProcessName: at.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\system32\regsvr.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\regsvr.exe, ProcessId: 6508, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msn Messsenger

Suricata Signatures

ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T20:49:09.661212+0100	2012200	1	A Network Trojan was detected	192.168.2.5	49705	74.6.143.25	80	TCP
2025-01-14T20:49:10.598364+0100	2012200	1	A Network Trojan was detected	192.168.2.5	49706	74.6.143.25	443	TCP
2025-01-14T20:49:11.678741+0100	2012200	1	A Network Trojan was detected	192.168.2.5	49707	87.248.119.252	443	TCP
2025-01-14T20:49:12.843490+0100	2012200	1	A Network Trojan was detected	192.168.2.5	49705	74.6.143.25	80	TCP
2025-01-14T20:49:13.479647+0100	2012200	1	A Network Trojan was detected	192.168.2.5	49708	74.6.143.25	443	TCP
2025-01-14T20:49:14.520787+0100	2012200	1	A Network Trojan was detected	192.168.2.5	49709	87.248.119.252	443	TCP
2025-01-14T20:49:15.186129+0100	2012200	1	A Network Trojan was detected	192.168.2.5	49710	87.248.119.252	80	TCP
2025-01-14T20:49:16.293240+0100	2012200	1	A Network Trojan was detected	192.168.2.5	49712	87.248.119.252	443	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T20:49:09.661212+0100	2803304	3	Unknown Traffic	192.168.2.5	49705	74.6.143.25	80	TCP
2025-01-14T20:49:12.843490+0100	2803304	3	Unknown Traffic	192.168.2.5	49705	74.6.143.25	80	TCP
2025-01-14T20:49:15.186129+0100	2803304	3	Unknown Traffic	192.168.2.5	49710	87.248.119.252	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: regsvr.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\svchost .exe	Avira: detection malicious, Label: TR/AutoIt.CI.14
Source: C:\Windows\SysWOW64\regsvr.exe	Avira: detection malicious, Label: TR/AutoIt.CI.14
Source: C:\Users\user\AppData\Roaming\regsvr.exe	Avira: detection malicious, Label: TR/AutoIt.CI.14
Source: C:\Windows\SysWOW64\regsvr.exe	Avira: detection malicious, Label: TR/AutoIt.CI.14

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\regsvr.exe	ReversingLabs: Detection: 100%
Source: C:\Windows\SysWOW64\regsvr.exe	ReversingLabs: Detection: 100%
Source: C:\Windows\SysWOW64\svchost .exe	ReversingLabs: Detection: 100%
Source: C:\Windows\regsvr.exe	ReversingLabs: Detection: 100%

Multi AV Scanner detection for submitted file

Source: regsvr.exe	Virustotal: Detection: 97%			Perma Link
Source: regsvr.exe	ReversingLabs: Detection: 100%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\svchost .exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\regsvr.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\regsvr.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\regsvr.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: regsvr.exe

Joe Sandbox ML: detected

Source: regsvr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 74.6.143.25:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.119.252:443 -> 192.168.2.5:49707 version: TLS 1.2

Source: C:\Windows\regsvr.exe	File opened: z:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: x:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: v:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: t:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: r:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: p:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: n:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: l:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: j:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: h:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: f:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: b:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: y:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: w:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: u:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: s:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: q:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: o:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: m:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: k:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: i:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: g:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: e:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: c:	Jump to behavior
Source: C:\Windows\regsvr.exe	File opened: a:	Jump to behavior

Source: regsvr.exe, 00000000.00000003.2156625058.0000000003980000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [Autorun]
Source: regsvr.exe, 00000000.00000003.2156677522.0000000003980000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [Autorun]
Source: regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.infp
Source: regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.infC
Source: regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.infd
Source: regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.infL
Source: regsvr.exe, 00000009.00000002.4594642657.000000000098E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Autorun]
Source: regsvr.exe, 00000009.00000003.2442670612.0000000003980000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [Autorun]
Source: regsvr.exe, 00000009.00000002.4594873393.0000000002C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.infS
Source: regsvr.exe, 00000009.00000002.4594873393.0000000002C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: regsvr.exe, 00000009.00000002.4594873393.0000000002C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.infP
Source: regsvr.exe, 00000009.00000002.4594873393.0000000002C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.infT
Source: regsvr.exe, 00000009.00000002.4594873393.0000000002C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.infv
Source: regsvr.exe, 00000009.00000002.4594873393.0000000002C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.inf@
Source: regsvr.exe, 00000009.00000002.4594873393.0000000002C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.inf:
Source: regsvr.exe, 00000009.00000002.4594873393.0000000002C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.inf7
Source: regsvr.exe, 00000009.00000003.2442633872.0000000003980000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [Autorun]
Source: setup.ini.0.dr	Binary or memory string: [Autorun]
Source: setup.ini.9.dr	Binary or memory string: [Autorun]

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0040C49D GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0040C49D
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0040C78E GetFileAttributesW,GetFileAttributesW,_wcscat,GetFileAttributesW,_wcscat,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0040C78E
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041DE3C GetFileAttributesW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_0041DE3C
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041E028 FindFirstFileW,FindNextFileW,FindClose,	0_2_0041E028
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041B572 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0041B572
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0040C672 GetFileAttributesW,_wcscat,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_0040C672
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041EA5E FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_0041EA5E
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041BA0A FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_0041BA0A
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041BB4D FindFirstFileW,FindClose,	0_2_0041BB4D
Source: C:\Windows\regsvr.exe	Code function: 9_2_0040C49D GetFileAttributesW,FindFirstFileW,FindClose,	9_2_0040C49D
Source: C:\Windows\regsvr.exe	Code function: 9_2_0040C78E GetFileAttributesW,GetFileAttributesW,_wcscat,GetFileAttributesW,_wcscat,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	9_2_0040C78E
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041DE3C GetFileAttributesW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	9_2_0041DE3C
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041E028 FindFirstFileW,FindNextFileW,FindClose,	9_2_0041E028
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041B572 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	9_2_0041B572
Source: C:\Windows\regsvr.exe	Code function: 9_2_0040C672 GetFileAttributesW,_wcscat,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	9_2_0040C672
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041EA5E FindFirstFileW,Sleep,FindNextFileW,FindClose,	9_2_0041EA5E
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041BA0A FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	9_2_0041BA0A
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041BB4D FindFirstFileW,FindClose,	9_2_0041BB4D

Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Cache-Control: no-cacheHost: yahoo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveHost: www.yahoo.com
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Cache-Control: no-cacheHost: yahoo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveHost: www.yahoo.com
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Cache-Control: no-cacheHost: www.yahoo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Host: yahoo.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Host: yahoo.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Host: www.yahoo.comCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 87.248.119.252 87.248.119.252
Source: Joe Sandbox View	IP Address: 74.6.143.25 74.6.143.25

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49705 -> 74.6.143.25:80
Source: Network traffic	Suricata IDS: 2012200 - Severity 1 - ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc : 192.168.2.5:49705 -> 74.6.143.25:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49710 -> 87.248.119.252:80
Source: Network traffic	Suricata IDS: 2012200 - Severity 1 - ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc : 192.168.2.5:49710 -> 87.248.119.252:80
Source: Network traffic	Suricata IDS: 2012200 - Severity 1 - ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc : 192.168.2.5:49709 -> 87.248.119.252:443
Source: Network traffic	Suricata IDS: 2012200 - Severity 1 - ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc : 192.168.2.5:49712 -> 87.248.119.252:443
Source: Network traffic	Suricata IDS: 2012200 - Severity 1 - ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc : 192.168.2.5:49708 -> 74.6.143.25:443
Source: Network traffic	Suricata IDS: 2012200 - Severity 1 - ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc : 192.168.2.5:49706 -> 74.6.143.25:443
Source: Network traffic	Suricata IDS: 2012200 - Severity 1 - ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc : 192.168.2.5:49707 -> 87.248.119.252:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_00422477 GetLastError,GetLastError,FreeLibrary,FreeLibrary,GetLastError,FreeLibrary,FreeLibrary,GetLastError,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,LoadLibraryA,GetProcAddress,InternetOpenUrlW,GetLastError,FreeLibrary,FreeLibrary,FreeLibrary,GetLastError,FreeLibrary,InternetReadFile,FreeLibrary,

0_2_00422477

Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Cache-Control: no-cacheHost: yahoo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveHost: www.yahoo.com
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Cache-Control: no-cacheHost: yahoo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveHost: www.yahoo.com
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Cache-Control: no-cacheHost: www.yahoo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Host: yahoo.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Host: yahoo.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /setting.doc HTTP/1.1Host: www.yahoo.comCache-Control: no-cache

Source: regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: !Locationhttps://www.yahoo.com/setting.doc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4594202461.0000000000144000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158062819.0000000000144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ""https://www.yahoo.com/setting.doc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594202461.0000000000144000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: *.www.yahoo.com equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4594202461.0000000000144000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158062819.0000000000144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: +www.yahoo.com equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ://www.yahoo.com/setting.docea equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4593705998.0000000000106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Host: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Hostwww.yahoo.com equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4159152110.000000000013A000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158618153.0000000000131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Hostwww.yahoo.comGET /setting.doc HTTP/1.1 equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4159152110.000000000013A000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158618153.0000000000131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Hostwww.yahoo.comGET /setting.doc HTTP/1.1/setting.doc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Hostwww.yahoo.comGET /setting.doc HTTP/1.1/setting.docWo equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4159152110.000000000013A000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158618153.0000000000131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Hostwww.yahoo.comGET /setting.doc HTTP/1.1O equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Hostwww.yahoo.comWo equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2174098834.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Location: https://www.yahoo.com/setting.doc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Locationhttps://www.yahoo.com/setting.doc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000009.00000002.4594813865.0000000002B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/ equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/-e equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/setting.doc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/setting.doc#o equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/setting.doc/ equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/setting.doc:l equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/ equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/Sj\|f equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2174098834.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/pi equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174098834.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.doc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.doc/ equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.doc?o equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.docFllg equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.docLlbg equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.docPlvg equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.docTmzf equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.docUo equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/ye equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/{i equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184910391.00000000001A0000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594367032.000000000019C000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: staging.www.yahoo.com equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4594367032.000000000019C000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594202461.0000000000144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2174098834.000000000019E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174098834.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174204801.000000000019E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com/setting.doc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2174098834.000000000019E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174204801.000000000019E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com/setting.doc.com/setting.docA equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com/yahoo.com/setting.doc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4593987312.000000000011F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com/yahoo.com/setting.docW;-f( equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4593705998.0000000000106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com5 equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4594202461.0000000000144000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158062819.0000000000144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com7 equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com9 equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comAO equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2174098834.000000000019E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comDO equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comF equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comLMEM equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comW equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com[O%g equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4593705998.0000000000106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com` equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comapi.yahoo.com equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2174098834.000000000019E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174204801.000000000019E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.combO<g equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comcJO equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comg.doccomO equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comg.docdoc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2174098834.000000000019E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comhO2g equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2174098834.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comlConvertPublicKeyInfo equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comm equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comoO9g equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000002.4594367032.000000000019C000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4157935607.000000000019B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comsO equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174098834.000000000019E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174204801.000000000019E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comvO equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comw equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.4158618153.000000000011E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4593987312.000000000011F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.comyahoo.com/setting.doc equals www.yahoo.com (Yahoo)
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174098834.000000000019E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com\|O equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: www.yahoo.com

Source: regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000009.00000002.4594813865.0000000002B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/-e
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/setting.doc
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/setting.doc#o
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/setting.doc/
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yahoo.com/setting.doc:l
Source: regsvr.exe, 00000000.00000002.4594894602.0000000002B95000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000009.00000002.4594813865.0000000002B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com
Source: regsvr.exe, 00000000.00000002.4593705998.0000000000106000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4159152110.000000000013A000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158618153.0000000000131000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4593987312.000000000013B000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158618153.000000000011E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4593987312.000000000011F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/setting.doc
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/setting.doc9
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/setting.docAO
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/setting.dochO2g
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/setting.docl
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/setting.docvO
Source: regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.comM
Source: regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ads.taboola.com;
Source: regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.taboola.com
Source: regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csp.yahoo.com/beacon/csp?src=ats&site=news&region=US&lang=en-US&device=desktop&yrid=6o9nr8ti
Source: regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pnr.ouryahoo.com
Source: regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/Sj
Source: regsvr.exe, 00000000.00000003.2174098834.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/pi
Source: regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.doc
Source: regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.doc/
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.doc?o
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174098834.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.docFllg
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.docLlbg
Source: regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.docPlvg
Source: regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174098834.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.docTmzf
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/setting.docUo
Source: regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yahoo.com/ye
Source: regsvr.exe, 00000000.00000002.4594202461.000000000013F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158062819.000000000013E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/
Source: regsvr.exe, 00000000.00000002.4594202461.000000000013F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158062819.000000000013E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/o
Source: regsvr.exe, 00000000.00000002.4594202461.0000000000144000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174098834.000000000019E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158062819.0000000000144000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158618153.000000000011E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4593987312.000000000011F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174204801.000000000019E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/setting.doc
Source: regsvr.exe, 00000000.00000003.4158618153.000000000011E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4593987312.000000000011F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/setting.doc(:
Source: regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/setting.docJO

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 74.6.143.25:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.119.252:443 -> 192.168.2.5:49707 version: TLS 1.2

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0042209A GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0042209A

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0042209A GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		0_2_0042209A
Source: C:\Windows\regsvr.exe	Code function: 9_2_0042209A GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		9_2_0042209A

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_00421EB4 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,DragQueryFileW,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00421EB4

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0040853B GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_0040853B

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00441FD7 GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,LoadCursorW,SetCursor,LoadCursorW,SetCursor,GetWindowRect,GetWindowRect,GetWindowRect,MoveWindow,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,PostMessageW,GetFocus,GetDlgCtrlID,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,SendMessageW,GetCursorPos,GetCursorPos,TrackPopupMenuEx,ClientToScreen,GetSysColor,SetBkColor,74A309A0,ReleaseCapture,SetWindowTextW,SendMessageW,FreeLibrary,DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,		0_2_00441FD7
Source: C:\Windows\regsvr.exe	Code function: 9_2_00441FD7 GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,LoadCursorW,SetCursor,LoadCursorW,SetCursor,GetWindowRect,GetWindowRect,GetWindowRect,MoveWindow,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,PostMessageW,GetFocus,GetDlgCtrlID,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,SendMessageW,GetCursorPos,GetCursorPos,TrackPopupMenuEx,ClientToScreen,GetSysColor,SetBkColor,74A309A0,ReleaseCapture,SetWindowTextW,SendMessageW,FreeLibrary,DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,		9_2_00441FD7

System Summary

PE file contains section with special chars

Source: regsvr.exe	Static PE information: section name: .vc++
Source: regsvr.exe.0.dr	Static PE information: section name: .vc++
Source: regsvr.exe0.0.dr	Static PE information: section name: .vc++
Source: svchost .exe.0.dr	Static PE information: section name: .vc++
Source: regsvr.exe.9.dr	Static PE information: section name: .vc++

PE file has a writeable .text section

Source: regsvr.exe	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: regsvr.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: regsvr.exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: svchost .exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: regsvr.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0041D0C8: __swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_0041D0C8

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0040D288 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,		0_2_0040D288
Source: C:\Windows\regsvr.exe	Code function: 9_2_0040D288 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,		9_2_0040D288

Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\28463	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\regsvr.exe	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\regsvr.exe:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\regsvr.exe	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\regsvr.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\svchost .exe	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\svchost .exe:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\setup.ini	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\setting.ini	Jump to behavior

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0045A04B	0_2_0045A04B
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00429FD7	0_2_00429FD7
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0044602C	0_2_0044602C
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_004500CD	0_2_004500CD
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_004121B3	0_2_004121B3
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0045831B	0_2_0045831B
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0044F41A	0_2_0044F41A
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_004504ED	0_2_004504ED
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00461573	0_2_00461573
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0045763A	0_2_0045763A
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_004646BD	0_2_004646BD
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00455770	0_2_00455770
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0044F8ED	0_2_0044F8ED
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00445948	0_2_00445948
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00411906	0_2_00411906
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0044D99C	0_2_0044D99C
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00458AE0	0_2_00458AE0
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00461AB5	0_2_00461AB5
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00432BDC	0_2_00432BDC
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0044FCC1	0_2_0044FCC1
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00436CF3	0_2_00436CF3
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0045BD92	0_2_0045BD92
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00441FD7	0_2_00441FD7
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00461FF7	0_2_00461FF7
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00463FFD	0_2_00463FFD
Source: C:\Windows\regsvr.exe	Code function: 9_2_0045A04B	9_2_0045A04B
Source: C:\Windows\regsvr.exe	Code function: 9_2_00429FD7	9_2_00429FD7
Source: C:\Windows\regsvr.exe	Code function: 9_2_0044602C	9_2_0044602C
Source: C:\Windows\regsvr.exe	Code function: 9_2_004500CD	9_2_004500CD
Source: C:\Windows\regsvr.exe	Code function: 9_2_004121B3	9_2_004121B3
Source: C:\Windows\regsvr.exe	Code function: 9_2_0045831B	9_2_0045831B
Source: C:\Windows\regsvr.exe	Code function: 9_2_0044F41A	9_2_0044F41A
Source: C:\Windows\regsvr.exe	Code function: 9_2_004504ED	9_2_004504ED
Source: C:\Windows\regsvr.exe	Code function: 9_2_00461573	9_2_00461573
Source: C:\Windows\regsvr.exe	Code function: 9_2_0045763A	9_2_0045763A
Source: C:\Windows\regsvr.exe	Code function: 9_2_004646BD	9_2_004646BD
Source: C:\Windows\regsvr.exe	Code function: 9_2_00455770	9_2_00455770
Source: C:\Windows\regsvr.exe	Code function: 9_2_0044F8ED	9_2_0044F8ED
Source: C:\Windows\regsvr.exe	Code function: 9_2_00445948	9_2_00445948
Source: C:\Windows\regsvr.exe	Code function: 9_2_00411906	9_2_00411906
Source: C:\Windows\regsvr.exe	Code function: 9_2_0044D99C	9_2_0044D99C
Source: C:\Windows\regsvr.exe	Code function: 9_2_00458AE0	9_2_00458AE0
Source: C:\Windows\regsvr.exe	Code function: 9_2_00461AB5	9_2_00461AB5
Source: C:\Windows\regsvr.exe	Code function: 9_2_00432BDC	9_2_00432BDC
Source: C:\Windows\regsvr.exe	Code function: 9_2_0044FCC1	9_2_0044FCC1
Source: C:\Windows\regsvr.exe	Code function: 9_2_00436CF3	9_2_00436CF3
Source: C:\Windows\regsvr.exe	Code function: 9_2_0045BD92	9_2_0045BD92
Source: C:\Windows\regsvr.exe	Code function: 9_2_00441FD7	9_2_00441FD7
Source: C:\Windows\regsvr.exe	Code function: 9_2_00461FF7	9_2_00461FF7
Source: C:\Windows\regsvr.exe	Code function: 9_2_00463FFD	9_2_00463FFD

Source: C:\Users\user\Desktop\regsvr.exe	Code function: String function: 0045570C appears 49 times
Source: C:\Users\user\Desktop\regsvr.exe	Code function: String function: 00453ED0 appears 38 times
Source: C:\Users\user\Desktop\regsvr.exe	Code function: String function: 0040E30A appears 91 times
Source: C:\Users\user\Desktop\regsvr.exe	Code function: String function: 00405AA7 appears 48 times
Source: C:\Windows\regsvr.exe	Code function: String function: 0045570C appears 49 times
Source: C:\Windows\regsvr.exe	Code function: String function: 00453ED0 appears 38 times
Source: C:\Windows\regsvr.exe	Code function: String function: 0040E30A appears 91 times
Source: C:\Windows\regsvr.exe	Code function: String function: 00405AA7 appears 48 times

Source: regsvr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: regsvr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: regsvr.exe.0.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: regsvr.exe0.0.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: svchost .exe.0.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: regsvr.exe.9.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: regsvr.exe	Static PE information: Section: .rdata ZLIB complexity 1.0009191176470589
Source: regsvr.exe.0.dr	Static PE information: Section: .rdata ZLIB complexity 1.0009191176470589
Source: regsvr.exe0.0.dr	Static PE information: Section: .rdata ZLIB complexity 1.0009191176470589
Source: svchost .exe.0.dr	Static PE information: Section: .rdata ZLIB complexity 1.0009191176470589
Source: regsvr.exe.9.dr	Static PE information: Section: .rdata ZLIB complexity 1.0009191176470589

Source: classification engine

Classification label: mal100.evad.winEXE@12/13@2/2

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_00418B7F GetLastError,FormatMessageW,

0_2_00418B7F

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0040D288 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,		0_2_0040D288
Source: C:\Windows\regsvr.exe	Code function: 9_2_0040D288 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,EnumWindows,ExitWindowsEx,SetSystemPowerState,		9_2_0040D288

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0041C97F SetErrorMode,GetDiskFreeSpaceW,FreeLibrary,

0_2_0041C97F

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0040BCAA Sleep,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,_wcscat,__wcsicmp,CloseHandle,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,

0_2_0040BCAA

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0041D215 CoInitialize,CoCreateInstance,_wcsncpy,CoUninitialize,

0_2_0041D215

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0040D70C __swprintf,__swprintf,__wcsicmp,FindResourceW,FindResourceW,LoadResource,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0040D70C

Source: C:\Windows\regsvr.exe

File created: C:\Users\user\AppData\Roaming\support

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1400:120:WilError_03

Source: C:\Users\user\Desktop\regsvr.exe

File created: C:\Users\user\AppData\Local\Temp\aut3295.tmp

Jump to behavior

Source: C:\Users\user\Desktop\regsvr.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\regsvr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: regsvr.exe	Virustotal: Detection: 97%
Source: regsvr.exe	ReversingLabs: Detection: 100%

Source: C:\Users\user\Desktop\regsvr.exe

File read: C:\Users\user\Desktop\regsvr.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\regsvr.exe "C:\Users\user\Desktop\regsvr.exe"
Source: C:\Users\user\Desktop\regsvr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C AT /delete /yes
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\at.exe AT /delete /yes
Source: C:\Users\user\Desktop\regsvr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\at.exe AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
Source: unknown	Process created: C:\Windows\regsvr.exe "C:\Windows\regsvr.exe"
Source: C:\Users\user\Desktop\regsvr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C AT /delete /yes	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\at.exe AT /delete /yes	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\at.exe AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe	Jump to behavior

Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: schedcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\SysWOW64\at.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\regsvr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\regsvr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\regsvr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\regsvr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\regsvr.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\regsvr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\regsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\regsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\regsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\regsvr.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\Desktop\regsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\regsvr.exe

File written: C:\Windows\SysWOW64\setup.ini

Jump to behavior

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_004053EF GetVersionExW,_wcscpy,LoadLibraryA,GetProcAddress,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,FreeLibrary,

0_2_004053EF

Source: initial sample

Static PE information: section where entry point is pointing to: .vc++

Source: regsvr.exe	Static PE information: real checksum: 0xc35e7 should be: 0xbe3dd
Source: svchost .exe.0.dr	Static PE information: real checksum: 0xc35e7 should be: 0xbe3dd
Source: regsvr.exe.9.dr	Static PE information: real checksum: 0xc35e7 should be: 0xbe3dd
Source: regsvr.exe0.0.dr	Static PE information: real checksum: 0xc35e7 should be: 0xbe3dd
Source: regsvr.exe.0.dr	Static PE information: real checksum: 0xc35e7 should be: 0xbe3dd

Source: regsvr.exe	Static PE information: section name: .vc++
Source: regsvr.exe	Static PE information: section name: .adata
Source: regsvr.exe	Static PE information: section name: .vsp
Source: regsvr.exe.0.dr	Static PE information: section name: .vc++
Source: regsvr.exe.0.dr	Static PE information: section name: .adata
Source: regsvr.exe.0.dr	Static PE information: section name: .vsp
Source: regsvr.exe0.0.dr	Static PE information: section name: .vc++
Source: regsvr.exe0.0.dr	Static PE information: section name: .adata
Source: regsvr.exe0.0.dr	Static PE information: section name: .vsp
Source: svchost .exe.0.dr	Static PE information: section name: .vc++
Source: svchost .exe.0.dr	Static PE information: section name: .adata
Source: svchost .exe.0.dr	Static PE information: section name: .vsp
Source: regsvr.exe.9.dr	Static PE information: section name: .vc++
Source: regsvr.exe.9.dr	Static PE information: section name: .adata
Source: regsvr.exe.9.dr	Static PE information: section name: .vsp

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_004A500A push ebp; ret	0_2_004A500D
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00455751 push ecx; ret	0_2_00455764
Source: C:\Windows\regsvr.exe	Code function: 9_2_004A500A push ebp; ret	9_2_004A500D
Source: C:\Windows\regsvr.exe	Code function: 9_2_00455751 push ecx; ret	9_2_00455764

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\regsvr.exe

Source: C:\Windows\regsvr.exe	File created: C:\Users\user\AppData\Roaming\regsvr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\svchost .exe	Jump to dropped file
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\regsvr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\regsvr.exe	Jump to dropped file

Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\svchost .exe	Jump to dropped file
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\SysWOW64\regsvr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\regsvr.exe	File created: C:\Windows\regsvr.exe	Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\Desktop\regsvr.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Msn Messsenger

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\regsvr.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Jump to behavior

Creates multiple autostart registry keys

Source: C:\Windows\regsvr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Msn Messsenger			Jump to behavior
Source: C:\Windows\regsvr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yahoo Messsenger			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\at.exe AT /delete /yes

Source: C:\Users\user\Desktop\regsvr.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule

Jump to behavior

Source: C:\Users\user\Desktop\regsvr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Msn Messsenger	Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Msn Messsenger	Jump to behavior
Source: C:\Windows\regsvr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yahoo Messsenger	Jump to behavior
Source: C:\Windows\regsvr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yahoo Messsenger	Jump to behavior
Source: C:\Windows\regsvr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Msn Messsenger	Jump to behavior
Source: C:\Windows\regsvr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Msn Messsenger	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon (1106).png

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00409786 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_00409786
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00439F63 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_00439F63
Source: C:\Windows\regsvr.exe	Code function: 9_2_00409786 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,	9_2_00409786
Source: C:\Windows\regsvr.exe	Code function: 9_2_00439F63 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	9_2_00439F63

Source: C:\Users\user\Desktop\regsvr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\regsvr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\regsvr.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_9-52959
Source: C:\Users\user\Desktop\regsvr.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-52879

Source: C:\Users\user\Desktop\regsvr.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-51788
Source: C:\Windows\regsvr.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_9-51906

Source: C:\Users\user\Desktop\regsvr.exe	API coverage: 7.7 %
Source: C:\Windows\regsvr.exe	API coverage: 6.7 %

Source: C:\Windows\regsvr.exe TID: 1812

Thread sleep count: 209 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0040C49D GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0040C49D
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0040C78E GetFileAttributesW,GetFileAttributesW,_wcscat,GetFileAttributesW,_wcscat,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0040C78E
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041DE3C GetFileAttributesW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_0041DE3C
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041E028 FindFirstFileW,FindNextFileW,FindClose,	0_2_0041E028
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041B572 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0041B572
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0040C672 GetFileAttributesW,_wcscat,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_0040C672
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041EA5E FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_0041EA5E
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041BA0A FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_0041BA0A
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0041BB4D FindFirstFileW,FindClose,	0_2_0041BB4D
Source: C:\Windows\regsvr.exe	Code function: 9_2_0040C49D GetFileAttributesW,FindFirstFileW,FindClose,	9_2_0040C49D
Source: C:\Windows\regsvr.exe	Code function: 9_2_0040C78E GetFileAttributesW,GetFileAttributesW,_wcscat,GetFileAttributesW,_wcscat,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	9_2_0040C78E
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041DE3C GetFileAttributesW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	9_2_0041DE3C
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041E028 FindFirstFileW,FindNextFileW,FindClose,	9_2_0041E028
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041B572 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	9_2_0041B572
Source: C:\Windows\regsvr.exe	Code function: 9_2_0040C672 GetFileAttributesW,_wcscat,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	9_2_0040C672
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041EA5E FindFirstFileW,Sleep,FindNextFileW,FindClose,	9_2_0041EA5E
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041BA0A FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	9_2_0041BA0A
Source: C:\Windows\regsvr.exe	Code function: 9_2_0041BB4D FindFirstFileW,FindClose,	9_2_0041BB4D

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_004053EF GetVersionExW,_wcscpy,LoadLibraryA,GetProcAddress,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,FreeLibrary,

0_2_004053EF

Source: regsvr.exe, 00000009.00000002.4594642657.000000000098E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&00000
Source: regsvr.exe, 00000000.00000002.4594202461.0000000000144000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158062819.0000000000144000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158618153.000000000011E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4593987312.000000000011F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\regsvr.exe	API call chain: ExitProcess graph end node	graph_0-51563
Source: C:\Users\user\Desktop\regsvr.exe	API call chain: ExitProcess graph end node	graph_0-51877
Source: C:\Windows\regsvr.exe	API call chain: ExitProcess graph end node	graph_9-51581
Source: C:\Windows\regsvr.exe	API call chain: ExitProcess graph end node	graph_9-51982

Source: C:\Users\user\Desktop\regsvr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_004053EF GetVersionExW,_wcscpy,LoadLibraryA,GetProcAddress,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,FreeLibrary,

0_2_004053EF

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_00453C5E GetStartupInfoW,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__amsg_exit,___crtGetCommandLineW,___crtGetEnvironmentStringsW,__wsetargv,__amsg_exit,__wsetenvp,__amsg_exit,__cinit,__amsg_exit,__wwincmdln,

0_2_00453C5E

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00460147 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00460147
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00460874 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00460874
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0045EA75 SetUnhandledExceptionFilter,	0_2_0045EA75
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00454F21 _memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00454F21
Source: C:\Windows\regsvr.exe	Code function: 9_2_00460147 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00460147
Source: C:\Windows\regsvr.exe	Code function: 9_2_00460874 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00460874
Source: C:\Windows\regsvr.exe	Code function: 9_2_0045EA75 SetUnhandledExceptionFilter,	9_2_0045EA75
Source: C:\Windows\regsvr.exe	Code function: 9_2_00454F21 _memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00454F21

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0040108C GetCurrentDirectoryW,MessageBoxA,GetFullPathNameW,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,SetCurrentDirectoryW,

0_2_0040108C

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_00408381 keybd_event,

0_2_00408381

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0040D3AB mouse_event,

0_2_0040D3AB

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\at.exe AT /delete /yes			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\at.exe AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe			Jump to behavior

Source: regsvr.exe	Binary or memory string: Shell_TrayWnd
Source: regsvr.exe, 00000000.00000003.2146840510.0000000000E60000.00000004.00001000.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, regsvr.exe, 00000009.00000003.2441396899.0000000000950000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: k@<v@ASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALT0409000208090710050EASC 0%dupdownonoff0%dShell_TrayWndVirtualAllocExVirtualFreeExExitScript Pausedblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_00461506 cpuid

0_2_00461506

Source: C:\Users\user\Desktop\regsvr.exe	Code function: GetLocaleInfoA,		0_2_00462EED
Source: C:\Windows\regsvr.exe	Code function: GetLocaleInfoA,		9_2_00462EED

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0041B7D8 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,_wcsncpy,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,GetFileAttributesW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_0041B7D8

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0042ED72 GetUserNameW,

0_2_0042ED72

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_0045D8AB __lock,__invoke_watson,__invoke_watson,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,SetOaNoCache,__invoke_watson,

0_2_0045D8AB

Source: C:\Users\user\Desktop\regsvr.exe

Code function: 0_2_004053EF GetVersionExW,_wcscpy,LoadLibraryA,GetProcAddress,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,FreeLibrary,

0_2_004053EF

Lowering of HIPS / PFW / Operating System Security Settings

Disables the Windows registry editor (regedit)

Source: C:\Users\user\Desktop\regsvr.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\regsvr.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Source: regsvr.exe	Binary or memory string: WIN_XP
Source: regsvr.exe	Binary or memory string: WIN_VISTA
Source: regsvr.exe, 00000009.00000002.4593984874.0000000000401000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: %.2d%.3dProgramFilesDirSOFTWARE\Microsoft\Windows\CurrentVersionCommonFilesDirPersonalSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCommon AppDataCommon DesktopDesktopCommon DocumentsCommon FavoritesFavoritesCommon ProgramsProgramsCommon Start MenuStart MenuCommon StartupStartupAppDataX86IA64X64UNKN%dWIN32_NTWIN32_WINDOWSWIN_LONGHORNWIN_VISTAWIN_2003WIN_XPWIN_2000WIN_NT4WIN_95WIN_98WIN_MEInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\Language.DEFAULT\Control Panel\Desktop\ResourceLocale3, 2, 10, 0USERPROFILEUSERDOMAINUSERDNSDOMAINnul:cdeclwinapistdcallnonestrstringwstrwstringintuintlongulongdwordudwordshortushortbyteubytefloatdoubleptrhwndlparamwparamint64uint64long_ptrint_ptrshort_ptrcharwcharuint_ptrulong_ptralignGetProcessMemoryInfoGetProcessIoCountersAdvapi32.dllCreateProcessWithLogonW64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_BINARY+.-.+-diouxXeEfgGsISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINEGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32MonitorFromPointSetLayeredWindowAttributesGetMonitorInfoWAutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DROPID@GUI_DRAGID@GUI_DRAGFILECOMBOBOXEDIT

Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_0042754A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_0042754A
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00428656 OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_00428656
Source: C:\Users\user\Desktop\regsvr.exe	Code function: 0_2_00426F8D socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_00426F8D
Source: C:\Windows\regsvr.exe	Code function: 9_2_0042754A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	9_2_0042754A
Source: C:\Windows\regsvr.exe	Code function: 9_2_00428656 OleInitialize,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	9_2_00428656
Source: C:\Windows\regsvr.exe	Code function: 9_2_00426F8D socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	9_2_00426F8D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Replication Through Removable Media	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	31 Registry Run Keys / Startup Folder	1 Windows Service	1 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 DLL Side-Loading	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	221 Masquerading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	31 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	DCSync	111 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	3 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
regsvr.exe	97%	Virustotal		Browse
regsvr.exe	100%	ReversingLabs	Win32.Worm.Sohanad
regsvr.exe	100%	Avira	TR/AutoIt.CI.14
regsvr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\svchost .exe	100%	Avira	TR/AutoIt.CI.14
C:\Windows\SysWOW64\regsvr.exe	100%	Avira	TR/AutoIt.CI.14
C:\Users\user\AppData\Roaming\regsvr.exe	100%	Avira	TR/AutoIt.CI.14
C:\Windows\SysWOW64\regsvr.exe	100%	Avira	TR/AutoIt.CI.14
C:\Windows\SysWOW64\svchost .exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\regsvr.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\regsvr.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\regsvr.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\regsvr.exe	100%	ReversingLabs	Win32.Worm.Sohanad
C:\Windows\SysWOW64\regsvr.exe	100%	ReversingLabs	Win32.Worm.Sohanad
C:\Windows\SysWOW64\svchost .exe	100%	ReversingLabs	Win32.Worm.Sohanad
C:\Windows\regsvr.exe	100%	ReversingLabs	Win32.Worm.Sohanad

Source	Detection	Scanner	Label
http://yahoo.comM	0%	Avira URL Cloud	safe
https://pnr.ouryahoo.com	0%	Avira URL Cloud	safe
https://ads.taboola.com;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
me-ycpi-cf-www.g06.yahoodns.net	87.248.119.252	true	false	high
yahoo.com	74.6.143.25	true	false	high
www.yahoo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://yahoo.com/setting.doc	false	high
http://www.yahoo.com/setting.doc	false	high
https://www.yahoo.com/setting.doc	false	high
https://yahoo.com/setting.doc	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://yahoo.comM	regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.yahoo.com/setting.doc/	regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.yahoo.com/setting.docUo	regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
http://yahoo.com	regsvr.exe, 00000000.00000002.4594894602.0000000002B95000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000009.00000002.4594813865.0000000002B75000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.yahoo.com/	regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pnr.ouryahoo.com	regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000155000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.yahoo.com/Sj	regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://yahoo.com/setting.dochO2g	regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.yahoo.com/setting.docLlbg	regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.yahoo.com/pi	regsvr.exe, 00000000.00000003.2174098834.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.yahoo.com	regsvr.exe, 00000000.00000002.4594978530.0000000003710000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000009.00000002.4594813865.0000000002B75000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.yahoo.com/setting.docFllg	regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174098834.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ads.taboola.com;	regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000155000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.yahoo.com/setting.docPlvg	regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.yahoo.com/	regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	regsvr.exe, 00000000.00000002.4594202461.000000000013F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158062819.000000000013E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/setting.doc(:	regsvr.exe, 00000000.00000003.4158618153.000000000011E000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4593987312.000000000011F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://yahoo.com/setting.docl	regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
http://yahoo.com/setting.docvO	regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.yahoo.com/-e	regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
https://csp.yahoo.com/beacon/csp?src=ats&site=news&region=US&lang=en-US&device=desktop&yrid=6o9nr8ti	regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000155000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.yahoo.com/setting.docTmzf	regsvr.exe, 00000000.00000003.2184928553.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2174098834.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/o	regsvr.exe, 00000000.00000002.4594202461.000000000013F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4158062819.000000000013E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/setting.docJO	regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
http://yahoo.com/setting.doc9	regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.yahoo.com/setting.doc#o	regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.yahoo.com/setting.doc/	regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.yahoo.com/setting.doc:l	regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.taboola.com	regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.4156480891.0000000000155000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.yahoo.com/ye	regsvr.exe, 00000000.00000003.4156480891.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231067722.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2231032889.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000002.4594333616.0000000000161000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://yahoo.com/setting.docAO	regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.yahoo.com/setting.doc?o	regsvr.exe, 00000000.00000003.2213312916.000000000015D000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2213352097.000000000015F000.00000004.00000020.00020000.00000000.sdmp, regsvr.exe, 00000000.00000003.2202910400.0000000000161000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.248.119.252	me-ycpi-cf-www.g06.yahoodns.net	United Kingdom		203220	YAHOO-DEBDE	false
74.6.143.25	yahoo.com	United States		26101	YAHOO-3US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591253
Start date and time:	2025-01-14 20:48:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	regsvr.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@12/13@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 72 Number of non-executed functions: 302
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:50:12	API Interceptor	1848x Sleep call for process: regsvr.exe modified
20:49:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Msn Messsenger C:\Windows\system32\regsvr.exe
20:49:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Msn Messsenger C:\Windows\system32\regsvr.exe
20:49:36	Autostart	Run: WinLogon Shell regsvr.exe
20:49:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Yahoo Messsenger C:\Users\user\AppData\Roaming\support\svchost.exe
20:49:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Yahoo Messsenger C:\Users\user\AppData\Roaming\support\svchost.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.248.119.252	http://fggddcurrently.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	mail.yahoo.com/
	https://meandyouj.weebly.com/	Get hash	malicious	Unknown	Browse	www.yahoo.com/
	http://ertyuytcurrently.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	mail.yahoo.com/
	https://njd.pages.dev/account/js-reporting/?crumb=uz4.07kerli&message=javascript_not_enabled&ref=/account/challenge/password	Get hash	malicious	HTMLPhisher	Browse	help.yahoo.com/kb/account?redirect=true
74.6.143.25	Project.exe	Get hash	malicious	Unknown	Browse	yahoo.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
me-ycpi-cf-www.g06.yahoodns.net	https://t.co/WUjzOGRMNx	Get hash	malicious	Unknown	Browse	87.248.119.252
	https://att-mail-987654.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.252
	http://currently0734.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.252
	https://meandyouj.weebly.com/	Get hash	malicious	Unknown	Browse	87.248.119.252
	https://attservicesinc.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.252
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Phisher	Browse	87.248.119.252
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	87.248.119.251
	Farahexperiences.com_Report_52288.pdf	Get hash	malicious	Unknown	Browse	87.248.119.252
	http://emaildlatt-mailcom-28e2uy93.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.252
	27987136e29b3032ad40982c8b7c2e168112c9601e08da806119dcba615524b5.html	Get hash	malicious	Unknown	Browse	87.248.119.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
YAHOO-3US	https://offfryfjtht767755433.webflow.io/	Get hash	malicious	Unknown	Browse	67.195.204.151
	Update-KB3406-x86.exe	Get hash	malicious	Unknown	Browse	67.195.204.73
	body.msg.bat.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	Update-KB3406-x86.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	Update-KB6125-x86.exe	Get hash	malicious	Unknown	Browse	67.195.204.73
	readme.msg.bat.exe	Get hash	malicious	Unknown	Browse	67.195.204.74
	Update-KB6125-x86.exe	Get hash	malicious	Unknown	Browse	67.195.204.73
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	98.139.166.53
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	74.6.55.55
	armv5l.elf	Get hash	malicious	Mirai	Browse	72.30.87.141
YAHOO-DEBDE	http://www.affordablehousing.com/MaineCWL	Get hash	malicious	Unknown	Browse	87.248.119.252
	https://microsoft-visio.en.softonic.com/	Get hash	malicious	Unknown	Browse	87.248.119.251
	https://offfryfjtht767755433.webflow.io/	Get hash	malicious	Unknown	Browse	87.248.119.252
	https://tinyurl.com/ch268ddp	Get hash	malicious	Unknown	Browse	87.248.119.252
	https://urlz.fr/tJIZ	Get hash	malicious	Unknown	Browse	87.248.119.251
	http://ww1.tryd.pro	Get hash	malicious	Unknown	Browse	87.248.119.252
	http://aeromorning.com	Get hash	malicious	Unknown	Browse	87.248.119.252
	http://ledger-recovery.co.uk/	Get hash	malicious	Unknown	Browse	87.248.119.252
	https://ledger-recovery.co.uk/public	Get hash	malicious	Unknown	Browse	87.248.119.251
	https://talktalk770.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	87.248.119.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	0dsIoO7xjt.docx	Get hash	malicious	Unknown	Browse	87.248.119.252 74.6.143.25
	inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	87.248.119.252 74.6.143.25
	1KaTo6P18Z.doc	Get hash	malicious	Unknown	Browse	87.248.119.252 74.6.143.25
	5UnAIdF7m2.docx	Get hash	malicious	Unknown	Browse	87.248.119.252 74.6.143.25
	x6yDsHJ9tr.exe	Get hash	malicious	Remcos, GuLoader	Browse	87.248.119.252 74.6.143.25
	LrBF2Z930N.exe	Get hash	malicious	Remcos, GuLoader	Browse	87.248.119.252 74.6.143.25
	2T10XBqS6g.exe	Get hash	malicious	Remcos, GuLoader	Browse	87.248.119.252 74.6.143.25
	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	87.248.119.252 74.6.143.25

Process:	C:\Users\user\Desktop\regsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	300730
Entropy (8bit):	7.982780278477302
Encrypted:	false
SSDEEP:	6144:mnvu6X0EvMzb7nRZHHDSnrsAdTBTGj3g43sLA2mf1I5UhcVf:mvuQ0AMb/U+LgiWA7CUhcVf
MD5:	05A5C685209891100860BBA7DE6E07BA
SHA1:	2A2BB52DCCF5CE3C83FF805AD3E185934D78C0CC
SHA-256:	D2DD6B923203A6366121C6EE663BC52035C25711B44051E87FA7B8E053945EFA
SHA-512:	E2AF5F4CE12120E662462E85556D34A094F8EDCD25B17E25969DBBD24CBA4821A8FE90B290B8DE8DFE0A480675168EBEC0BB68734D716DA41DECAF8BAFD85060
Malicious:	false
Reputation:	low
Preview:	EA06...................(....._..~...!..S9.......W19.D<..T..^............s.~.......ugk....ZX}\.".C.............J.c..( .......X.....@$W\U..S^....... .....t...TmH.A...:.........>0....j.P....\|."..u...f..6........@ .(,....S. .]......(0....PQ ...3...`..<...u..x....]...G.......@ ..u..a.X`...f......A....\|....\.O......l..I..A........K.W;...0........6... ........U...].a..q..J...t..=.+...Y.cn.E[......FB...b..L/..^.A...%~.....ul_...b..o.B...B=.......b.....t....KW....x.H6&. ..........w.../.....\|.."..+.......>.P.......?.m....z> ....P..14i..+T..h...H.lB...}.........!P.@.....z..\|.T......P......>...Q..Vq4h%.-S..=......R.0...!.......^.V.u\_....`..J.Zg..c.\|_..d..c..l2....1.i'....l\|P...t.....]#.E.OA....s^.]f..4..D.F1.I$B..M...8......P....b..%..S..:,.....+.../.].F ..X..u.b.L_{.4.010.^V{..cb..e..u.Mzi...b ......8>...........3....}..]"!V.......9P..\|..M...?.^.........]7.3.}.0...ss.] v..{.M.`..%....A>....!... .XW. .B0\|./..`.Z...o..V.@@g..c.F../5....s.....#.L....?4.q...@.... ...

C:\Users\user\AppData\Local\Temp\autA573.tmp

Download File

Process:	C:\Windows\regsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	300730
Entropy (8bit):	7.982780278477302
Encrypted:	false
SSDEEP:	6144:mnvu6X0EvMzb7nRZHHDSnrsAdTBTGj3g43sLA2mf1I5UhcVf:mvuQ0AMb/U+LgiWA7CUhcVf
MD5:	05A5C685209891100860BBA7DE6E07BA
SHA1:	2A2BB52DCCF5CE3C83FF805AD3E185934D78C0CC
SHA-256:	D2DD6B923203A6366121C6EE663BC52035C25711B44051E87FA7B8E053945EFA
SHA-512:	E2AF5F4CE12120E662462E85556D34A094F8EDCD25B17E25969DBBD24CBA4821A8FE90B290B8DE8DFE0A480675168EBEC0BB68734D716DA41DECAF8BAFD85060
Malicious:	false
Reputation:	low
Preview:	EA06...................(....._..~...!..S9.......W19.D<..T..^............s.~.......ugk....ZX}\.".C.............J.c..( .......X.....@$W\U..S^....... .....t...TmH.A...:.........>0....j.P....\|."..u...f..6........@ .(,....S. .]......(0....PQ ...3...`..<...u..x....]...G.......@ ..u..a.X`...f......A....\|....\.O......l..I..A........K.W;...0........6... ........U...].a..q..J...t..=.+...Y.cn.E[......FB...b..L/..^.A...%~.....ul_...b..o.B...B=.......b.....t....KW....x.H6&. ..........w.../.....\|.."..+.......>.P.......?.m....z> ....P..14i..+T..h...H.lB...}.........!P.@.....z..\|.T......P......>...Q..Vq4h%.-S..=......R.0...!.......^.V.u\_....`..J.Zg..c.\|_..d..c..l2....1.i'....l\|P...t.....]#.E.OA....s^.]f..4..D.F1.I$B..M...8......P....b..%..S..:,.....+.../.].F ..X..u.b.L_{.4.010.^V{..cb..e..u.Mzi...b ......8>...........3....}..]"!V.......9P..\|..M...?.^.........]7.3.}.0...ss.] v..{.M.`..%....A>....!... .XW. .B0\|./..`.Z...o..V.@@g..c.F../5....s.....#.L....?4.q...@.... ...

C:\Users\user\AppData\Roaming\regsvr.exe

Download File

Process:	C:\Windows\regsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765953
Entropy (8bit):	4.592914551404049
Encrypted:	false
SSDEEP:	6144:N3i8X7pt4Oti0BWmKWIBtOcI9SSbA+cuXhsBM7xX:N3TdtLW5WIj1YSSdFxsBSX
MD5:	E05F460EB752D40392F1D75D75716276
SHA1:	38320C10449E636FAB9C7649454B52248957EE1E
SHA-256:	804465598E1EDC091A4EC8844CD7D8C81063EBAD37339A1D646E0E0F242C5B89
SHA-512:	C7B50835A862C2E681C541DBE3E4AACC1B850896318DAE1E774E554F54B40237815A7352C12F1DBE90057643A8C7E5E547148C75EF6650F82AF948EA819DD1A0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Reputation:	low
Preview:	MZ......................@....... ....................................!..L.!This program cannot be run in DOS mode....$........$.qVE."VE."VE."..."TE."q.."bE."q..".E.".J."_E.".J."ME."VE.".D."q.."oE."q.."sE."q.."WE."q.."WE."RichVE."........................PE..L....>IG..........#......R...........P.......p....@..........................P.......5........@.............................._...........^..................T_.......................................................................................text....`..........................@....rdata.......p...D..................@....data........`.......L..............@....rsrc....`...........X..............@....vc++....P...P...J...h.............. ....adata..............................@....vsp................l..4.....9.....`...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\regsvr.exe:Zone.Identifier

Download File

Process:	C:\Windows\regsvr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\setup.ini

Download File

Process:	C:\Windows\regsvr.exe
File Type:	Microsoft Windows Autorun file
Category:	modified
Size (bytes):	96
Entropy (8bit):	4.357433142101641
Encrypted:	false
SSDEEP:	3:03BqVurVTWCsLPWTWCsj5d1iuXWiCsnAcv:Sqwr5WViTWVpiuZVv
MD5:	9ECE103C47335F0CC777F1132B8D522F
SHA1:	63AFA171C64F86D99DB81723E1335E960E85FA43
SHA-256:	69815D4932DDDE240CE6B1353305D2FAB58CA402E9C478452C8E37CE8A7B2AC9
SHA-512:	B1AC64C71C6338BF0AB33DF938128822DA680F20D0552EDB2EDB808F1C75BAFB88467412FC8DC60ED8022A1F0C4F3FCBECB69A320EC871B3A766482F32D6EB05
Malicious:	false
Preview:	[Autorun]..Open=regsvr.exe..Shellexecute=regsvr.exe..Shell\Open\command=regsvr.exe..Shell=Open..

C:\Windows\SysWOW64\regsvr.exe

Download File

Process:	C:\Users\user\Desktop\regsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765953
Entropy (8bit):	4.592914551404049
Encrypted:	false
SSDEEP:	6144:N3i8X7pt4Oti0BWmKWIBtOcI9SSbA+cuXhsBM7xX:N3TdtLW5WIj1YSSdFxsBSX
MD5:	E05F460EB752D40392F1D75D75716276
SHA1:	38320C10449E636FAB9C7649454B52248957EE1E
SHA-256:	804465598E1EDC091A4EC8844CD7D8C81063EBAD37339A1D646E0E0F242C5B89
SHA-512:	C7B50835A862C2E681C541DBE3E4AACC1B850896318DAE1E774E554F54B40237815A7352C12F1DBE90057643A8C7E5E547148C75EF6650F82AF948EA819DD1A0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@....... ....................................!..L.!This program cannot be run in DOS mode....$........$.qVE."VE."VE."..."TE."q.."bE."q..".E.".J."_E.".J."ME."VE.".D."q.."oE."q.."sE."q.."WE."q.."WE."RichVE."........................PE..L....>IG..........#......R...........P.......p....@..........................P.......5........@.............................._...........^..................T_.......................................................................................text....`..........................@....rdata.......p...D..................@....data........`.......L..............@....rsrc....`...........X..............@....vc++....P...P...J...h.............. ....adata..............................@....vsp................l..4.....9.....`...........................................................................................................................................................................................................................

C:\Windows\SysWOW64\regsvr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\regsvr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\setting.ini

Download File

Process:	C:\Users\user\Desktop\regsvr.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	E0AA021E21DDDBD6D8CECEC71E9CF564
SHA1:	9CE3BD4224C8C1780DB56B4125ECF3F24BF748B7
SHA-256:	565339BC4D33D72817B583024112EB7F5CDF3E5EEF0252D6EC1B9C9A94E12BB3
SHA-512:	900110C951560EFF857B440E89CC29F529416E0E3B3D7F0AD51651BFDBD8025B91768C5ED7DB5352D1A5523354CE06CED2C42047E33A3E958A1BBA5F742DB874
Malicious:	false
Preview:	OK

C:\Windows\SysWOW64\setup.ini

Download File

Process:	C:\Users\user\Desktop\regsvr.exe
File Type:	Microsoft Windows Autorun file
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.357433142101641
Encrypted:	false
SSDEEP:	3:03BqVurVTWCsLPWTWCsj5d1iuXWiCsnAcv:Sqwr5WViTWVpiuZVv
MD5:	9ECE103C47335F0CC777F1132B8D522F
SHA1:	63AFA171C64F86D99DB81723E1335E960E85FA43
SHA-256:	69815D4932DDDE240CE6B1353305D2FAB58CA402E9C478452C8E37CE8A7B2AC9
SHA-512:	B1AC64C71C6338BF0AB33DF938128822DA680F20D0552EDB2EDB808F1C75BAFB88467412FC8DC60ED8022A1F0C4F3FCBECB69A320EC871B3A766482F32D6EB05
Malicious:	false
Preview:	[Autorun]..Open=regsvr.exe..Shellexecute=regsvr.exe..Shell\Open\command=regsvr.exe..Shell=Open..

C:\Windows\SysWOW64\svchost .exe

Download File

Process:	C:\Users\user\Desktop\regsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765953
Entropy (8bit):	4.592914551404049
Encrypted:	false
SSDEEP:	6144:N3i8X7pt4Oti0BWmKWIBtOcI9SSbA+cuXhsBM7xX:N3TdtLW5WIj1YSSdFxsBSX
MD5:	E05F460EB752D40392F1D75D75716276
SHA1:	38320C10449E636FAB9C7649454B52248957EE1E
SHA-256:	804465598E1EDC091A4EC8844CD7D8C81063EBAD37339A1D646E0E0F242C5B89
SHA-512:	C7B50835A862C2E681C541DBE3E4AACC1B850896318DAE1E774E554F54B40237815A7352C12F1DBE90057643A8C7E5E547148C75EF6650F82AF948EA819DD1A0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@....... ....................................!..L.!This program cannot be run in DOS mode....$........$.qVE."VE."VE."..."TE."q.."bE."q..".E.".J."_E.".J."ME."VE.".D."q.."oE."q.."sE."q.."WE."q.."WE."RichVE."........................PE..L....>IG..........#......R...........P.......p....@..........................P.......5........@.............................._...........^..................T_.......................................................................................text....`..........................@....rdata.......p...D..................@....data........`.......L..............@....rsrc....`...........X..............@....vc++....P...P...J...h.............. ....adata..............................@....vsp................l..4.....9.....`...........................................................................................................................................................................................................................

C:\Windows\SysWOW64\svchost .exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\regsvr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\regsvr.exe

Download File

Process:	C:\Users\user\Desktop\regsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765953
Entropy (8bit):	4.592914551404049
Encrypted:	false
SSDEEP:	6144:N3i8X7pt4Oti0BWmKWIBtOcI9SSbA+cuXhsBM7xX:N3TdtLW5WIj1YSSdFxsBSX
MD5:	E05F460EB752D40392F1D75D75716276
SHA1:	38320C10449E636FAB9C7649454B52248957EE1E
SHA-256:	804465598E1EDC091A4EC8844CD7D8C81063EBAD37339A1D646E0E0F242C5B89
SHA-512:	C7B50835A862C2E681C541DBE3E4AACC1B850896318DAE1E774E554F54B40237815A7352C12F1DBE90057643A8C7E5E547148C75EF6650F82AF948EA819DD1A0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@....... ....................................!..L.!This program cannot be run in DOS mode....$........$.qVE."VE."VE."..."TE."q.."bE."q..".E.".J."_E.".J."ME."VE.".D."q.."oE."q.."sE."q.."WE."q.."WE."RichVE."........................PE..L....>IG..........#......R...........P.......p....@..........................P.......5........@.............................._...........^..................T_.......................................................................................text....`..........................@....rdata.......p...D..................@....data........`.......L..............@....rsrc....`...........X..............@....vc++....P...P...J...h.............. ....adata..............................@....vsp................l..4.....9.....`...........................................................................................................................................................................................................................

C:\Windows\regsvr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\regsvr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.592914551404049
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	regsvr.exe
File size:	765'953 bytes
MD5:	e05f460eb752d40392f1d75d75716276
SHA1:	38320c10449e636fab9c7649454b52248957ee1e
SHA256:	804465598e1edc091a4ec8844cd7d8c81063ebad37339a1d646e0e0f242c5b89
SHA512:	c7b50835a862c2e681c541dbe3e4aacc1b850896318dae1e774e554f54b40237815a7352c12f1dbe90057643a8c7e5e547148c75ef6650f82af948ea819dd1a0
SSDEEP:	6144:N3i8X7pt4Oti0BWmKWIBtOcI9SSbA+cuXhsBM7xX:N3TdtLW5WIj1YSSdFxsBSX
TLSH:	5AF4D002612BF5E4E82C8C76294730FA1BC56D615E0FEE25705DBF3738762E4AD0A52B
File Content Preview:	MZ......................@....... ....................................!..L.!This program cannot be run in DOS mode....$........$.qVE."VE."VE."..."TE."q.."bE."q..".E.".J."_E.".J."ME."VE.".D."q.."oE."q.."sE."q.."WE."q.."WE."RichVE.".......................

File Icon


Icon Hash:	25ced24e627e1e01

Static PE Info

General

Entrypoint:	0x4a5000
Entrypoint Section:	.vc++
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x47493EAA [Sun Nov 25 09:21:46 2007 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7d580e3bc0d56dc97c988e38179b1756

Entrypoint Preview

Instruction
nop
pushad
call 00007F3C58D593E8h
jmp 00007F3C9E3298D0h
push ebp
ret
call 00007F3C58D593E6h
jmp 00007F3C58D5943Fh
mov ebx, FFFFFFEDh
add ebx, ebp
sub ebx, 000A5000h
cmp dword ptr [ebp+00000422h], 00000000h
mov dword ptr [ebp+00000422h], ebx
jne 00007F3C58D5974Bh
lea eax, dword ptr [ebp+0000042Eh]
push eax
call dword ptr [ebp+00000F4Dh]
mov dword ptr [ebp+00000426h], eax
mov edi, eax
lea ebx, dword ptr [ebp+5Eh]
push ebx
push eax
call dword ptr [ebp+00000F49h]
mov dword ptr [ebp+0000054Dh], eax
lea ebx, dword ptr [ebp+6Bh]
push ebx
push edi
call dword ptr [ebp+00000F49h]
mov dword ptr [ebp+00000551h], eax
lea eax, dword ptr [ebp+77h]
jmp eax
push esi
imul esi, dword ptr [edx+74h], 416C6175h
insb
insb
outsd
arpl word ptr [eax], ax
push esi
imul esi, dword ptr [edx+74h], 466C6175h
jc 00007F3C58D59447h
add byte ptr [ebx+0005319Dh], cl
add byte ptr [ebx], cl

Rich Headers

Programming Language:

[C++] VS2005 build 50727
[ C ] VS2005 build 50727
[ASM] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa5fac	0x2c8	.vc++
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8f000	0x15ed0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5f54	0x8	.vc++
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x100000

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x66000	0x30400	d9d97730b6ccc9fb116199255d493c78	False	0.9984820272020726	data	7.998539298621614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x67000	0xf000	0x4400	05a7ad5d0679e42057520ca594660a3f	False	1.0009191176470589	data	7.986857792277237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x76000	0x19000	0xc00	97fce54178d4c14f5b98ce73426c45f2	False	0.9879557291666666	data	7.874420644458337	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8f000	0x16000	0x1000	bb7bc224d4567eb4333742fbea5652ef	False	0.674072265625	data	6.330193660679065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vc++	0xa5000	0x15000	0x14a00	f1b8ac7590e3f4b823bcec760edf4975	False	0.21271306818181818	data	5.103013094701391	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.adata	0xba000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vsp	0xbb000	0x96dc	0x9800	31e14c04c60244fdc3737cc73a13aacd	False	0.0015419407894736842	data	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xb92c8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	English	Great Britain	0.11036585365853659
RT_ICON	0xb8fe0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.1827956989247312
RT_ICON	0xb8eb8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.4222972972972973
RT_ICON	0xb8010	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2867803837953092
RT_ICON	0xb7768	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.35965703971119134
RT_ICON	0xb70a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	English	Great Britain	0.4216589861751152
RT_ICON	0xb6b38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.42846820809248554
RT_ICON	0xb4590	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.2020746887966805
RT_ICON	0xb34e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.2976078799249531
RT_ICON	0xb33c0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xb3298	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xb2910	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	Great Britain	0.4262295081967213
RT_ICON	0xb24a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.350177304964539
RT_ICON	0xaf800	0x2ca8	Device independent bitmap graphic, 96 x 192 x 8, image size 0	English	Great Britain	0.3191042687193842
RT_ICON	0xa6358	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 0	English	Great Britain	0.10074626865671642
RT_MENU	0xa2b40	0x40	empty	English	Great Britain	0
RT_DIALOG	0xa2b80	0xf0	empty	English	Great Britain	0
RT_STRING	0xa2c70	0x588	empty	English	Great Britain	0
RT_STRING	0xa31f8	0x690	empty	English	Great Britain	0
RT_STRING	0xa3888	0x4ce	empty	English	Great Britain	0
RT_STRING	0xa3d58	0x604	empty	English	Great Britain	0
RT_STRING	0xa435c	0x65e	empty	English	Great Britain	0
RT_STRING	0xa49bc	0x430	empty	English	Great Britain	0
RT_GROUP_ICON	0xa629c	0xbc	data	English	Great Britain	0.6223404255319149
RT_GROUP_ICON	0xa6288	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xa6274	0x14	data	English	Great Britain	1.25

Imports

DLL	Import
kernel32.dll	GetProcAddress, GetModuleHandleA, LoadLibraryA
advapi32.dll	RegEnumValueW
comctl32.dll	ImageList_EndDrag
comdlg32.dll	GetSaveFileNameW
gdi32.dll	MoveToEx
mpr.dll	WNetUseConnectionW
ole32.dll	OleSetContainedObject
oleaut32.dll	LoadRegTypeLib
shell32.dll	DragQueryPoint
user32.dll	GetWindowTextLengthW
version.dll	GetFileVersionInfoSizeW
winmm.dll	waveOutSetVolume
wsock32.dll	__WSAFDIsSet

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T20:49:09.661212+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49705	74.6.143.25	80	TCP
2025-01-14T20:49:09.661212+0100	2012200	ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc	1	192.168.2.5	49705	74.6.143.25	80	TCP
2025-01-14T20:49:10.598364+0100	2012200	ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc	1	192.168.2.5	49706	74.6.143.25	443	TCP
2025-01-14T20:49:11.678741+0100	2012200	ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc	1	192.168.2.5	49707	87.248.119.252	443	TCP
2025-01-14T20:49:12.843490+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49705	74.6.143.25	80	TCP
2025-01-14T20:49:12.843490+0100	2012200	ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc	1	192.168.2.5	49705	74.6.143.25	80	TCP
2025-01-14T20:49:13.479647+0100	2012200	ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc	1	192.168.2.5	49708	74.6.143.25	443	TCP
2025-01-14T20:49:14.520787+0100	2012200	ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc	1	192.168.2.5	49709	87.248.119.252	443	TCP
2025-01-14T20:49:15.186129+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49710	87.248.119.252	80	TCP
2025-01-14T20:49:15.186129+0100	2012200	ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc	1	192.168.2.5	49710	87.248.119.252	80	TCP
2025-01-14T20:49:16.293240+0100	2012200	ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.doc	1	192.168.2.5	49712	87.248.119.252	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 20:49:09.168083906 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:09.173027039 CET	80	49705	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:09.173119068 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:09.175412893 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:09.180188894 CET	80	49705	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:09.661051989 CET	80	49705	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:09.661211967 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:09.734637022 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:09.734685898 CET	443	49706	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:09.734756947 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:09.871505976 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:09.871539116 CET	443	49706	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:10.372716904 CET	443	49706	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:10.372818947 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:10.480051994 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:10.480078936 CET	443	49706	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:10.480385065 CET	443	49706	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:10.480447054 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:10.483031034 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:10.527323008 CET	443	49706	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:10.598402977 CET	443	49706	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:10.598473072 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:10.598500013 CET	443	49706	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:10.598532915 CET	443	49706	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:10.598541021 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:10.598576069 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:10.601852894 CET	49706	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:10.601869106 CET	443	49706	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:10.623267889 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:10.623352051 CET	443	49707	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:10.623433113 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:10.623825073 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:10.623853922 CET	443	49707	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:11.376279116 CET	443	49707	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:11.376358032 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:11.377079010 CET	443	49707	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:11.377135992 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:11.383271933 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:11.383301020 CET	443	49707	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:11.383590937 CET	443	49707	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:11.383647919 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:11.384053946 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:11.427347898 CET	443	49707	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:11.678796053 CET	443	49707	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:11.679020882 CET	443	49707	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:11.679106951 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:11.679107904 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:11.682960033 CET	49707	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:11.682984114 CET	443	49707	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:12.730628014 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:12.735402107 CET	80	49705	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:12.843327999 CET	80	49705	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:12.843489885 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:12.851675987 CET	49708	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:12.851783037 CET	443	49708	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:12.851902962 CET	49708	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:12.852379084 CET	49708	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:12.852415085 CET	443	49708	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:13.349868059 CET	443	49708	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:13.349920988 CET	49708	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:13.350982904 CET	49708	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:13.350992918 CET	443	49708	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:13.351330996 CET	49708	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:13.351335049 CET	443	49708	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:13.479660034 CET	443	49708	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:13.479737997 CET	49708	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:13.479775906 CET	443	49708	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:13.479793072 CET	443	49708	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:13.479818106 CET	49708	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:13.479851007 CET	49708	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:13.480848074 CET	49708	443	192.168.2.5	74.6.143.25
Jan 14, 2025 20:49:13.480865002 CET	443	49708	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:13.488673925 CET	49709	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:13.488725901 CET	443	49709	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:13.488801956 CET	49709	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:13.489131927 CET	49709	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:13.489145994 CET	443	49709	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:14.212496996 CET	443	49709	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:14.212662935 CET	49709	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:14.213720083 CET	49709	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:14.213741064 CET	443	49709	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:14.214036942 CET	49709	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:14.214049101 CET	443	49709	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:14.520792007 CET	443	49709	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:14.520914078 CET	443	49709	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:14.520987034 CET	49709	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:14.521023035 CET	49709	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:14.522979021 CET	49709	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:14.523005009 CET	443	49709	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:14.546408892 CET	49710	80	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:14.551460028 CET	80	49710	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:14.551563978 CET	49710	80	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:14.551749945 CET	49710	80	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:14.556554079 CET	80	49710	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:15.186063051 CET	80	49710	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:15.186129093 CET	49710	80	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:15.187129974 CET	49712	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:15.187192917 CET	443	49712	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:15.187275887 CET	49712	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:15.187540054 CET	49712	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:15.187556982 CET	443	49712	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:15.920939922 CET	443	49712	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:15.921080112 CET	49712	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:16.002023935 CET	49712	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:16.002048969 CET	443	49712	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:16.002289057 CET	49712	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:16.002294064 CET	443	49712	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:16.293260098 CET	443	49712	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:16.293401957 CET	443	49712	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:16.293427944 CET	49712	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:16.293459892 CET	49712	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:16.294964075 CET	49712	443	192.168.2.5	87.248.119.252
Jan 14, 2025 20:49:16.294987917 CET	443	49712	87.248.119.252	192.168.2.5
Jan 14, 2025 20:49:23.127676964 CET	80	49705	74.6.143.25	192.168.2.5
Jan 14, 2025 20:49:23.127743006 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:50:46.084965944 CET	80	49710	87.248.119.252	192.168.2.5
Jan 14, 2025 20:50:46.087183952 CET	49710	80	192.168.2.5	87.248.119.252
Jan 14, 2025 20:50:59.197695017 CET	49710	80	192.168.2.5	87.248.119.252
Jan 14, 2025 20:50:59.197783947 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:50:59.202625036 CET	80	49710	87.248.119.252	192.168.2.5
Jan 14, 2025 20:50:59.541534901 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:51:00.244671106 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:51:01.541603088 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:51:04.041594028 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:51:08.932244062 CET	49705	80	192.168.2.5	74.6.143.25
Jan 14, 2025 20:51:18.541594028 CET	49705	80	192.168.2.5	74.6.143.25

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 20:49:09.129997015 CET	56537	53	192.168.2.5	1.1.1.1
Jan 14, 2025 20:49:09.136773109 CET	53	56537	1.1.1.1	192.168.2.5
Jan 14, 2025 20:49:10.614804983 CET	52485	53	192.168.2.5	1.1.1.1
Jan 14, 2025 20:49:10.622229099 CET	53	52485	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 20:49:09.129997015 CET	192.168.2.5	1.1.1.1	0xcb0	Standard query (0)	yahoo.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 20:49:10.614804983 CET	192.168.2.5	1.1.1.1	0x436f	Standard query (0)	www.yahoo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 20:49:09.136773109 CET	1.1.1.1	192.168.2.5	0xcb0	No error (0)	yahoo.com		74.6.143.25	A (IP address)	IN (0x0001)	false
Jan 14, 2025 20:49:09.136773109 CET	1.1.1.1	192.168.2.5	0xcb0	No error (0)	yahoo.com		98.137.11.163	A (IP address)	IN (0x0001)	false
Jan 14, 2025 20:49:09.136773109 CET	1.1.1.1	192.168.2.5	0xcb0	No error (0)	yahoo.com		74.6.143.26	A (IP address)	IN (0x0001)	false
Jan 14, 2025 20:49:09.136773109 CET	1.1.1.1	192.168.2.5	0xcb0	No error (0)	yahoo.com		74.6.231.21	A (IP address)	IN (0x0001)	false
Jan 14, 2025 20:49:09.136773109 CET	1.1.1.1	192.168.2.5	0xcb0	No error (0)	yahoo.com		98.137.11.164	A (IP address)	IN (0x0001)	false
Jan 14, 2025 20:49:09.136773109 CET	1.1.1.1	192.168.2.5	0xcb0	No error (0)	yahoo.com		74.6.231.20	A (IP address)	IN (0x0001)	false
Jan 14, 2025 20:49:10.622229099 CET	1.1.1.1	192.168.2.5	0x436f	No error (0)	www.yahoo.com	me-ycpi-cf-www.g06.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 20:49:10.622229099 CET	1.1.1.1	192.168.2.5	0x436f	No error (0)	me-ycpi-cf-www.g06.yahoodns.net		87.248.119.252	A (IP address)	IN (0x0001)	false
Jan 14, 2025 20:49:10.622229099 CET	1.1.1.1	192.168.2.5	0x436f	No error (0)	me-ycpi-cf-www.g06.yahoodns.net		87.248.119.251	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

yahoo.com

www.yahoo.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	74.6.143.25	80	6508	C:\Users\user\Desktop\regsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 20:49:09.175412893 CET	71	OUT	GET /setting.doc HTTP/1.1 Host: yahoo.com Cache-Control: no-cache
Jan 14, 2025 20:49:09.661051989 CET	287	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 19:49:09 GMT Connection: keep-alive Server: ATS Cache-Control: no-store, no-cache Content-Type: text/html Content-Language: en X-Frame-Options: SAMEORIGIN Location: https://yahoo.com/setting.doc Content-Length: 8 Data Raw: 72 65 64 69 72 65 63 74 Data Ascii: redirect
Jan 14, 2025 20:49:12.730628014 CET	71	OUT	GET /setting.doc HTTP/1.1 Host: yahoo.com Cache-Control: no-cache
Jan 14, 2025 20:49:12.843327999 CET	287	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 19:49:12 GMT Connection: keep-alive Server: ATS Cache-Control: no-store, no-cache Content-Type: text/html Content-Language: en X-Frame-Options: SAMEORIGIN Location: https://yahoo.com/setting.doc Content-Length: 8 Data Raw: 72 65 64 69 72 65 63 74 Data Ascii: redirect

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	87.248.119.252	80	6508	C:\Users\user\Desktop\regsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 20:49:14.551749945 CET	75	OUT	GET /setting.doc HTTP/1.1 Host: www.yahoo.com Cache-Control: no-cache
Jan 14, 2025 20:49:15.186063051 CET	245	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 19:49:15 GMT Connection: keep-alive Server: ATS Cache-Control: no-store Content-Type: text/html Content-Language: en Location: https://www.yahoo.com/setting.doc Content-Length: 1 Data Raw: 0a Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	74.6.143.25	443	6508	C:\Users\user\Desktop\regsvr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 19:49:10 UTC	95	OUT	GET /setting.doc HTTP/1.1 Cache-Control: no-cache Host: yahoo.com Connection: Keep-Alive
2025-01-14 19:49:10 UTC	439	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 19:49:10 GMT Connection: keep-alive Strict-Transport-Security: max-age=31536000 Server: ATS Cache-Control: no-store, no-cache Content-Type: text/html Content-Language: en X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Location: https://www.yahoo.com/setting.doc Content-Length: 8
2025-01-14 19:49:10 UTC	8	IN	Data Raw: 72 65 64 69 72 65 63 74 Data Ascii: redirect

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	87.248.119.252	443	6508	C:\Users\user\Desktop\regsvr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 19:49:11 UTC	99	OUT	GET /setting.doc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Host: www.yahoo.com
2025-01-14 19:49:11 UTC	1200	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 19:49:11 GMT Strict-Transport-Security: max-age=31536000 Server: ATS Cache-Control: no-store, no-cache, max-age=0, private Content-Type: text/html Content-Language: en Expires: -1 X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff Content-Length: 2 Age: 0 Connection: close Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.pnr.ouryahoo.com https://pnr.ouryahoo.com https://.search.aol.com https://.search.huffpost.com https://.onesearch.com https://.verizonmedia.com https://*.publishing.oath.com https://cdn.taboola.com https://ads.taboola.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=news&region=US&lang=en-US&device=desktop&yrid=6o9nr8tivmg0j&partner=;
2025-01-14 19:49:11 UTC	2	IN	Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	74.6.143.25	443	6508	C:\Users\user\Desktop\regsvr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 19:49:13 UTC	95	OUT	GET /setting.doc HTTP/1.1 Cache-Control: no-cache Host: yahoo.com Connection: Keep-Alive
2025-01-14 19:49:13 UTC	439	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 19:49:13 GMT Connection: keep-alive Strict-Transport-Security: max-age=31536000 Server: ATS Cache-Control: no-store, no-cache Content-Type: text/html Content-Language: en X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Location: https://www.yahoo.com/setting.doc Content-Length: 8
2025-01-14 19:49:13 UTC	8	IN	Data Raw: 72 65 64 69 72 65 63 74 Data Ascii: redirect

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	87.248.119.252	443	6508	C:\Users\user\Desktop\regsvr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 19:49:14 UTC	99	OUT	GET /setting.doc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Host: www.yahoo.com
2025-01-14 19:49:14 UTC	1200	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 19:49:14 GMT Strict-Transport-Security: max-age=31536000 Server: ATS Cache-Control: no-store, no-cache, max-age=0, private Content-Type: text/html Content-Language: en Expires: -1 X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff Content-Length: 2 Age: 0 Connection: close Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.pnr.ouryahoo.com https://pnr.ouryahoo.com https://.search.aol.com https://.search.huffpost.com https://.onesearch.com https://.verizonmedia.com https://*.publishing.oath.com https://cdn.taboola.com https://ads.taboola.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=news&region=US&lang=en-US&device=desktop&yrid=6o9nr8tivmg0j&partner=;
2025-01-14 19:49:14 UTC	2	IN	Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	87.248.119.252	443	6508	C:\Users\user\Desktop\regsvr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 19:49:15 UTC	99	OUT	GET /setting.doc HTTP/1.1 Cache-Control: no-cache Host: www.yahoo.com Connection: Keep-Alive
2025-01-14 19:49:16 UTC	1200	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 19:49:16 GMT Strict-Transport-Security: max-age=31536000 Server: ATS Cache-Control: no-store, no-cache, max-age=0, private Content-Type: text/html Content-Language: en Expires: -1 X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Content-Type-Options: nosniff Content-Length: 2 Age: 0 Connection: close Content-Security-Policy: frame-ancestors 'self' https://.builtbygirls.com https://.rivals.com https://.engadget.com https://.intheknow.com https://.autoblog.com https://.techcrunch.com https://.yahoo.com https://.aol.com https://.huffingtonpost.com https://.oath.com https://.search.yahoo.com https://.pnr.ouryahoo.com https://pnr.ouryahoo.com https://.search.aol.com https://.search.huffpost.com https://.onesearch.com https://.verizonmedia.com https://*.publishing.oath.com https://cdn.taboola.com https://ads.taboola.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=news&region=US&lang=en-US&device=desktop&yrid=6o9nr8tivmg0j&partner=;
2025-01-14 19:49:16 UTC	2	IN	Data Raw: 4f 4b Data Ascii: OK

Target ID:	0
Start time:	14:49:07
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\regsvr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\regsvr.exe"
Imagebase:	0x400000
File size:	765'953 bytes
MD5 hash:	E05F460EB752D40392F1D75D75716276
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:49:07
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /C AT /delete /yes
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:49:07
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:49:07
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	AT /delete /yes
Imagebase:	0xc40000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:49:08
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:49:08
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:49:08
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\at.exe
Wow64 process (32bit):	true
Commandline:	AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe
Imagebase:	0xc40000
File size:	25'088 bytes
MD5 hash:	2AE20048111861FA09B709D3CC551AD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:49:36
Start date:	14/01/2025
Path:	C:\Windows\regsvr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\regsvr.exe"
Imagebase:	0x400000
File size:	765'953 bytes
MD5 hash:	E05F460EB752D40392F1D75D75716276
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	35

Executed Functions

Function 00422477 Relevance: 37.1, APIs: 19, Strings: 2, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042799C: LoadLibraryA.KERNEL32(Wininet.dll,?,?,004224A7), ref: 004279A7
Part of subcall function 0042799C: GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 004279B9

FreeLibrary.KERNEL32(00000000), ref: 0042288F

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 00422D64: FreeLibrary.KERNEL32(00000000), ref: 00422D8B

GetLastError.KERNEL32(?,00000000,?,?,?,?,?), ref: 00422560
GetLastError.KERNEL32 ref: 004225EB
FreeLibrary.KERNEL32(?), ref: 00422610
FreeLibrary.KERNEL32(00000000), ref: 004227A8

Strings

Wininet.dll, xrefs: 0042271B
InternetOpenUrlW, xrefs: 0042272E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$Free$ErrorLast$AddressLoadMessageProc
String ID: InternetOpenUrlW$Wininet.dll
API String ID: 2866533396-1201172734
Opcode ID: 1639af020b3ccf60068b8fbf7486d664327b795c502b41eafc1be8d237b6ff63
Instruction ID: 0b258b1817af18fe24c17d00a4c81d806bb1e3b45cad99637a574585516463cb
Opcode Fuzzy Hash: 1639af020b3ccf60068b8fbf7486d664327b795c502b41eafc1be8d237b6ff63
Instruction Fuzzy Hash: 9FB19D71608364AFD7119F65ED84A6FB7E4FB84308F40093FF84592261EBB89944CB9E

Function 0040C78E Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 178
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040C4DB: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\regsvr.exe,00000104,0048D8B0,C:\Users\user\Desktop\regsvr.exe,?,?,00406C7E,C:\Users\user\Desktop\regsvr.exe,00000104), ref: 0040C4F9

Part of subcall function 0040C5CD: __wcsicmp.LIBCMT ref: 0040C664

GetFileAttributesW.KERNEL32(?), ref: 0040C7EC
_wcscat.LIBCMT ref: 0040C805
GetFileAttributesW.KERNEL32(?), ref: 0040C814
_wcscat.LIBCMT ref: 0040C828
FindFirstFileW.KERNEL32(?,?), ref: 0040C86F
_wcscpy.LIBCMT ref: 0040C8DF
_wcscat.LIBCMT ref: 0040C8F1
_wcscat.LIBCMT ref: 0040C903
lstrcmpiW.KERNEL32(?,?), ref: 0040C925
DeleteFileW.KERNEL32(?), ref: 0040C932
MoveFileW.KERNEL32(?,?), ref: 0040C952
CopyFileW.KERNEL32(?,?,00000000), ref: 0040C962
DeleteFileW.KERNEL32(?), ref: 0040C96D
CopyFileW.KERNEL32(?,?,00000000), ref: 0040C97D
FindClose.KERNEL32(?), ref: 0040C987
MoveFileW.KERNEL32(?,?), ref: 0040C996
FindNextFileW.KERNEL32(?,00000010), ref: 0040C9AE
FindClose.KERNEL32(?), ref: 0040C9CB

Strings

\*.*, xrefs: 0040C7F1, 0040C803, 0040C826

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseCopyDeleteMove$FirstFullNameNextPath__wcsicmp_wcscpylstrcmpi
String ID: \*.*
API String ID: 768025798-1173974218
Opcode ID: 10b2d1794f889928ce0e0e9e551be00faccc2560a39368bc2c4d36c533d22c20
Instruction ID: ac382173c2676c855cfac5d4542afd1b052519be0a49c5268b83ac1b6772a6c9
Opcode Fuzzy Hash: 10b2d1794f889928ce0e0e9e551be00faccc2560a39368bc2c4d36c533d22c20
Instruction Fuzzy Hash: E45184B2008345AAD721DFA1DC89EDF77ECAB45314F040A2FF585D2191EB38D548C7AA

Function 0040108C Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 004010AD

Part of subcall function 004013FE: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\regsvr.exe,00000104,?,00000104), ref: 0040143E
Part of subcall function 004013FE: __wcsicmp.LIBCMT ref: 00401546

Part of subcall function 0040E2B5: GetModuleHandleA.KERNEL32(kernel32.dll,004010C0,?), ref: 0040E2BA
Part of subcall function 0040E2B5: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0040E2CA

MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,0046BD8E,00000010), ref: 004010D2
SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\regsvr.exe), ref: 0040117A

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 004010E4, 00401152, 0040115F, 004011D7, 00401287
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support., xrefs: 004010CB
runas, xrefs: 004011FA, 0040122D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CurrentDirectoryModule$AddressFileHandleMessageNameProc__wcsicmp
String ID: C:\Users\user\Desktop\regsvr.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
API String ID: 100587416-3456153593
Opcode ID: bbcb086491826c9c086e2e5048280d0f062283ebc6428eca5842b34c6c0e4702
Instruction ID: a517a9db5f85c4c96bb8fc9c2871e4bd747f39243f1e7ce5074cf97865ffdd83
Opcode Fuzzy Hash: bbcb086491826c9c086e2e5048280d0f062283ebc6428eca5842b34c6c0e4702
Instruction Fuzzy Hash: 83510471904254AAEB10BBA59C05FAE7B78EB45308F0404BFF501B61E2D7BC89858B6E

Function 0041DE3C Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 121
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000003,?,75918FB0,75923340,00000000), ref: 0041DE5D
GetFileAttributesW.KERNEL32(?), ref: 0041DEA6
SetFileAttributesW.KERNEL32(?,00000000), ref: 0041DEBC
FindNextFileW.KERNELBASE(00000000,?), ref: 0041DECC
FindClose.KERNEL32(00000000), ref: 0041DED9
FindClose.KERNEL32(00000000), ref: 0041DEE6
FindFirstFileW.KERNEL32(*.*,?), ref: 0041DEFB
SetCurrentDirectoryW.KERNEL32(?), ref: 0041DF42

Part of subcall function 0041DE3C: SetCurrentDirectoryW.KERNEL32(0046FAA8,00000003,00000000,?,00000000), ref: 0041DF62

FindNextFileW.KERNEL32(?,00000010), ref: 0041DF6D
FindClose.KERNEL32(?), ref: 0041DF7D

Strings

*.*, xrefs: 0041DEF6

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 10bb8065325b9965cb294d6f61081a68c99e569a702118bdb6baabe53864fc73
Instruction ID: a4d2aa76a43ea5969c1a1a81fb0d8a6e3f8afc9f3cd91bb763ce84b1788f51b6
Opcode Fuzzy Hash: 10bb8065325b9965cb294d6f61081a68c99e569a702118bdb6baabe53864fc73
Instruction Fuzzy Hash: 2F31E4B290C305AADB00DFA0DC419EF77ECAF56315F10052BF990C3291E739E9498B9A

Function 004053EF Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 215
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?,00000000), ref: 0040540C
_wcscpy.LIBCMT ref: 0040556D
LoadLibraryA.KERNEL32(kernel32.dll,?), ref: 0040567F
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00405692
GetCurrentProcess.KERNEL32(?), ref: 004056A7
GetNativeSystemInfo.KERNEL32(?), ref: 004056FF
FreeLibrary.KERNEL32(?), ref: 0040570A
GetSystemInfo.KERNEL32(?), ref: 00405712
FreeLibrary.KERNEL32(?), ref: 00405765

Strings

IsWow64Process, xrefs: 0040568C
kernel32.dll, xrefs: 00405677

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$FreeInfoSystem$AddressCurrentLoadNativeProcProcessVersion_wcscpy
String ID: IsWow64Process$kernel32.dll
API String ID: 2152952469-3024904723
Opcode ID: b4ea03b83d01c2e64632bef0b81f658f78af1d8375097a5454cf352bb8aadb72
Instruction ID: 55887c8e518e006de204ccda2b1b86d7e9ce9c3f371ea8eba2cdefb3dc4dd345
Opcode Fuzzy Hash: b4ea03b83d01c2e64632bef0b81f658f78af1d8375097a5454cf352bb8aadb72
Instruction Fuzzy Hash: C5A12130448688C9DF119F68C58C7D63F959B21308F5C44FADC499F29BD3BA8589CBB6

Function 0040BCAA Relevance: 18.1, APIs: 12, Instructions: 132processCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D9E9: LoadLibraryA.KERNEL32(kernel32.dll,0040BCD1,75920F00,0048BA08), ref: 0040D9F4
Part of subcall function 0040D9E9: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0040DA06

FreeLibrary.KERNEL32(00418DD9,75920F00,0048BA08), ref: 0040BE45

Part of subcall function 0040DA18: LoadLibraryA.KERNEL32(kernel32.dll,0040BCE1,75920F00,0048BA08), ref: 0040DA23
Part of subcall function 0040DA18: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0040DA35

FreeLibrary.KERNEL32(00000000,75920F00,0048BA08), ref: 0040BE37

Part of subcall function 0040DA47: LoadLibraryA.KERNEL32(kernel32.dll,0040BCF1,75920F00,0048BA08), ref: 0040DA52
Part of subcall function 0040DA47: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0040DA64

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,75920F00,0048BA08), ref: 0040BD1A
Process32FirstW.KERNEL32(?,0000022C), ref: 0040BD3D
Process32NextW.KERNEL32(?,0000022C), ref: 0040BD70
_wcscat.LIBCMT ref: 0040BDAD
__wcsicmp.LIBCMT ref: 0040BDBC
CloseHandle.KERNEL32(?), ref: 0040BDF3
FreeLibrary.KERNEL32(0041902D), ref: 0040BE07
FreeLibrary.KERNEL32(00000000), ref: 0040BE11
FreeLibrary.KERNEL32(00418DD9), ref: 0040BE1B
FreeLibrary.KERNEL32(0041902D,75920F00,0048BA08), ref: 0040BE29

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$Free$AddressLoadProc$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicmp_wcscat
String ID:
API String ID: 106133192-0
Opcode ID: 309f1983b0d1d7e16c2b1b6799748829eb26840d23cc78156816468137cc015a
Instruction ID: fa0bb9f8add545e666743b8d05504188b17dc158f43c9a4505aa3be8f7021ede
Opcode Fuzzy Hash: 309f1983b0d1d7e16c2b1b6799748829eb26840d23cc78156816468137cc015a
Instruction Fuzzy Hash: 1A510672C00219ABCF11AFA5CC449EEB7B8FF48304F5084BAE514B2291D7395E45DFA9

Function 0040C49D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 0040C4AC
FindFirstFileW.KERNEL32(?,00000000), ref: 0040C4BE
FindClose.KERNEL32(00000000), ref: 0040C4CE

Strings

*p@, xrefs: 0040C49D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID: *p@
API String ID: 48322524-2474123842
Opcode ID: 0941a96f2b4e133539b3baa8ee8f6d7ade120b6096835f9915711223bd9d8400
Instruction ID: 943425797427cd944ec2477e11eb90c7ac2384fd5af1d53218e0603e71938972
Opcode Fuzzy Hash: 0941a96f2b4e133539b3baa8ee8f6d7ade120b6096835f9915711223bd9d8400
Instruction Fuzzy Hash: 8BE04F31808404ABCB106F74EC884B97B69AB06335F104B32FEB5D12F0E7759950958A

Function 00418B7F Relevance: 3.0, APIs: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000003), ref: 00418BA3
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000003), ref: 00418BB5

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 3e86870cb8cf007079cae3968f33e62dd157cf953cbb657e99254de906b7a85f
Instruction ID: 467baf8bf01b25525d585cab7db777dbe93ca1f360f42ccb9431c17a33480558
Opcode Fuzzy Hash: 3e86870cb8cf007079cae3968f33e62dd157cf953cbb657e99254de906b7a85f
Instruction Fuzzy Hash: E9E02B3110822DBBDB105B958C09FDB775CEF053A5F00403AF918A22C1D674A941CBB5

Function 00429FD7 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_strcat
String ID:
API String ID: 1783402425-0
Opcode ID: e18b76ced0fac1fa3dd8379dba5be37faead6896194f24653fd9befda51f0ffd
Instruction ID: f4bed3256a820badb101227a0947acf1ba754944e69c511bfec78f6e62ce8c00
Opcode Fuzzy Hash: e18b76ced0fac1fa3dd8379dba5be37faead6896194f24653fd9befda51f0ffd
Instruction Fuzzy Hash: B4224970608311DFC714EF65D88596AB7E0BF84314F50882EF89597262CB38E999CF5B

Function 00430850 Relevance: 68.7, APIs: 38, Strings: 1, Instructions: 486
filepipeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0043087B
CreatePipe.KERNEL32(00000004,00000008,?,00000000), ref: 0043091B
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 00430933
GetCurrentProcess.KERNEL32(?,00000000), ref: 0043093E
DuplicateHandle.KERNEL32(00000000), ref: 00430941
CloseHandle.KERNEL32(?), ref: 0043095B
GetStdHandle.KERNEL32(000000F5), ref: 00430977
CreateFileW.KERNEL32(nul,40000000,00000002,?,00000003,00000080,00000000), ref: 0043099C
CreatePipe.KERNEL32(?,?,?,00000000), ref: 004309CC
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 004309E4
GetCurrentProcess.KERNEL32(?,00000000), ref: 004309EF
DuplicateHandle.KERNEL32(00000000), ref: 004309F2
CloseHandle.KERNEL32(?), ref: 00430A0C
GetStdHandle.KERNEL32(000000F4), ref: 00430A28
CreateFileW.KERNEL32(nul,40000000,00000002,?,00000003,00000080,00000000), ref: 00430A4D
CreatePipe.KERNEL32(?,?,?,00000000), ref: 00430A7D
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00430A95
GetCurrentProcess.KERNEL32(?,00000000), ref: 00430A9D
DuplicateHandle.KERNEL32(00000000), ref: 00430AA0
CloseHandle.KERNEL32(?), ref: 00430AB7
GetStdHandle.KERNEL32(000000F6), ref: 00430AD0
CreateFileW.KERNEL32(nul,80000000,00000001,?,00000003,00000080,00000000), ref: 00430AF5
_wcscpy.LIBCMT ref: 00430B1F
_wcscpy.LIBCMT ref: 00430B46
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00430B6B
_memset.LIBCMT ref: 00430BB0

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

FreeLibrary.KERNEL32(?,00000087,00000000,?,000000FF), ref: 00430C83
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,00000000,00000000,?,?,?), ref: 00430CB1
GetLastError.KERNEL32(00000000), ref: 00430CF5
CloseHandle.KERNEL32(?), ref: 00430D19
CloseHandle.KERNEL32(00000004), ref: 00430D33
CloseHandle.KERNEL32(?), ref: 00430D45
CloseHandle.KERNEL32(?), ref: 00430D57
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00430D71
GetCurrentProcess.KERNEL32(?,00000000), ref: 00430D77
DuplicateHandle.KERNEL32(00000000), ref: 00430D7A
CloseHandle.KERNEL32(?), ref: 00430DEC
FreeLibrary.KERNEL32(?), ref: 00430DFA

Strings

nul, xrefs: 00430997, 00430A48, 00430AF0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Handle$CurrentProcess$Close$Create$Duplicate$FilePipe$FreeLibrary_memset_wcscpy$DirectoryErrorLast_malloc
String ID: nul
API String ID: 3280770425-2873401336
Opcode ID: 13c03301f670196446dbc29c957dbf2750b6201ee8d2ff05c5243bed1a7e85fe
Instruction ID: 1e5b9749e3666ced2f883344952439004967d82c66297152457089bb690e1251
Opcode Fuzzy Hash: 13c03301f670196446dbc29c957dbf2750b6201ee8d2ff05c5243bed1a7e85fe
Instruction Fuzzy Hash: AE02D1B1504249AFDB10DFA5CC95ADE7BA8FF08308F04426AF91997291D778EC44CF59

Function 00412C71 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 235
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041288D: __time64.LIBCMT ref: 00412897

_fseek.LIBCMT ref: 00412CA6

Part of subcall function 004130CE: __fread_nolock.LIBCMT ref: 004130E7
Part of subcall function 004130CE: __fread_nolock.LIBCMT ref: 00413125
Part of subcall function 004130CE: __fread_nolock.LIBCMT ref: 00413142
Part of subcall function 004130CE: _wcscpy.LIBCMT ref: 00413175
Part of subcall function 004130CE: __fread_nolock.LIBCMT ref: 00413184
Part of subcall function 004130CE: __fread_nolock.LIBCMT ref: 004131A1
Part of subcall function 004130CE: _wcscpy.LIBCMT ref: 004131D0
Part of subcall function 004130CE: _fseek.LIBCMT ref: 004131F2

__fread_nolock.LIBCMT ref: 00412CD5
__fread_nolock.LIBCMT ref: 00412CE6
__fread_nolock.LIBCMT ref: 00412D03
__fread_nolock.LIBCMT ref: 00412D12
__fread_nolock.LIBCMT ref: 00412D31
__fread_nolock.LIBCMT ref: 00412D40
__fread_nolock.LIBCMT ref: 00412D4F
__fread_nolock.LIBCMT ref: 00412D5E
GetTempPathW.KERNEL32(00000104,?), ref: 00412D73
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00412D90
__fread_nolock.LIBCMT ref: 00412E0A
DeleteFileW.KERNEL32(?), ref: 00412E86
_wcscpy.LIBCMT ref: 00412EC4
_wcscpy.LIBCMT ref: 00412ED4
CopyFileW.KERNEL32(?,?,00000000), ref: 00412EFC
DeleteFileW.KERNEL32(?), ref: 00412F15
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,00000080,00000000), ref: 00412F2E
SetFileTime.KERNEL32(00000000,?,00000000,?), ref: 00412F47
CloseHandle.KERNEL32(00000000), ref: 00412F4E

Strings

aut, xrefs: 00412D83

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __fread_nolock$File$_wcscpy$DeleteTemp_fseek$CloseCopyCreateHandleNamePathTime__time64
String ID: aut
API String ID: 4271773709-3010740371
Opcode ID: f1460ff563875310647a6a6e8609410c8352aebd63edaa18295b8f75108ff7ea
Instruction ID: 5965db3f211466000438e1ca9a14de579336b4291dc07ba067f484b4a889039f
Opcode Fuzzy Hash: f1460ff563875310647a6a6e8609410c8352aebd63edaa18295b8f75108ff7ea
Instruction Fuzzy Hash: 5C81B072508344ABDB219B61CD45FDF7BACEF85304F00081BF688E6191D7B89598CB6A

Function 00434645 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 363
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegConnectRegistryW.ADVAPI32(?,00000000,00000000), ref: 004346F8
RegCreateKeyExW.KERNEL32(00000000,?,00000000,0046BF68,00000000,?,00000000,?,?), ref: 00434739
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00434764
RegCloseKey.KERNEL32(?), ref: 0043477E
RegCloseKey.ADVAPI32(00000000), ref: 0043478C

Strings

REG_DWORD, xrefs: 0043490B
REG_SZ, xrefs: 00434818
REG_MULTI_SZ, xrefs: 00434870
REG_BINARY, xrefs: 0043494A
REG_EXPAND_SZ, xrefs: 00434793

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Close$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_SZ
API String ID: 3641090821-2346799943
Opcode ID: 6748d82ebc539e92e4411bbdc198434ab96816bb1679d5c102ac9d8c26c2f993
Instruction ID: 63ad986f57a684181669bbd1c66e7d09d92ed7f764fe6cec599199ab264e71ae
Opcode Fuzzy Hash: 6748d82ebc539e92e4411bbdc198434ab96816bb1679d5c102ac9d8c26c2f993
Instruction Fuzzy Hash: 43B1A332A442046AEF25BBB29C46EEF6369AF44319F10053FF901F71D2DB7CA9448A59

Function 0046233D Relevance: 30.6, APIs: 20, Instructions: 602fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 00462389
__invoke_watson.LIBCMT ref: 004623A4
CreateFileW.KERNEL32(00000080,?,00000080,0000000C,00000001,00000080,00000000,?,00000000,00000109), ref: 0046258D
CreateFileW.KERNEL32(00000080,7FFFFFFF,00000001,0000000C,00000001,00000080,00000000), ref: 004625C6
GetLastError.KERNEL32 ref: 004625EB
__dosmaperr.LIBCMT ref: 004625F2
GetFileType.KERNEL32(00000109), ref: 00462607
GetLastError.KERNEL32 ref: 0046262C
__dosmaperr.LIBCMT ref: 00462635
CloseHandle.KERNEL32(00000109), ref: 0046263E
__chsize_nolock.LIBCMT ref: 00462723
CloseHandle.KERNEL32(00000109), ref: 004628A2
CreateFileW.KERNEL32(00000080,?,00000001,0000000C,00000003,00000080,00000000), ref: 004628BF
GetLastError.KERNEL32 ref: 004628CE
__dosmaperr.LIBCMT ref: 004628D5
__lseeki64_nolock.LIBCMT ref: 00462908
__lseeki64_nolock.LIBCMT ref: 0046291D
__lseeki64_nolock.LIBCMT ref: 0046298C
__lseeki64_nolock.LIBCMT ref: 0046299D
__locking.LIBCMT ref: 00462A4C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: File__lseeki64_nolock$CreateErrorLast__dosmaperr$CloseHandle__invoke_watson$Type__chsize_nolock__locking
String ID:
API String ID: 2633173609-0
Opcode ID: 73ccf638fcbd47b8637f0f19fd7112795cc4c81a6db7838cf43504a437daa166
Instruction ID: 19b5d40a3e20635bc283d5433884d9a13fa9064d3bd213727c871e867cc8e1e0
Opcode Fuzzy Hash: 73ccf638fcbd47b8637f0f19fd7112795cc4c81a6db7838cf43504a437daa166
Instruction Fuzzy Hash: C2223671900A09BBDF219F68CE45BBF7BA0AB00318F24456BE85197391E7BD8D44CB1B

Function 00403C2F Relevance: 26.6, APIs: 7, Strings: 8, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(0046BF68,0048B334,0048C0C0,0048C170,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe,?,?,?,?,?,0040126A), ref: 00403CE4

Part of subcall function 00403A71: CharUpperBuffW.USER32(0046BF68,0048B334,0046BF68,?,?,00000000,0046BF68,0048B334,0048C0C0,0048C170,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe), ref: 00403B54

GetForegroundWindow.USER32(?,00000104,ACTIVE,?,00000104,LAST,0046BF68,0048B334,0048C0C0,0048C170,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe), ref: 00403D9D
IsWindow.USER32(0048B334), ref: 00403DEC
CharUpperBuffW.USER32(?,?,?,00000104,TITLE,?,00000104,ALL,?,00000104,INSTANCE,?,00000104,CLASS,?,00000104), ref: 00403F76
CharUpperBuffW.USER32(?,?,?,00000104,TITLE,?,00000104,ALL,?,00000104,INSTANCE,?,00000104,CLASS,?,00000104), ref: 00403F8B
GetDesktopWindow.USER32 ref: 00403F98
EnumWindows.USER32(00403FEB,?), ref: 00403FA7

Strings

LAST, xrefs: 00403D18
CLASS, xrefs: 00403E5B
TITLE, xrefs: 00403F10
HANDLE, xrefs: 00403DB1
ACTIVE, xrefs: 00403D70
ALL, xrefs: 00403EDC
REGEXPTITLE, xrefs: 00403E09
INSTANCE, xrefs: 00403E9C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$BuffCharUpper$Foreground$DesktopEnumWindows
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPTITLE$TITLE
API String ID: 2444216868-1002644998
Opcode ID: b770b4687b25d056ccb3addbc4b506e2bd315c5016a6c12a7c11e9a22061d8cb
Instruction ID: 35681d50ae41a6dd6df3f4c88348625863dd71f3e960296de463811a950ee33f
Opcode Fuzzy Hash: b770b4687b25d056ccb3addbc4b506e2bd315c5016a6c12a7c11e9a22061d8cb
Instruction Fuzzy Hash: 53C1A17190554AAECB01EF66C8419D9BFB8BF04309B04427BF914B3692C738FA55CBDA

Function 0041D6D5 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 0041D76C
_wcschr.LIBCMT ref: 0041D77A
_wcscpy.LIBCMT ref: 0041D793
_wcscat.LIBCMT ref: 0041D7A4
_wcscat.LIBCMT ref: 0041D7C4
_wcscpy.LIBCMT ref: 0041D7E4
GetFileAttributesW.KERNEL32(?,>>>AUTOIT SCRIPT<<<), ref: 0041D7F2

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

_wcscpy.LIBCMT ref: 0041D8C9
_wcscpy.LIBCMT ref: 0041D8DA
_wcscpy.LIBCMT ref: 0041D8F0
_wcscat.LIBCMT ref: 0041D903
_wcscat.LIBCMT ref: 0041D916
_wcscat.LIBCMT ref: 0041D929

Part of subcall function 00412C71: _fseek.LIBCMT ref: 00412CA6

Strings

\, xrefs: 0041D80D
>>>AUTOIT SCRIPT<<<, xrefs: 0041D70A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscpy$_wcscat$AttributesFileMessage_fseek_wcschr
String ID: >>>AUTOIT SCRIPT<<<$\
API String ID: 1061597502-1896584978
Opcode ID: 6a767beeb6302ae742f4deb9d810584f862763ff2a9e622a16c04784fa7f4541
Instruction ID: 61eb2778df3db36280617f29fa069db34b17f38730bec27e1dea06aac2843fa4
Opcode Fuzzy Hash: 6a767beeb6302ae742f4deb9d810584f862763ff2a9e622a16c04784fa7f4541
Instruction Fuzzy Hash: 3C7168B2D1011966DF20F7B18D86AEF73ADAF44318F1405BBF505F7181EA3C9A888B59

Function 004060C8 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 165
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00406166
_wcsncat.LIBCMT ref: 00406195
__makepath.LIBCMT ref: 004061B1

Part of subcall function 0045156F: __wmakepath_s.LIBCMT ref: 00451583

Part of subcall function 0044E9ED: std::exception::exception.LIBCMT ref: 0044EA3C
Part of subcall function 0044E9ED: __CxxThrowException@8.LIBCMT ref: 0044EA51

_wcscpy.LIBCMT ref: 004061EC
RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00406208
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?), ref: 00406232
_wcscat.LIBCMT ref: 0040628C
_wcscat.LIBCMT ref: 004062CD
_wcsncpy.LIBCMT ref: 00406306
RegCloseKey.ADVAPI32(?), ref: 00406329

Strings

Software\AutoIt v3\AutoIt, xrefs: 004061FE
<v@, xrefs: 00406109, 00406125
\, xrefs: 004062B5
Include, xrefs: 0040618F, 00406223

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscat$CloseException@8FileModuleNameOpenQueryThrowValue__makepath__wmakepath_s_malloc_wcscpy_wcsncat_wcsncpystd::exception::exception
String ID: <v@$Include$Software\AutoIt v3\AutoIt$\
API String ID: 3663597669-4126755141
Opcode ID: 5bf4ab24d776dbe09a2511fb973cb2f09b7e361b1c47bcd7bff25fbae2677942
Instruction ID: 7a0ec9e26652ebfc38452f8fd7d191dc43944444fa956801943b60db48f99f1d
Opcode Fuzzy Hash: 5bf4ab24d776dbe09a2511fb973cb2f09b7e361b1c47bcd7bff25fbae2677942
Instruction Fuzzy Hash: 846149B1D41208ABDB10EF99EC8599E77F8FB48304B5044BFE919E3291E7349A44CF58

Function 0041DBD4 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

_wcsncpy.LIBCMT ref: 0041DCFC
_wcscat.LIBCMT ref: 0041DD4F
_wcscat.LIBCMT ref: 0041DD62
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0041DD72
SetCurrentDirectoryW.KERNEL32(?), ref: 0041DD85
GetFileAttributesW.KERNEL32(?), ref: 0041DDA9
GetFileAttributesW.KERNEL32(?), ref: 0041DDBB
SetFileAttributesW.KERNEL32(?,00000000), ref: 0041DDCF
SetCurrentDirectoryW.KERNEL32(?), ref: 0041DDE0
SetCurrentDirectoryW.KERNEL32(?), ref: 0041DDF0
_wcscpy.LIBCMT ref: 0041DDFE
SetCurrentDirectoryW.KERNEL32(?,?,00000000,00000003,00000000), ref: 0041DE31

Strings

*.*, xrefs: 0041DDF8

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile$_wcscat$Message_wcscpy_wcsncpy
String ID: *.*
API String ID: 3717301856-438819550
Opcode ID: 603d72be2bec5c54eee4aa541953f462cd9650e9e6c6c029130f51442477e6a5
Instruction ID: 5825f315c92a54745c8b95b965c5411bd5e151bf0bcb3a171f06d9f56f1f0150
Opcode Fuzzy Hash: 603d72be2bec5c54eee4aa541953f462cd9650e9e6c6c029130f51442477e6a5
Instruction Fuzzy Hash: E361DBF5D0011896DF20AB65CC45BEE7368EF04314F54897BE945E3280E67C9AC6CB9D

Function 0045A99A Relevance: 21.5, APIs: 14, Instructions: 515COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d29e8ed4e1106b380a19fad00dbb929a1bab4918ae0f6babdf43499c9426a3d
Instruction ID: 8bfe1705bfab2b7fecbb4446f26cada722f6ccf31b68c76c898d4e0b8ba4390d
Opcode Fuzzy Hash: 2d29e8ed4e1106b380a19fad00dbb929a1bab4918ae0f6babdf43499c9426a3d
Instruction Fuzzy Hash: D312D7705042869FCB229F68C8807BA7BF1AF0630AF14475BED6297393D3785869C75B

Function 004130CE Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 004130E7
__fread_nolock.LIBCMT ref: 00413125
__fread_nolock.LIBCMT ref: 00413142
_wcscpy.LIBCMT ref: 00413175
__fread_nolock.LIBCMT ref: 00413184
__fread_nolock.LIBCMT ref: 004131A1
_wcscpy.LIBCMT ref: 004131D0
_fseek.LIBCMT ref: 004131F2
__fread_nolock.LIBCMT ref: 00413203
_fseek.LIBCMT ref: 00413219

Part of subcall function 00451D73: __fseek_nolock.LIBCMT ref: 00451DCE

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 004130D7, 00413138, 00413151, 00413197, 004131B0
FILE, xrefs: 00413102

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __fread_nolock$_fseek_wcscpy$__fseek_nolock
String ID: C:\Users\user\Desktop\regsvr.exe$FILE
API String ID: 1218644068-3293826460
Opcode ID: 6e6a3b2bfe82ee4463ba5e8e73eabdcc83c3f41dc4378e2c6ae9e3450a07caa2
Instruction ID: 16955c187f1d51c9af23cef21f966cda246683522ea37d69e2bde0f0683897d4
Opcode Fuzzy Hash: 6e6a3b2bfe82ee4463ba5e8e73eabdcc83c3f41dc4378e2c6ae9e3450a07caa2
Instruction Fuzzy Hash: 9A4186B2D40208BAEF21EBE1DC45FDE777DAF44304F1004ABBA44B2091E6B997988775

Function 004535F2 Relevance: 19.8, APIs: 13, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00453633

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 8709f0b67ccc48c4e29bd1c705b9165b5ffce8b257a50cfd2839d6adaa9aa818
Instruction ID: 93cfa079bb3fa6d06c64970c7f5ad7d0c4230e4e74fcc52d062f6826687924d9
Opcode Fuzzy Hash: 8709f0b67ccc48c4e29bd1c705b9165b5ffce8b257a50cfd2839d6adaa9aa818
Instruction Fuzzy Hash: DA81F971A00600ABDB28AF6ACC8196FB7E5EF54756B14452FFC11D2383E778DB088B59

Function 00412F5E Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fseek.LIBCMT ref: 00412F84

Part of subcall function 004130CE: __fread_nolock.LIBCMT ref: 004130E7
Part of subcall function 004130CE: __fread_nolock.LIBCMT ref: 00413125
Part of subcall function 004130CE: __fread_nolock.LIBCMT ref: 00413142
Part of subcall function 004130CE: _wcscpy.LIBCMT ref: 00413175
Part of subcall function 004130CE: __fread_nolock.LIBCMT ref: 00413184
Part of subcall function 004130CE: __fread_nolock.LIBCMT ref: 004131A1
Part of subcall function 004130CE: _wcscpy.LIBCMT ref: 004131D0
Part of subcall function 004130CE: _fseek.LIBCMT ref: 004131F2

__fread_nolock.LIBCMT ref: 00412FB1
__fread_nolock.LIBCMT ref: 00412FBF
__fread_nolock.LIBCMT ref: 00412FD8
__fread_nolock.LIBCMT ref: 00412FF1
_fseek.LIBCMT ref: 00413008
_malloc.LIBCMT ref: 00413015
_malloc.LIBCMT ref: 0041301F
__fread_nolock.LIBCMT ref: 0041302E

Part of subcall function 00450D38: __lock.LIBCMT ref: 00450D56
Part of subcall function 00450D38: ___sbh_find_block.LIBCMT ref: 00450D61
Part of subcall function 00450D38: ___sbh_free_block.LIBCMT ref: 00450D70
Part of subcall function 00450D38: RtlFreeHeap.NTDLL(00000000,?,00472580,0000000C,00455513,00000000,00472858,0000000C,0045554B,?,?,?,00461185,00000004,00472B40,0000000C), ref: 00450DA0
Part of subcall function 00450D38: GetLastError.KERNEL32(?,00461185,00000004,00472B40,0000000C,00456F8A,?,?,00000000,00000000,00000000,00454BA3,00000001,00000214,?,00000000), ref: 00450DB1

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 00412F67
>>>AUTOIT SCRIPT<<<, xrefs: 00412F93

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __fread_nolock$_fseek$_malloc_wcscpy$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock
String ID: >>>AUTOIT SCRIPT<<<$C:\Users\user\Desktop\regsvr.exe
API String ID: 265842893-2111243058
Opcode ID: 381cc85e538e54c3940dcb950b10ceb135395bd434d351cf3b31d4928a848fb4
Instruction ID: f4d1da0c8a6fbb18ceafc9879cae3c5c5b185f25af741d58c88928373c1b6d83
Opcode Fuzzy Hash: 381cc85e538e54c3940dcb950b10ceb135395bd434d351cf3b31d4928a848fb4
Instruction Fuzzy Hash: 80419175900208BEDB20AF61CC42FDE7BB8EF45704F10445BFA44A7152DBB99A98CB59

Function 0041C4A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

CharLowerBuffW.USER32(?,?,0046BF68), ref: 0041C4E8
GetDriveTypeW.KERNEL32(?,0046FB24,00000061,unknown,ramdisk,network,fixed,removable,cdrom,all), ref: 0041C63F
_wcscpy.LIBCMT ref: 0041C664

Strings

unknown, xrefs: 0041C5F1
fixed, xrefs: 0041C572
removable, xrefs: 0041C548
network, xrefs: 0041C59C
ramdisk, xrefs: 0041C5C6
all, xrefs: 0041C4EE
cdrom, xrefs: 0041C51B

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: BuffCharDriveLowerMessageType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2654775160-1000479233
Opcode ID: a4bced8b5c57268d5562a5ef9a567ae6da3d03c0d2a86c41fb238adf3d09212d
Instruction ID: 9c1c073b62aa0e8ef385af659908c37397dc5094794e4e079a72e2e76f57fb54
Opcode Fuzzy Hash: a4bced8b5c57268d5562a5ef9a567ae6da3d03c0d2a86c41fb238adf3d09212d
Instruction Fuzzy Hash: AC51A731E81215ABCF10A7A2DC926EEB771EF41714F20882BF911771D2EB7C6E56864C

Function 00422D64 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 165libraryloadernetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00427955: LoadLibraryA.KERNEL32(Wininet.dll,004222DD), ref: 00427960
Part of subcall function 00427955: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 00427972

FreeLibrary.KERNEL32(00000000), ref: 00422D8B
InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000,?,00000003), ref: 00422DF2
LoadLibraryA.KERNEL32(Wininet.dll), ref: 00422E0D
GetProcAddress.KERNEL32(00000000,InternetQueryOptionW), ref: 00422E20
FreeLibrary.KERNEL32(00000000), ref: 00422F0E
FreeLibrary.KERNEL32(00000000), ref: 00422F19
FreeLibrary.KERNEL32(00000000), ref: 00422F24

Strings

InternetQueryOptionW, xrefs: 00422E1A
Wininet.dll, xrefs: 00422E05
<local>, xrefs: 00422DBF

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$Free$AddressLoadProc$InternetOpen
String ID: <local>$InternetQueryOptionW$Wininet.dll
API String ID: 198108459-2230220794
Opcode ID: f58762aabc6be5a61c682d0b842e8373f80b47ca1580f1615fceb4ac60360d00
Instruction ID: df756f53dcf6a58436e68c9fb11ef3eb94b0e1e7365751bbd243ec574ff85a16
Opcode Fuzzy Hash: f58762aabc6be5a61c682d0b842e8373f80b47ca1580f1615fceb4ac60360d00
Instruction Fuzzy Hash: BF518D31B10225BFEF259B64ED49BEEB7B8FF04314F504126E410A6290CBB8AD45DA69

Function 004012BA Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 004012C5
LoadCursorW.USER32(00000000,00007F00), ref: 004012D5
LoadIconW.USER32(000000A1), ref: 004012EF
LoadIconW.USER32(000000A4), ref: 00401301
RegisterClassExW.USER32(?), ref: 00401371

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 004012C0, 004012C1
AutoIt v3, xrefs: 00401360
#, xrefs: 0040134D
0, xrefs: 00401346

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Load$Icon$BrushClassColorCursorRegister
String ID: #$0$AutoIt v3$C:\Users\user\Desktop\regsvr.exe
API String ID: 1664269819-1688876140
Opcode ID: 79ae604c2ece932835a0c4772eb2b5c11f83d1a8ec0ef193ecd32122831a9563
Instruction ID: a4ae1f2f7a30b14d8864461e08ebee6a3adfffe902ce092d78f3296afce67af2
Opcode Fuzzy Hash: 79ae604c2ece932835a0c4772eb2b5c11f83d1a8ec0ef193ecd32122831a9563
Instruction Fuzzy Hash: 9F2136B1D04308AFDB009FA9EC88A9DBFB4FB88394F54053EE515A36A0D7B40944CF99

Function 004342B8 Relevance: 15.3, APIs: 10, Instructions: 298registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 00433F9A: CharUpperBuffW.USER32(?,?,?,?,00000000), ref: 00433FAD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00434373
RegOpenKeyExW.KERNEL32(?,?,00000000,?,?,HKCR\), ref: 004343A2
RegCloseKey.ADVAPI32(?), ref: 004343B6
RegQueryValueExW.KERNEL32(?,00000000,00000000,?,00000000,00000000), ref: 004343E7
RegQueryValueExW.ADVAPI32(?,00000000), ref: 0043446B
RegCloseKey.ADVAPI32(?,00000000), ref: 0043460E
RegCloseKey.ADVAPI32(?), ref: 0043461A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Close$QueryValue$BuffCharConnectMessageOpenRegistryUpper
String ID:
API String ID: 4045058077-0
Opcode ID: 0578d846f5ff0b8a0a159295377fba254f4d7ce4d379a8d6993672bde0a99d9c
Instruction ID: f6a981f66e00b1d264ff148d2bdbeb4e7af21c5c7377ee539f2df3d1dd7ffcb6
Opcode Fuzzy Hash: 0578d846f5ff0b8a0a159295377fba254f4d7ce4d379a8d6993672bde0a99d9c
Instruction Fuzzy Hash: C7A19D72508205AFC710EF65C8819AFB3ECEF88318F00492EF995D7191DB38ED458B6A

Function 004016E5 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 146windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00401751

Part of subcall function 00422413: FreeLibrary.KERNEL32(00000000), ref: 0042245F

Strings

TaskbarCreated, xrefs: 004017A2

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: FocusFreeLibrary
String ID: TaskbarCreated
API String ID: 851375671-2362178303
Opcode ID: 67fe46154a8852e93ed32e521688f5f91017ce0591af7f624175e23647ffdf25
Instruction ID: 766dd6d360e5467922692d02d84ae20bf874affe0ca56d6e1b295126ee2023ca
Opcode Fuzzy Hash: 67fe46154a8852e93ed32e521688f5f91017ce0591af7f624175e23647ffdf25
Instruction Fuzzy Hash: 4B51C032654185EBEB11BF68EC8996A3BA1A701304F04843BF406B72F1D7B98C55976E

Function 004018E6 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 104windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 004018F4

Part of subcall function 00401A43: LoadLibraryA.KERNEL32(uxtheme.dll,00401967,?), ref: 00401A4E
Part of subcall function 00401A43: GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401A60

SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 004019D8
SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 004019E8
SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00401A0E
FreeLibrary.KERNEL32(?), ref: 00401A20

Strings

AutoIt, xrefs: 004018E8
Error allocating memory., xrefs: 004018ED

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: InfoParametersSystem$Library$AddressFreeLoadMessageProc
String ID: AutoIt$Error allocating memory.
API String ID: 3708148760-4017498283
Opcode ID: ea2fbedb0a2f2e78be5d3471e1697a934fcb5d0375a402043767215513df5e19
Instruction ID: a1573135fad00692fa7f18f263709ebf7850b98c3ea4e622f761f513c07eac78
Opcode Fuzzy Hash: ea2fbedb0a2f2e78be5d3471e1697a934fcb5d0375a402043767215513df5e19
Instruction Fuzzy Hash: E9318072508350ABD7119F56DC85A9ABBE8BB95304F00093FF998A32A1C7B49984CF5A

Function 00412B2B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 00412B5F
__fread_nolock.LIBCMT ref: 00412B88
_fseek.LIBCMT ref: 00412BD7
_fseek.LIBCMT ref: 00412BEA
__fread_nolock.LIBCMT ref: 00412BFC

Strings

EA06, xrefs: 00412C04
AU3!, xrefs: 00412B59

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __fread_nolock_fseek$_strcat
String ID: AU3!$EA06
API String ID: 4101178306-2658333250
Opcode ID: e012c83945f9d281c39d7056c8335287a7a112ae67a96d600054abbfed0335ba
Instruction ID: 5757126cfbf0ebb3bd41f3560bc587e5df1a16494f2c8b6fb9d4fd78a3a92d38
Opcode Fuzzy Hash: e012c83945f9d281c39d7056c8335287a7a112ae67a96d600054abbfed0335ba
Instruction Fuzzy Hash: FE217D31A002087ADB119F688D46FDE3BA9AF45305F2404AFF941E3193E6B8E2988765

Function 0040C50F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0040C525
SHGetMalloc.SHELL32(00000104), ref: 0040C530
_wcscpy.LIBCMT ref: 0040C540
SHGetDesktopFolder.SHELL32(?), ref: 0040C54F
SHGetPathFromIDListW.SHELL32(?,?), ref: 0040C585
_wcscpy.LIBCMT ref: 0040C59B

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 0040C518

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscpy$DesktopFolderFromListMallocPath
String ID: C:\Users\user\Desktop\regsvr.exe
API String ID: 192938534-2994071119
Opcode ID: b04782f8b56c921b0f9fe3e0b5d24f71d1b40231c6593093b340969f23c4b676
Instruction ID: a5985507b53a5442811d6ddeb295535670b2ff61c6a54e4119d2549b79321a26
Opcode Fuzzy Hash: b04782f8b56c921b0f9fe3e0b5d24f71d1b40231c6593093b340969f23c4b676
Instruction Fuzzy Hash: F4215176900118FBDB11DF90DC88EEE7BB8EF44704F1041AAF905AB290DB35EA45DB58

Function 0040138D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000104), ref: 004013BB
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 004013DC
ShowWindow.USER32(00000000), ref: 004013F0
ShowWindow.USER32(00000000), ref: 004013F9

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 0040138D
AutoIt v3, xrefs: 004013B3, 004013B8, 004013B9
edit, xrefs: 004013D6

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$C:\Users\user\Desktop\regsvr.exe$edit
API String ID: 1584632944-2164139470
Opcode ID: b82919e5d7ef4d5fe5c3997ddc82d13d67b8087a6736bae879a08434eb98ac3a
Instruction ID: 8243fe0b56721b3ac0f0932c458c7c048deda5dae2dc7eb2f2db3a016a53c8e1
Opcode Fuzzy Hash: b82919e5d7ef4d5fe5c3997ddc82d13d67b8087a6736bae879a08434eb98ac3a
Instruction Fuzzy Hash: 76F0DA722422317AD6312B17AC4CFE72E6EEF867B0F120031FA1CA6260D2655C91C9F9

Function 00418D3C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 117COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 00418D45, 00418D46
ONAUTOITSTART, xrefs: 00418D94

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscat$LoadString$__swprintf_wcscpy
String ID: C:\Users\user\Desktop\regsvr.exe$ONAUTOITSTART
API String ID: 1746614660-2616765744
Opcode ID: 3995a2e13c5f4f376e2bdd8cbf6967d5df4c2717eaa53daed1c23ac33e28242e
Instruction ID: 53a84e5e32ac5007bae37493b6228830e89fc281fe87a5850283bc7e57e54f10
Opcode Fuzzy Hash: 3995a2e13c5f4f376e2bdd8cbf6967d5df4c2717eaa53daed1c23ac33e28242e
Instruction Fuzzy Hash: C3412B71608305ABC711EB748C84AEBBB9CAB15304F14062FF559C3251DF7898C69B9E

Function 00406BFC Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00406C24

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 00406C76, 00406C7F, 00406C80, 00406CA2, 00406CAB, 00406CB5
L, xrefs: 00406C34
au3, xrefs: 00406C61
AutoIt script files (*.au3, *.a3x), xrefs: 00406C4C
Run Script:, xrefs: 00406C3B

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset
String ID: AutoIt script files (*.au3, *.a3x)$C:\Users\user\Desktop\regsvr.exe$L$Run Script:$au3
API String ID: 2102423945-1925255675
Opcode ID: 8e1bfe0483ebeed70b9e4ea0b95cc7e4357020f8f96617a667ecadb6194bfa51
Instruction ID: d02f1d07d1508ac43af70b6cdc879bdb56ceb7d31fb44b40a89a76a1db2e01c8
Opcode Fuzzy Hash: 8e1bfe0483ebeed70b9e4ea0b95cc7e4357020f8f96617a667ecadb6194bfa51
Instruction Fuzzy Hash: C41160B1800518ABDB11EFD5DC45BEF7BBCAF05304F00405AE544A6282E7BC56498BAA

Function 0040D99A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe,004011AB,C:\Users\user\Desktop\regsvr.exe), ref: 0040D9AE
LockServiceDatabase.ADVAPI32(00000000), ref: 0040D9BB
UnlockServiceDatabase.ADVAPI32(00000000), ref: 0040D9C6
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D9DE

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 0040D99A, 0040D9A9

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Service$Database$CloseHandleLockManagerOpenUnlock
String ID: C:\Users\user\Desktop\regsvr.exe
API String ID: 3647510317-2994071119
Opcode ID: c826f0a8cc633e358eb96a105c6fc6aaafa6778c0bc2a7c870c343861650bff5
Instruction ID: 622ebe098e7d035d8a5bcfc97c789e973ec340aecb5eb206808113be1e38ea2d
Opcode Fuzzy Hash: c826f0a8cc633e358eb96a105c6fc6aaafa6778c0bc2a7c870c343861650bff5
Instruction Fuzzy Hash: D8E06DF3C59160ABC7202BF06CD89DB3A59A70521A7051473F252A2290D7794C499BBE

Function 004222B9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00427955: LoadLibraryA.KERNEL32(Wininet.dll,004222DD), ref: 00427960
Part of subcall function 00427955: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 00427972

FreeLibrary.KERNEL32(00000000,0000008C,000000FF), ref: 004222F8
__wcsicmp.LIBCMT ref: 00422325
FreeLibrary.KERNEL32(?,00000001), ref: 00422404

Part of subcall function 004187CB: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 0041881F
Part of subcall function 004187CB: LoadStringW.USER32(?,?,00000FFF), ref: 00418832
Part of subcall function 004187CB: __swprintf.LIBCMT ref: 0041886D
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 004188A0
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 004188AD
Part of subcall function 004187CB: _wcscpy.LIBCMT ref: 004188C3
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 004188E0
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 004188F3
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 00418900
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 00418914
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 00418927

Strings

abort, xrefs: 00422311

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscat$LibraryLoad$FreeString$AddressProc__swprintf__wcsicmp_wcscpy
String ID: abort
API String ID: 2874445117-4206212132
Opcode ID: 2f7553a218f7c69e5c98e33009b5c0614029380b6e0a63d6fb0b289303dba03b
Instruction ID: a3386cf9f928701ac749cf6970a2d1e8a5d20b7f8432ad1f140508c4762c62a0
Opcode Fuzzy Hash: 2f7553a218f7c69e5c98e33009b5c0614029380b6e0a63d6fb0b289303dba03b
Instruction Fuzzy Hash: 9E310870B04225BBDB15AF75A9416EEB764FF04308F40053FF815D7281DBFC5A80969A

Function 00412A2C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 0040DF43: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,C:\Users\user\Desktop\regsvr.exe,?,00412A47,0046BF68,?), ref: 0040DF75

_strcat.LIBCMT ref: 00412A53

Part of subcall function 00412047: _memset.LIBCMT ref: 0041204F

_strlen.LIBCMT ref: 00412A72

Part of subcall function 0041210B: _memset.LIBCMT ref: 00412164
Part of subcall function 0041210B: _memset.LIBCMT ref: 0041216F
Part of subcall function 0041210B: _memset.LIBCMT ref: 0041217B
Part of subcall function 0041210B: _sprintf.LIBCMT ref: 00412196

Part of subcall function 00412B2B: _strcat.LIBCMT ref: 00412B5F
Part of subcall function 00412B2B: __fread_nolock.LIBCMT ref: 00412B88
Part of subcall function 00412B2B: _fseek.LIBCMT ref: 00412BD7
Part of subcall function 00412B2B: _fseek.LIBCMT ref: 00412BEA
Part of subcall function 00412B2B: __fread_nolock.LIBCMT ref: 00412BFC

__fread_nolock.LIBCMT ref: 00412AE7
_ftell.LIBCMT ref: 00412B18

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 00412A38

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset$__fread_nolock$_fseek_strcat$ByteCharMultiWide_ftell_sprintf_strlen
String ID: C:\Users\user\Desktop\regsvr.exe
API String ID: 191142894-2994071119
Opcode ID: f3fd2d15e2c2829b1cb4dbe26ff2ab6dba542c3759986cf9e15b2d68dd32ea80
Instruction ID: 6cc8a242c6d0d15e650d7c968ce1b1718db6e337d876b9f68718d1ff6f1594d0
Opcode Fuzzy Hash: f3fd2d15e2c2829b1cb4dbe26ff2ab6dba542c3759986cf9e15b2d68dd32ea80
Instruction Fuzzy Hash: D9217E726083412BC714FF769D42A9EB7C8EF05314F10493FF555D2182EA7CE5A4828E

Function 00422C6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00427A87: LoadLibraryA.KERNEL32(Wininet.dll,00422C85,00000000,?), ref: 00427A92
Part of subcall function 00427A87: GetProcAddress.KERNEL32(00000000,InternetCrackUrlW), ref: 00427AA4

FreeLibrary.KERNEL32(?), ref: 00422C91
InternetCrackUrlW.WININET(?,00000000,00000000,0000003C,00000000,?), ref: 00422D07
_wcscat.LIBCMT ref: 00422D19
FreeLibrary.KERNEL32(?), ref: 00422D56

Strings

<, xrefs: 00422CCD

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$Free$AddressCrackInternetLoadProc_wcscat
String ID: <
API String ID: 3724098518-4251816714
Opcode ID: 8367d08c40cc6b6ce7e3cf0967e2fbe33a5d0c0fd4857d35a30b8cf9c81dd12f
Instruction ID: 7daa6fc9d9cce2f9e8e1424134e8f0e93db928ee65bac882d1dfd5c299807c39
Opcode Fuzzy Hash: 8367d08c40cc6b6ce7e3cf0967e2fbe33a5d0c0fd4857d35a30b8cf9c81dd12f
Instruction Fuzzy Hash: 663104B1D00229AFDF10DF95E9406EEBBB4EB08344F50806BE814A7210D7789A45CF68

Function 00452132 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00452192
_memcpy_s.LIBCMT ref: 00452205
__filbuf.LIBCMT ref: 00452290
_memset.LIBCMT ref: 004522D6
_memset.LIBCMT ref: 00452301

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset$__filbuf_memcpy_s
String ID:
API String ID: 2885843685-0
Opcode ID: 50d71b4f65ed1a6bd65b6caf26a703ed5e466bc03891ec77ca7ec0195b734041
Instruction ID: 8d222a48d55b4acc09949d8f2fd565fbcdcb2311850145653533022fb81319fc
Opcode Fuzzy Hash: 50d71b4f65ed1a6bd65b6caf26a703ed5e466bc03891ec77ca7ec0195b734041
Instruction Fuzzy Hash: 32513B35900605EBCB208F698E4499F77B4FF42322F14825BFC25922D3D7B89E49CB59

Function 00434CF0 Relevance: 7.7, APIs: 5, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 00433F9A: CharUpperBuffW.USER32(?,?,?,?,00000000), ref: 00433FAD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00434D9B
RegOpenKeyExW.KERNEL32(?,?,00000000,?,?), ref: 00434DE3
RegEnumKeyExW.KERNEL32(?,-00000001,?,000000FF,00000000,00000000,00000000,?), ref: 00434E48
RegCloseKey.ADVAPI32(?,?), ref: 00434E92
RegCloseKey.ADVAPI32(?), ref: 00434E9C

Part of subcall function 00418B7F: GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000003), ref: 00418BA3
Part of subcall function 00418B7F: FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000003), ref: 00418BB5

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CloseMessage$BuffCharConnectEnumErrorFormatLastOpenRegistryUpper
String ID:
API String ID: 3426653046-0
Opcode ID: 82002da3ab14b81dc7bf33c03ebbb28d1e7facc996a00cd2861bcb28b8cddcd5
Instruction ID: d0c25eb97ffe9a7d3d65260d8673287951bf97caa5b00c2679f155d554cd518b
Opcode Fuzzy Hash: 82002da3ab14b81dc7bf33c03ebbb28d1e7facc996a00cd2861bcb28b8cddcd5
Instruction Fuzzy Hash: 86514D72D00109ABDF00EFE1DC86DEEB779EF48358F10443BF611A7191DA78AA458B69

Function 0045328D Relevance: 7.6, APIs: 5, Instructions: 73threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 004532CC
CreateThread.KERNEL32(00000000,?,00453219,00000000,00000004,00000000), ref: 004532FF
ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 0045330F
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 0045331A
__dosmaperr.LIBCMT ref: 00453332

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__calloc_crt__dosmaperr
String ID:
API String ID: 1799056965-0
Opcode ID: da98295cac26577001e74339457104a521106f0aa7158b881982cf166fffbf0f
Instruction ID: 2c97fa6bf50048142bd6dde53a4aa4d36f385e81701ee299ce1724804f243ba6
Opcode Fuzzy Hash: da98295cac26577001e74339457104a521106f0aa7158b881982cf166fffbf0f
Instruction Fuzzy Hash: 15112671501700AEC7107F6A9C4589EB7A4EF4037BB20422FFC11962C3DE789E08856D

Function 0040CBF6 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,75923340,?,0040CD52,?), ref: 0040CC13
GetLastError.KERNEL32(?,75923340,?,0040CD52,?), ref: 0040CC1E
CreateDirectoryW.KERNEL32(?,00000000,?,75923340,?,0040CD52,?), ref: 0040CC32

Part of subcall function 0040D6DA: _wcscpy.LIBCMT ref: 0040D700

_wcsrchr.LIBCMT ref: 0040CC4C
CreateDirectoryW.KERNEL32(?,00000000,00000000,?), ref: 0040CC7D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcscpy_wcsrchr
String ID:
API String ID: 2727006461-0
Opcode ID: 956842110015219fc8d30e4d020964cdda5cc4709e9927e9bbdbb273eadc84c9
Instruction ID: 0cbb9c6a20cb65e42aa01b96198927eed14ceaf003c0dad5c6cf13ba2f479420
Opcode Fuzzy Hash: 956842110015219fc8d30e4d020964cdda5cc4709e9927e9bbdbb273eadc84c9
Instruction Fuzzy Hash: C801CC31549215D9F6212771ACC1BBF23589F53368F14023BFD05B62C1DB7C9C46516D

Function 00450D38 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00450D56

Part of subcall function 00455532: __mtinitlocknum.LIBCMT ref: 00455546
Part of subcall function 00455532: __amsg_exit.LIBCMT ref: 00455552
Part of subcall function 00455532: RtlEnterCriticalSection.NTDLL(?), ref: 0045555A

___sbh_find_block.LIBCMT ref: 00450D61
___sbh_free_block.LIBCMT ref: 00450D70
RtlFreeHeap.NTDLL(00000000,?,00472580,0000000C,00455513,00000000,00472858,0000000C,0045554B,?,?,?,00461185,00000004,00472B40,0000000C), ref: 00450DA0
GetLastError.KERNEL32(?,00461185,00000004,00472B40,0000000C,00456F8A,?,?,00000000,00000000,00000000,00454BA3,00000001,00000214,?,00000000), ref: 00450DB1

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1dae5a39ad9f5eaa0adcba3583bf8c6e65f4d52c9cb0ef0d6640d8a7f08b5655
Instruction ID: 66e46a8d836229765d90989f3e65ac2195dca750d16f6e27a5dd01344d14ddce
Opcode Fuzzy Hash: 1dae5a39ad9f5eaa0adcba3583bf8c6e65f4d52c9cb0ef0d6640d8a7f08b5655
Instruction Fuzzy Hash: D8018435945B05EADB207BF19C0576E3B74AF00726F10041FFC04562D3DA7C998C8A5D

Function 0045A6ED Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,00462A6C,?), ref: 0045A738
GetLastError.KERNEL32 ref: 0045A742
__dosmaperr.LIBCMT ref: 0045A771

Strings

l*F, xrefs: 0045A6EE, 0045A6F3, 0045A730, 0045A74E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID: l*F
API String ID: 2583163307-1314440155
Opcode ID: eefab8a056bf7af00086c744b673e9c7d069fb4adba8596174a5886756ddd586
Instruction ID: f09ee62a79e51a0dbfe9eccd481b4493b46564523e94472456f7a56f09ae77e6
Opcode Fuzzy Hash: eefab8a056bf7af00086c744b673e9c7d069fb4adba8596174a5886756ddd586
Instruction Fuzzy Hash: F301F93251571055D6252679AC49B9B1BA48F8933FF25025FFC10C72D3EF5CC889819F

Function 0045320D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00454A33: TlsGetValue.KERNEL32(?,0045321E), ref: 00454A3A
Part of subcall function 00454A33: TlsSetValue.KERNEL32(00000000,0045321E), ref: 00454A5B

Part of subcall function 00454A18: TlsGetValue.KERNEL32(?,00453229,00000000), ref: 00454A22

GetLastError.KERNEL32(00000000,?,00000000), ref: 00453240
RtlExitUserThread.NTDLL(00000000), ref: 00453247
__freefls@4.LIBCMT ref: 00453264

Strings

PYE, xrefs: 00453269, 00453272, 00453281

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Value$ErrorExitLastThreadUser__freefls@4
String ID: PYE
API String ID: 968313176-4264731808
Opcode ID: 6aa40b1287019582424d44191b4f5ce09a5683a33315cff3292b6146c6323a0d
Instruction ID: 5d4058ec041952d9b9954e48f029bc613ef3864679ee79ba0df0b9b71de34fb5
Opcode Fuzzy Hash: 6aa40b1287019582424d44191b4f5ce09a5683a33315cff3292b6146c6323a0d
Instruction Fuzzy Hash: EF016D70604640ABDB04BFA6D90991E77A5AF8430FF20846EFC049A223EA7CCC49DA5D

Function 00453219 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00454A33: TlsGetValue.KERNEL32(?,0045321E), ref: 00454A3A
Part of subcall function 00454A33: TlsSetValue.KERNEL32(00000000,0045321E), ref: 00454A5B

Part of subcall function 00454A18: TlsGetValue.KERNEL32(?,00453229,00000000), ref: 00454A22

GetLastError.KERNEL32(00000000,?,00000000), ref: 00453240
RtlExitUserThread.NTDLL(00000000), ref: 00453247
__freefls@4.LIBCMT ref: 00453264

Strings

PYE, xrefs: 00453269, 00453272, 00453281

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Value$ErrorExitLastThreadUser__freefls@4
String ID: PYE
API String ID: 968313176-4264731808
Opcode ID: bd6881f481de14c1b4c4aa2bd908232be170b8059dcc2b685d8852f75bb59494
Instruction ID: f5f146f6554694dcdbbf0ed92666f6fdd4ea751d27dd79f0b83c45461b657d3f
Opcode Fuzzy Hash: bd6881f481de14c1b4c4aa2bd908232be170b8059dcc2b685d8852f75bb59494
Instruction Fuzzy Hash: BBF04F70604640ABDB44AF76990991E7799AF8430FF10846EFC048A223EA7CCC49DA2D

Function 004531D8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00454BF1: __amsg_exit.LIBCMT ref: 00454BFF

CloseHandle.KERNEL32(?), ref: 004531C2
__freeptd.LIBCMT ref: 004531C9
RtlExitUserThread.NTDLL(00000000), ref: 004531D1

Part of subcall function 00455650: __FindPESection.LIBCMT ref: 004556A9

Strings

PYE, xrefs: 0045318F, 00453198, 004531A7

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CloseExitFindHandleSectionThreadUser__amsg_exit__freeptd
String ID: PYE
API String ID: 2341454418-4264731808
Opcode ID: 1668dc219109d611c5936bca42f4df7c5966ce609d5865978ab2e3b8bc06c2f6
Instruction ID: 9bb45036a2f768db81f9a72b8cf415731e5970cb7e298e0cd498d74fdb4babc0
Opcode Fuzzy Hash: 1668dc219109d611c5936bca42f4df7c5966ce609d5865978ab2e3b8bc06c2f6
Instruction Fuzzy Hash: 5FF09031404900ABE2243FB09D19B6E3B64AF007ABF10055AF804851E3EBAC8E49865E

Function 00427955 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wininet.dll,004222DD), ref: 00427960
GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 00427972

Strings

Wininet.dll, xrefs: 0042795B
InternetOpenW, xrefs: 0042796C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InternetOpenW$Wininet.dll
API String ID: 2574300362-877548236
Opcode ID: b1d8983364baa29d7161cbbf0cb1a01b6ef915cbfd28d9472f4ac8b7d1f71050
Instruction ID: 99dffb40ae353492489230e77bced5571cb5c4eb8d9f9eaf31004b6430a0dcd8
Opcode Fuzzy Hash: b1d8983364baa29d7161cbbf0cb1a01b6ef915cbfd28d9472f4ac8b7d1f71050
Instruction Fuzzy Hash: EAD05EB0605702DFD7208F32D848306B7E4AB10745F20CC7EE89AC2260E6B880C0CA19

Function 00401A43 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme.dll,00401967,?), ref: 00401A4E
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401A60

Strings

uxtheme.dll, xrefs: 00401A49
IsThemeActive, xrefs: 00401A5A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsThemeActive$uxtheme.dll
API String ID: 2574300362-3542929980
Opcode ID: 21f46e69b30c07e6e70ba4d9a524beab2f2c7279e81fd8ddf14fc835e9b20fb3
Instruction ID: 708e43c0397dec2faf81578261b9723fe63f5f84f826bce0dc18142a9322b586
Opcode Fuzzy Hash: 21f46e69b30c07e6e70ba4d9a524beab2f2c7279e81fd8ddf14fc835e9b20fb3
Instruction Fuzzy Hash: 22D017306003028FC720CF71CC0930776E8AB10345B20C83AE896D22B0E77884C4CE5A

Function 00401902 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 00401A43: LoadLibraryA.KERNEL32(uxtheme.dll,00401967,?), ref: 00401A4E
Part of subcall function 00401A43: GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00401A60

SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 004019D8
SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 004019E8
SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00401A0E
FreeLibrary.KERNEL32(?), ref: 00401A20

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: InfoParametersSystem$Library$AddressFreeLoadProc
String ID:
API String ID: 3664353960-0
Opcode ID: 3c5e0a68e0cb97ad3966a7a0b48cf8fc1dbc59275a0498ea28b4a9936cf48647
Instruction ID: 4353411602f3a87985f0dd9b24ad5660156ef5563a3a86d4efd7711f3f6935f0
Opcode Fuzzy Hash: 3c5e0a68e0cb97ad3966a7a0b48cf8fc1dbc59275a0498ea28b4a9936cf48647
Instruction Fuzzy Hash: 8A318172508351ABC711DF5ADC85A9BBBE8BF95314F00093FF898632A1C7749984CF5A

Function 00418C78 Relevance: 6.1, APIs: 4, Instructions: 72windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00418CAB
TranslateMessage.USER32(?), ref: 00418CD2
DispatchMessageW.USER32(?), ref: 00418CDC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00418CEC

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: a88d09abddd65d1de1d546c2f16f606a4bc06f50eec9a3d9c1bb4009f7293071
Instruction ID: 3b1cc05d54707ff613bd0a2dd8511293c23920df9bf20972262f4e1701a0712f
Opcode Fuzzy Hash: a88d09abddd65d1de1d546c2f16f606a4bc06f50eec9a3d9c1bb4009f7293071
Instruction Fuzzy Hash: BB21C3B2909349AEEB52CFB4AC48AF77BACA711308F04453FE442D2151FE6898C5D739

Function 00409C69 Relevance: 6.1, APIs: 4, Instructions: 63timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00409C91

Part of subcall function 0040A282: LoadStringW.USER32(00000065,?,0000007F,0048C258), ref: 0040A2C9
Part of subcall function 0040A282: _memset.LIBCMT ref: 0040A37C
Part of subcall function 0040A282: _wcsncpy.LIBCMT ref: 0040A3A4
Part of subcall function 0040A282: _wcscpy.LIBCMT ref: 0040A3BE
Part of subcall function 0040A282: Shell_NotifyIconW.SHELL32(00000001,?), ref: 0040A441

Shell_NotifyIconW.SHELL32(00000001,00000098), ref: 00409D2F
KillTimer.USER32(?,00000001,0048C258,?,?,00000000), ref: 00409D37
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00409D46

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$KillLoadString_wcscpy_wcsncpy
String ID:
API String ID: 354902784-0
Opcode ID: c35bfba876e77a39edf666fe6044342eb1fd9abe50f96d8afa92cb147ab3fbd9
Instruction ID: d9ddb8a2899b62e2fcccc16d4d61b92d84fb8850f8fc925c740899af16058ced
Opcode Fuzzy Hash: c35bfba876e77a39edf666fe6044342eb1fd9abe50f96d8afa92cb147ab3fbd9
Instruction Fuzzy Hash: 232199B1448388AEE722DB34DC45BD77BE86F02304F4444EAD18AA72D3D7B85D85DB29

Function 00418F7B Relevance: 4.6, APIs: 3, Instructions: 62sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe), ref: 00418FAA

Part of subcall function 00419536: timeGetTime.WINMM ref: 0041954E

GetExitCodeProcess.KERNEL32(0048C1F0,?), ref: 00418FEE
CloseHandle.KERNEL32(0048C1F0,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe), ref: 00418FFF

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CloseCodeExitHandleProcessSleepTimetime
String ID:
API String ID: 3939281578-0
Opcode ID: 7f8541a54e5892fc25d5a11e3b0a4fb9da640623ff5ade2c04205f115da9a3c8
Instruction ID: d5a1c2d6ec5c4c0377987a8aa9d25c44ee8dca23f6b4cf511090a599775075bd
Opcode Fuzzy Hash: 7f8541a54e5892fc25d5a11e3b0a4fb9da640623ff5ade2c04205f115da9a3c8
Instruction Fuzzy Hash: 96110131688109AECF26676588283FEBB979B12318F08015FF28412221CFAD5DC7A75F

Function 00409B18 Relevance: 4.6, APIs: 3, Instructions: 50windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00409B6C
_memset.LIBCMT ref: 00409B77
CreateIcon.USER32(00000020,00000020,00000001,00000001,?,?), ref: 00409B98

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset$CreateIcon
String ID:
API String ID: 913522015-0
Opcode ID: a6f4eb4be2dbcf74017614f2d8138f2798f1f139e78f9c4de7adff749eef7436
Instruction ID: ca4f057dcc6da7ce610f229eb06517835969a7fc3c14e34b9b0d482f9a7ec113
Opcode Fuzzy Hash: a6f4eb4be2dbcf74017614f2d8138f2798f1f139e78f9c4de7adff749eef7436
Instruction Fuzzy Hash: F701D8B2D002186AE710AB56AC85F9FB7ACEB84318F04047FFB04F61D1DAB55884C76C

Function 00452044 Relevance: 4.5, APIs: 3, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__flush.LIBCMT ref: 00452077
__freebuf.LIBCMT ref: 0045207F
__close.LIBCMT ref: 0045208B

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __close__flush__freebuf
String ID:
API String ID: 3722736141-0
Opcode ID: 9508790c0e5babfa435479e001925684b776dbef7d572b45be81eac24aa3b25b
Instruction ID: 9d03d284387e27f83df6200fdd7217aede530b946880ce88e7cf6cdacfabfba9
Opcode Fuzzy Hash: 9508790c0e5babfa435479e001925684b776dbef7d572b45be81eac24aa3b25b
Instruction Fuzzy Hash: B0F0C862901B005E86307A7B4D4185BB3DC5E8773AB144B1FFE65D21D3E6AC980E866A

Function 00459BD7 Relevance: 4.5, APIs: 3, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00004000,00000000,?,00004000,?,00462A0C,?,00000000,00000000), ref: 00459C04
GetLastError.KERNEL32 ref: 00459C11
__dosmaperr.LIBCMT ref: 00459C20

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 776397c19fed15d58f600e79d9db1e2e02b7b2c6ec9868dbc3e1fc5cacb8085b
Instruction ID: 1421f1653887643186f8ddbe5c170403d0b184ccd9b0dc43b5fda8f8f4b77431
Opcode Fuzzy Hash: 776397c19fed15d58f600e79d9db1e2e02b7b2c6ec9868dbc3e1fc5cacb8085b
Instruction Fuzzy Hash: 2AF0C8326145119ACA115B7DBC0498A37989B8673AB110B57F930CB2E6DB24CC8957AE

Function 00424EAD Relevance: 4.5, APIs: 3, Instructions: 31sleeptimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Sleep.KERNEL32(00000000), ref: 00424EC6
timeGetTime.WINMM ref: 00424ECE
SetProcessWorkingSetSize.KERNEL32(000000FF,000000FF,000000FF), ref: 00424EFD

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageProcessSizeSleepTimeWorkingtime
String ID:
API String ID: 3835126801-0
Opcode ID: aed01b4b616c5ee5313be59386696b9fe4da8bec6e5d1f4001601efe91bc8cdd
Instruction ID: 004ce6c9f14faae0c823e9f3b344dba8b273c30769ebcddcf58ef521d3ebcc52
Opcode Fuzzy Hash: aed01b4b616c5ee5313be59386696b9fe4da8bec6e5d1f4001601efe91bc8cdd
Instruction Fuzzy Hash: FDF09A3160C72157D750AB74EC1964B7690EF84338F200B3EF06AD22E1EEBC94408A5A

Function 004538B7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

___getgmtimebuf.LIBCMT ref: 004538B8

Strings

9B, xrefs: 004538C5

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ___getgmtimebuf
String ID: 9B
API String ID: 1156330120-3820238304
Opcode ID: e885dac88fae3ffb6da2fbc61de371c940828875919641d3891c7ac8b82a247d
Instruction ID: c2c5307adaea5995935e29c016da1468730111ae498a76b748061221494ba3e7
Opcode Fuzzy Hash: e885dac88fae3ffb6da2fbc61de371c940828875919641d3891c7ac8b82a247d
Instruction Fuzzy Hash: 0AC0127755D83515191635BA78024DA02408B417A7701215BF841C5142DA0C8A4B01CD

Function 004378E9 Relevance: 3.1, APIs: 2, Instructions: 92sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A,0048BA08,0048BA08,?,0048BA08,?,0041903C,0048BA08,0048BA08,00000001,00000000,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe), ref: 00437918
timeGetTime.WINMM(?,0048BA08,?,0041903C,0048BA08,0048BA08,00000001,00000000,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe), ref: 00437928

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 73fb8afa7d86d284975798a9be7b44cf41ebc75aa5fe7e352d951449fabdd359
Instruction ID: 27ab6f69b115c87ee4efd6f25079fd855adaa97c948d3e7e2dfbe735c757e670
Opcode Fuzzy Hash: 73fb8afa7d86d284975798a9be7b44cf41ebc75aa5fe7e352d951449fabdd359
Instruction Fuzzy Hash: 842137F130C60667F1746A7988C9B7AB640AF0D308F24271BE099D6212CF5D7891D79E

Function 0041A38C Relevance: 3.1, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 0040C4DB: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\regsvr.exe,00000104,0048D8B0,C:\Users\user\Desktop\regsvr.exe,?,?,00406C7E,C:\Users\user\Desktop\regsvr.exe,00000104), ref: 0040C4F9

WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0041A3FA
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0041A40C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: PrivateProfileStringWrite$FullMessageNamePath
String ID:
API String ID: 4224191562-0
Opcode ID: b3165dcbec84ba81f13b24983435283c7b45353497ba55dce17d1b7bd077e54f
Instruction ID: 2f3a17eaba5364665d9bd1352509b6a8d37325c63a6a48ab769e670502e24c8d
Opcode Fuzzy Hash: b3165dcbec84ba81f13b24983435283c7b45353497ba55dce17d1b7bd077e54f
Instruction Fuzzy Hash: 4901B5B2A101182BDB11B7754C4AEBF239DDB84328F054577BC05F71C2DA7CED454AA5

Function 00421BA8 Relevance: 3.1, APIs: 2, Instructions: 54networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 00421BE0
FreeLibrary.KERNEL32(?), ref: 00421C22

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CloseFreeHandleInternetLibrary
String ID:
API String ID: 2710724954-0
Opcode ID: b4c7338a8d3ec74770c5f944a003518f44762e0fd436aa82190dab9fa4d17abe
Instruction ID: df093ca8ce884c0039315dd9714d505d36a53e17b97302458325ae1eee0d03c3
Opcode Fuzzy Hash: b4c7338a8d3ec74770c5f944a003518f44762e0fd436aa82190dab9fa4d17abe
Instruction Fuzzy Hash: 93113C35A04616AFCB10EF9AE88088DFBB5FF1431479086BAE124E3621C774BD95CB95

Function 00457C57 Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,00453D34,00000001), ref: 00457C68
HeapDestroy.KERNEL32 ref: 00457C9E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: e6b95f09fe93390926c633a42a8f3dee3f5dfadbc4c9cf5d9526afadf555e938
Instruction ID: a77f34462ffdd17000d5cd908b616a03b19893ae351acdac2544d49c104382a2
Opcode Fuzzy Hash: e6b95f09fe93390926c633a42a8f3dee3f5dfadbc4c9cf5d9526afadf555e938
Instruction Fuzzy Hash: 74E0ED71678301AEEB126B31BD4972A3694AB50B8BF10087FFC05C51A5FFA88485960D

Function 0045DF97 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0045DFAF

Part of subcall function 00455532: __mtinitlocknum.LIBCMT ref: 00455546
Part of subcall function 00455532: __amsg_exit.LIBCMT ref: 00455552
Part of subcall function 00455532: RtlEnterCriticalSection.NTDLL(?), ref: 0045555A

__tzset_nolock.LIBCMT ref: 0045DFC0

Part of subcall function 0045D8AB: __lock.LIBCMT ref: 0045D8CD
Part of subcall function 0045D8AB: __invoke_watson.LIBCMT ref: 0045D8F1
Part of subcall function 0045D8AB: __invoke_watson.LIBCMT ref: 0045D90C
Part of subcall function 0045D8AB: __invoke_watson.LIBCMT ref: 0045D927
Part of subcall function 0045D8AB: ____lc_codepage_func.LIBCMT ref: 0045D92F
Part of subcall function 0045D8AB: _strlen.LIBCMT ref: 0045D98F
Part of subcall function 0045D8AB: __malloc_crt.LIBCMT ref: 0045D996
Part of subcall function 0045D8AB: _strlen.LIBCMT ref: 0045D9AC

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __invoke_watson$__lock_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__malloc_crt__mtinitlocknum__tzset_nolock
String ID:
API String ID: 4249203040-0
Opcode ID: a08efd3b4c74185ad907ebfb00f89f76045372d51b901ff08b25fc7a5c7f0228
Instruction ID: 59cc63003c215e045ab64db059d94580f4ee11be83b408d9e0598d97f1642164
Opcode Fuzzy Hash: a08efd3b4c74185ad907ebfb00f89f76045372d51b901ff08b25fc7a5c7f0228
Instruction Fuzzy Hash: 17E086318C0B30E6C631BFA1580652C71616F04737F60816FFC5A115D3CA3805888F5D

Function 0041A2F7 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 0040C4DB: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\regsvr.exe,00000104,0048D8B0,C:\Users\user\Desktop\regsvr.exe,?,?,00406C7E,C:\Users\user\Desktop\regsvr.exe,00000104), ref: 0040C4F9

GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 0041A36F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: FullMessageNamePathPrivateProfileString
String ID:
API String ID: 2293904819-0
Opcode ID: 7ac7ce0f5b8ca6039468c3ba847e0187ea7638d5644e6a267e4d956b3743f0b8
Instruction ID: afdfd4a222a38ee004319feb394522888084550f90ab02918900143d29eaee06
Opcode Fuzzy Hash: 7ac7ce0f5b8ca6039468c3ba847e0187ea7638d5644e6a267e4d956b3743f0b8
Instruction Fuzzy Hash: 4D01B1B26002186ADB21B7754C8A9AF239EDB84329B14457BF805F7582DA3CED498A54

Function 00437A84 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00437AB1

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 79f1cb65e0f32e2c55fefa4be7b0d5979f71531f1abff4e515172dfb9aa6aee2
Instruction ID: 9e359bad42108b498ede935d4586e5ccc50791f06e41fd18962da7bc5a959e55
Opcode Fuzzy Hash: 79f1cb65e0f32e2c55fefa4be7b0d5979f71531f1abff4e515172dfb9aa6aee2
Instruction Fuzzy Hash: 3B01C8B26086067ED750AA31DC40DE6FB6CFB44398F000537F459E3151DB39B9658BE4

Function 00452338 Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00452365

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: dd0292eb844590ae7aec5838017fc10a0592ecf0e5331e2f77dae737590ecce5
Instruction ID: 07d2608a6e7e809214e76f144cb627329647ae2f61a68c34cd360a4fded98e1d
Opcode Fuzzy Hash: dd0292eb844590ae7aec5838017fc10a0592ecf0e5331e2f77dae737590ecce5
Instruction Fuzzy Hash: 8A018031801619EBCF21AFA58D0289F3B71AF09752F00811BFC24151A3D77D8A69DFD9

Non-executed Functions

Function 00441FD7 Relevance: 138.1, APIs: 73, Strings: 5, Instructions: 1600windowfileCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00443111
GetSysColor.USER32(0000000F), ref: 0044312F
SetBkColor.GDI32(?,00000000), ref: 00443145
74A309A0.COMCTL32 ref: 004431FD
ReleaseCapture.USER32 ref: 00443203
SetWindowTextW.USER32(?,00000000), ref: 004432B6
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 004432C6
FreeLibrary.KERNEL32(?), ref: 004433F9
DragQueryPoint.SHELL32(?,?), ref: 0044340C
SendMessageW.USER32(0048A010,000000B0,?,?), ref: 00443477
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00443482
DragQueryFileW.SHELL32(?,?,?,00000104), ref: 004434AD
_wcscat.LIBCMT ref: 004434DE
SendMessageW.USER32(0048A010,000000C2,00000001,?), ref: 004434F5
SendMessageW.USER32(0048A010,000000B0,?,00000000), ref: 00443506
SendMessageW.USER32(0048A010,000000B1,?,00000000), ref: 00443516
SendMessageW.USER32(0048A010,000000B1,?,00000000), ref: 0044353B
DragFinish.SHELL32(?), ref: 00443540

Strings

@GUI_DRAGFILE, xrefs: 0044332C, 004435E7
,, xrefs: 00442DA3
@GUI_DRAGID, xrefs: 004426B5, 004435AE
@GUI_DROPID, xrefs: 004432F1, 00443576
F, xrefs: 00442A43

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$Drag$Query$ColorFile$A309CaptureClientFinishFreeLibraryPointReleaseScreenTextWindow_wcscat
String ID: ,$@GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$F
API String ID: 2676149128-697031152
Opcode ID: 993c5459f25ed31fe4d180c329fc208f00fa9602aa8913f8b5c431fcf14e507e
Instruction ID: 2f5ca21f466d0c7f14adb5fd58eb00a35839a94604e3799ddf271b1a3d79e7c1
Opcode Fuzzy Hash: 993c5459f25ed31fe4d180c329fc208f00fa9602aa8913f8b5c431fcf14e507e
Instruction Fuzzy Hash: 8DD2A130204341AFEB20DF28C984B6BBBE5FF84714F500A5EF591972A1D7B9E945CB1A

Function 00432BDC Relevance: 48.0, APIs: 1, Strings: 26, Instructions: 724COMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

CharLowerBuffW.USER32(?,?), ref: 00432F7A

Part of subcall function 00410215: _memset.LIBCMT ref: 00410243

Strings

byte, xrefs: 00432BE8
long_ptr, xrefs: 00432F0D
int_ptr, xrefs: 00432EC4
int, xrefs: 00432D6D
char, xrefs: 00432C41
, xrefs: 00432C80
long, xrefs: 00432D2F
hwnd, xrefs: 00432E4E
ulong, xrefs: 00432D55
short, xrefs: 00432C93
wchar, xrefs: 00432C68
ptr, xrefs: 00432E11
align, xrefs: 00432F98
ushort, xrefs: 00432CB8
uint_ptr, xrefs: 00432EE8
dword, xrefs: 00432CDF
uint64, xrefs: 00432DF6
@, xrefs: 00432E6F
@, xrefs: 00432E44
ubyte, xrefs: 00432C19
double, xrefs: 00432E9D
uint, xrefs: 00432DA7
ulong_ptr, xrefs: 00432F35
udword, xrefs: 00432D06
int64, xrefs: 00432DCE
float, xrefs: 00432E79

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: BuffCharLowerMessage_memset
String ID: $@$@$align$byte$char$double$dword$float$hwnd$int$int64$int_ptr$long$long_ptr$ptr$short$ubyte$udword$uint$uint64$uint_ptr$ulong$ulong_ptr$ushort$wchar
API String ID: 2326986344-16665901
Opcode ID: e72367f5e4790fb5b6babce893b4319525e075ee07547b6522cb5075420b2f2e
Instruction ID: 76a9f760883b43b550d8287efe5ff65a748cb50c4bbca1b921223ee8b51c25ed
Opcode Fuzzy Hash: e72367f5e4790fb5b6babce893b4319525e075ee07547b6522cb5075420b2f2e
Instruction Fuzzy Hash: 60429131D00618ABDB21DF69C8417EEB7B1BF48305F1084ABE909BB251D7B95E85CF85

Function 00409786 Relevance: 42.1, APIs: 23, Strings: 1, Instructions: 117threadkeyboardwindowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040979B
IsIconic.USER32(?), ref: 004097A8
ShowWindow.USER32(?,00000009,?,?,75A915B0,?,00000001), ref: 004097B5
SetForegroundWindow.USER32(?), ref: 004097C6
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004097D8
GetCurrentThreadId.KERNEL32 ref: 004097DE
GetWindowThreadProcessId.USER32(?,00000000), ref: 004097EA
AttachThreadInput.USER32(?,00000000,00000001,?,?,75A915B0,?,00000001), ref: 004097FD
AttachThreadInput.USER32(?,?,00000001,?,?,75A915B0,?,00000001), ref: 00409809
AttachThreadInput.USER32(?,?,00000001,?,?,75A915B0,?,00000001), ref: 00409815
SetForegroundWindow.USER32(?), ref: 00409818
MapVirtualKeyW.USER32(00000012,00000000), ref: 00409829
keybd_event.USER32(00000012,00000000), ref: 00409834
MapVirtualKeyW.USER32(00000012,00000000), ref: 0040983C
keybd_event.USER32(00000012,00000000), ref: 00409841
MapVirtualKeyW.USER32(00000012,00000000), ref: 00409848
keybd_event.USER32(00000012,00000000), ref: 0040984D
MapVirtualKeyW.USER32(00000012,00000000), ref: 00409855
keybd_event.USER32(00000012,00000000), ref: 0040985A
SetForegroundWindow.USER32(?), ref: 00409860
AttachThreadInput.USER32(00000003,?,00000000), ref: 00409885
AttachThreadInput.USER32(00000003,00000003,00000000), ref: 00409890
AttachThreadInput.USER32(?,?,00000000), ref: 0040989B

Strings

Shell_TrayWnd, xrefs: 00409796

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Thread$Window$AttachInput$Virtualkeybd_event$Foreground$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 1293805756-2988720461
Opcode ID: 52c51417e2a545cfa38766acbc20a44171109917dd8e773bbe11aa5087a41122
Instruction ID: 9db30ad53e920ac4545e7fec9f1000412b23fd80184155ad3c302ff893226886
Opcode Fuzzy Hash: 52c51417e2a545cfa38766acbc20a44171109917dd8e773bbe11aa5087a41122
Instruction Fuzzy Hash: 0031B471504309BBDB10AF66CC44F6B7E9DEF857D8F01042AF540921A2D6B6DC149BB7

Function 00421EB4 Relevance: 31.7, APIs: 21, Instructions: 164clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0046BF68), ref: 00421EDD
IsClipboardFormatAvailable.USER32(0000000D), ref: 00421EEB
GetClipboardData.USER32(0000000D), ref: 00421EF3
CloseClipboard.USER32 ref: 00421EFF
GlobalLock.KERNEL32(00000000), ref: 00421F17
CloseClipboard.USER32 ref: 00421F21
IsClipboardFormatAvailable.USER32(00000001), ref: 00421F3A
GetClipboardData.USER32(00000001), ref: 00421F42
GlobalLock.KERNEL32(00000000), ref: 00421F4F
GlobalUnlock.KERNEL32(00000000), ref: 00421F76
IsClipboardFormatAvailable.USER32(0000000F), ref: 00421F83
GetClipboardData.USER32(0000000F), ref: 00421F8F
CloseClipboard.USER32 ref: 00421FA0
GlobalLock.KERNEL32(00000000), ref: 00421FAD
CloseClipboard.USER32 ref: 00421FB7
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00421FCE
DragQueryFileW.SHELL32(?,?,?,00000104), ref: 00421FEE
DragQueryFileW.SHELL32(?,?,?,00000104), ref: 00422022
GlobalUnlock.KERNEL32(?), ref: 00422041
CountClipboardFormats.USER32 ref: 00422067
CloseClipboard.USER32 ref: 00422082

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Clipboard$CloseGlobal$AvailableDataDragFileFormatLockQuery$Unlock$CountFormatsOpen
String ID:
API String ID: 1467999397-0
Opcode ID: 2cb0fa8f945d83c028d0fecefb5a3bb4a0a16bd23a328e87f83d9dce2012ad3e
Instruction ID: dee9b12acf1d7c0e5d34432ddaea1ab5d71d3f0a61fff10c2d8a619a1ce1d4cd
Opcode Fuzzy Hash: 2cb0fa8f945d83c028d0fecefb5a3bb4a0a16bd23a328e87f83d9dce2012ad3e
Instruction Fuzzy Hash: E751D771704119BBDB10AFA5ED89FAE3768AF14318F110077F611E21A1EBB49E41CB6A

Function 0041B572 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 210timefileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

FindFirstFileW.KERNEL32(00000000,?), ref: 0041B5A2
FindClose.KERNEL32(00000000), ref: 0041B5E2
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0041B60E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0041B625
FileTimeToSystemTime.KERNEL32(?,?), ref: 0041B64C
__swprintf.LIBCMT ref: 0041B698
__swprintf.LIBCMT ref: 0041B6CF
__swprintf.LIBCMT ref: 0041B6FB

Part of subcall function 0044F059: __woutput_l.LIBCMT ref: 0044F0AC

__swprintf.LIBCMT ref: 0041B724

Part of subcall function 0044F059: __flsbuf.LIBCMT ref: 0044F0CA
Part of subcall function 0044F059: __flsbuf.LIBCMT ref: 0044F0E2

__swprintf.LIBCMT ref: 0041B74D
__swprintf.LIBCMT ref: 0041B776
__swprintf.LIBCMT ref: 0041B79F

Strings

%4d, xrefs: 0041B6C9
%4d%02d%02d%02d%02d%02d, xrefs: 0041B692
%02d, xrefs: 0041B6F0, 0041B6F9, 0041B722, 0041B74B, 0041B774, 0041B79D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstMessageSystem__woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 1895052877-2428617273
Opcode ID: 2d8e35d287bcfed7e38f3570ac1975c48480ae4dcd4d4152ecbcd59a91fe4261
Instruction ID: 58c41aa100c0c531ca340e54775947fabf3c2dbe4ced7be747fb93faf759285b
Opcode Fuzzy Hash: 2d8e35d287bcfed7e38f3570ac1975c48480ae4dcd4d4152ecbcd59a91fe4261
Instruction Fuzzy Hash: 77617272508304AFC710EFA58845DAF77ECAF89714F00492FF695D3281E6B8D9858BA6

Function 0041B7D8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

GetLocalTime.KERNEL32(?), ref: 0041B89C
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041B8AC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0041B8B8
_wcsncpy.LIBCMT ref: 0041B8DF
_wcscat.LIBCMT ref: 0041B93E
_wcscat.LIBCMT ref: 0041B950
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0041B961
SetCurrentDirectoryW.KERNEL32(?), ref: 0041B975
GetFileAttributesW.KERNEL32(?), ref: 0041B986
SetCurrentDirectoryW.KERNEL32(?), ref: 0041B9BA
_wcscpy.LIBCMT ref: 0041B9C6
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0041B9FD

Strings

*.*, xrefs: 0041B9C0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Time$CurrentDirectoryFile$Local_wcscat$AttributesMessageSystem_wcscpy_wcsncpy
String ID: *.*
API String ID: 1156724541-438819550
Opcode ID: f03f9563414caf4ffc7010042de2435deb692c6d8151ed44618d7755af116d7e
Instruction ID: cb4f71639a2160c6757a7afe06acb7e7096463695dc5846f498f29438757b29b
Opcode Fuzzy Hash: f03f9563414caf4ffc7010042de2435deb692c6d8151ed44618d7755af116d7e
Instruction Fuzzy Hash: 18514FB25083446BCB20EBA5D885ADB77DCEF85718F000A3FF585D3141EB78D5498BAA

Function 0041D0C8 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 98fileCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 0041D0E1
CreateDirectoryW.KERNEL32(00000000,00000000,?,?,?,00000000), ref: 0041D131
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000003,02200000,00000000,00000000,?,?,?,00000000), ref: 0041D155
_memset.LIBCMT ref: 0041D170
_wcsncpy.LIBCMT ref: 0041D1B7
DeviceIoControl.KERNEL32(00000000,000900A4,A0000003,?,00000000,00000000,?,00000000), ref: 0041D1EA
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041D1F5
RemoveDirectoryW.KERNEL32(00000000,?,?,?,00000000), ref: 0041D1FC
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041D206

Strings

\??\%s, xrefs: 0041D0DB
:, xrefs: 0041D10E
\, xrefs: 0041D0F7

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 147185268-3457252023
Opcode ID: 01229f154515c0a184b3b42d371d5060e0470ccb71a0a816dd080fc0190f3ee4
Instruction ID: 8a8c1d5972a93648f321550eee670f743a53079bdd3337a3edc54f5173483aeb
Opcode Fuzzy Hash: 01229f154515c0a184b3b42d371d5060e0470ccb71a0a816dd080fc0190f3ee4
Instruction Fuzzy Hash: E531ACB190021C6EDB20EB64DC45FEB77ACBF44308F0041E6F555D2152EB789E898B69

Function 0040D288 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 65shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0040D2A1
OpenProcessToken.ADVAPI32(00000000), ref: 0040D2A8
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040D2C2
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0040D2E1
GetLastError.KERNEL32 ref: 0040D2E7
EnumWindows.USER32(0040D339,00000000), ref: 0040D30C
ExitWindowsEx.USER32(?,00000000), ref: 0040D31E
SetSystemPowerState.KERNEL32(00000000,00000000), ref: 0040D330

Strings

SeShutdownPrivilege, xrefs: 0040D2BA
, xrefs: 0040D328
, xrefs: 0040D312
@, xrefs: 0040D317

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ProcessTokenWindows$AdjustCurrentEnumErrorExitLastLookupOpenPowerPrivilegePrivilegesStateSystemValue
String ID: $ $@$SeShutdownPrivilege
API String ID: 3737638738-3163812486
Opcode ID: d221b141257a1b5a77c5d9165ae56490d43f55f2f625de518dde7a499e688718
Instruction ID: eac26956ff1bed6e971f9e7b7b09c618fe6a40502a3d4a20c72487dc46b2676d
Opcode Fuzzy Hash: d221b141257a1b5a77c5d9165ae56490d43f55f2f625de518dde7a499e688718
Instruction Fuzzy Hash: 3311C471D05225BEE7205BE59D8CBAB7EACDF05394F100076F902E01D0E6B88948C7BA

Function 0044602C Relevance: 20.8, APIs: 7, Strings: 3, Instructions: 3285COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 0044639B
_strncmp.LIBCMT ref: 0044663D
_strncmp.LIBCMT ref: 00446702
_strncmp.LIBCMT ref: 00446F57
_strncmp.LIBCMT ref: 004471A9
_memset.LIBCMT ref: 004471E1

Strings

ACCEPT, xrefs: 00446356
DEFINE, xrefs: 004466FC
Q\E, xrefs: 004471A3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _strncmp$_memset
String ID: ACCEPT$DEFINE$Q\E
API String ID: 3584909358-3228910099
Opcode ID: 32d23e6376e96b81a453cc1c6041cf18e8f68d3cc9863617e5092e1ce2dd82f9
Instruction ID: c1e7447fc3f11b16837eced2967d18acf4e8b53fe993750e218afdb34a4b267c
Opcode Fuzzy Hash: 32d23e6376e96b81a453cc1c6041cf18e8f68d3cc9863617e5092e1ce2dd82f9
Instruction Fuzzy Hash: 9C53BE70504289DFEF29CF28C8847AA3BE1BF16304F15415BEC9587392D779D886CB9A

Function 0040853B Relevance: 18.1, APIs: 12, Instructions: 147keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 004085DF
SetKeyboardState.USER32(?), ref: 00408623
GetAsyncKeyState.USER32(00000011), ref: 00408638
GetKeyState.USER32(00000011), ref: 00408645
GetAsyncKeyState.USER32(00000012), ref: 00408668
GetKeyState.USER32(00000012), ref: 00408670
GetAsyncKeyState.USER32(?), ref: 00408695
GetKeyState.USER32(?), ref: 004086A2
GetAsyncKeyState.USER32(000000A1), ref: 004086CD
GetKeyState.USER32(000000A1), ref: 004086D5
GetAsyncKeyState.USER32(0000005B), ref: 004086F8
GetKeyState.USER32(0000005B), ref: 00408700

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 7360a7b56c165d971390acd4bd3d10ae77c4bce19b2045796409b3cf3099cd63
Instruction ID: daa85f2bcad83e4fa999e06a490039027a88e11ba0e292c1260292f71f5e0a3c
Opcode Fuzzy Hash: 7360a7b56c165d971390acd4bd3d10ae77c4bce19b2045796409b3cf3099cd63
Instruction Fuzzy Hash: F4516D30205B409AE7309A398E897E77694AF50788F15483EE9DA773C1DF7EA904CB1D

Function 0041BA0A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 0041BA28
FindNextFileW.KERNEL32(00000000,?), ref: 0041BA80
FindClose.KERNEL32(00000000), ref: 0041BA91
FindClose.KERNEL32(00000000), ref: 0041BAA3
FindFirstFileW.KERNEL32(*.*,?), ref: 0041BAB9
SetCurrentDirectoryW.KERNEL32(?), ref: 0041BB07
SetCurrentDirectoryW.KERNEL32(0046FAA8), ref: 0041BB25
FindNextFileW.KERNEL32(?,00000010), ref: 0041BB31
FindClose.KERNEL32(?), ref: 0041BB44

Part of subcall function 0040C25D: GetFileAttributesW.KERNEL32(?), ref: 0040C264

Strings

*.*, xrefs: 0041BAB4

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Attributes
String ID: *.*
API String ID: 3396039715-438819550
Opcode ID: 292b795b31d98c95004cc2cea4c857d0f8e6e59e6bf4472f4792a00dd828fcc4
Instruction ID: 24112f52db47151e95aa2786c82ce1e44472ccac8df7ef0c03d195ca626b433b
Opcode Fuzzy Hash: 292b795b31d98c95004cc2cea4c857d0f8e6e59e6bf4472f4792a00dd828fcc4
Instruction Fuzzy Hash: 9531D6319042087ADF109FF1EC45AEE77ACEF45364F2001A7F804E2191E779EE899B99

Function 0040C672 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C4DB: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\regsvr.exe,00000104,0048D8B0,C:\Users\user\Desktop\regsvr.exe,?,?,00406C7E,C:\Users\user\Desktop\regsvr.exe,00000104), ref: 0040C4F9

GetFileAttributesW.KERNEL32(?), ref: 0040C697
_wcscat.LIBCMT ref: 0040C6B0
FindFirstFileW.KERNEL32(?,?,?,?,?), ref: 0040C6F1
_wcscpy.LIBCMT ref: 0040C724
_wcscat.LIBCMT ref: 0040C736
_wcscat.LIBCMT ref: 0040C748
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040C755
FindNextFileW.KERNEL32(00000000,00000010), ref: 0040C769
FindClose.KERNEL32(00000000,?,?,?), ref: 0040C77A

Strings

\*.*, xrefs: 0040C6AA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath_wcscpy
String ID: \*.*
API String ID: 1646789304-1173974218
Opcode ID: b111e6d061cfc11706be453b9723871d6f0b132665ce78fb924a51c4d08c4fa5
Instruction ID: 214debf2cda6567c14c833ab0d974a760c696e7914f813d879f3e4fefbd5b9c4
Opcode Fuzzy Hash: b111e6d061cfc11706be453b9723871d6f0b132665ce78fb924a51c4d08c4fa5
Instruction Fuzzy Hash: 073184724483499AD720DBA4D889DDB77DCAB46314F040B2FF595D3181E739D50C8B6B

Function 0040D70C Relevance: 16.6, APIs: 11, Instructions: 92COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 0040D720
__swprintf.LIBCMT ref: 0040D72D

Part of subcall function 0044F059: __woutput_l.LIBCMT ref: 0044F0AC

__wcsicmp.LIBCMT ref: 0040D73A
FindResourceW.KERNEL32(?,?,0000000E), ref: 0040D75E
LoadResource.KERNEL32(?,00000000), ref: 0040D76A
LockResource.KERNEL32(00000000), ref: 0040D76D
FindResourceW.KERNEL32(?,?,00000003), ref: 0040D792
LoadResource.KERNEL32(?,00000000), ref: 0040D79B
SizeofResource.KERNEL32(?,?), ref: 0040D7A6
LockResource.KERNEL32(00000000), ref: 0040D7B2

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicmp__woutput_l
String ID:
API String ID: 1236958983-0
Opcode ID: f10c7e01df551b1d201e3edd110367980da33a9b77f23fe8755f474e4a25e71c
Instruction ID: 98a6d5060e16ede7f432ee4b2633ddf11e0c5f817e7636dd1fde48ecaf2debe4
Opcode Fuzzy Hash: f10c7e01df551b1d201e3edd110367980da33a9b77f23fe8755f474e4a25e71c
Instruction Fuzzy Hash: 4C318D71800209AFDF11DFA1DD44EAE7BB9FB44304F008426F955A22A0E379DDA4DBA9

Function 0042209A Relevance: 12.1, APIs: 8, Instructions: 51clipboardmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 0040D6DA: _wcscpy.LIBCMT ref: 0040D700

GlobalAlloc.KERNEL32(00000002,?), ref: 004220C5
GlobalLock.KERNEL32(00000000), ref: 004220E6
_wcscpy.LIBCMT ref: 004220F2
GlobalUnlock.KERNEL32(00000000), ref: 00422101
OpenClipboard.USER32 ref: 0042210D
EmptyClipboard.USER32 ref: 00422113
SetClipboardData.USER32(0000000D,00000000), ref: 0042211C
CloseClipboard.USER32 ref: 00422122

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Clipboard$Global$_wcscpy$AllocCloseDataEmptyLockMessageOpenUnlock
String ID:
API String ID: 1154262185-0
Opcode ID: 4411b4628d2b36a0669a557a4331fcc58edd2813061426db5d04e616cb6d1917
Instruction ID: f57eda6113cd665400d7349620928e2233a8d1cb9c03744da8c07c0f788a121d
Opcode Fuzzy Hash: 4411b4628d2b36a0669a557a4331fcc58edd2813061426db5d04e616cb6d1917
Instruction Fuzzy Hash: AD01D4325081207BD3113BB2AC4EE6F3A68EF45779B00043FF901E6192EEACC945C66E

Function 00426F8D Relevance: 9.1, APIs: 6, Instructions: 75networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00426FED
WSAGetLastError.WS2_32(00000000,00000002,00000001,00000006,?,00000000,00000000), ref: 00426FFB

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

bind.WS2_32(00000000,?,00000010), ref: 00427012
listen.WS2_32(00000000,00000005), ref: 00427020
WSAGetLastError.WS2_32(00000000,00000002,00000001,00000006,?,00000000,00000000), ref: 0042702E
closesocket.WS2_32(00000000), ref: 0042703D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ErrorLast$Messagebindclosesocketlistensocket
String ID:
API String ID: 158358722-0
Opcode ID: 98a8e7fd46ebe0775f59dfc51cdfd106aaa9d1d730ed189c368ace39ee607ec9
Instruction ID: 699dfbc0ac604ad5be8f0202c243b2e73cd09f844bd0362dfc5d0cd4353c2c47
Opcode Fuzzy Hash: 98a8e7fd46ebe0775f59dfc51cdfd106aaa9d1d730ed189c368ace39ee607ec9
Instruction Fuzzy Hash: 0811E63174513466EB20B6B91D53BAF22894F4432CF55023FB512F72C3DA7C8D4906AE

Function 0041D215 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 239comCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

CoInitialize.OLE32(00000000), ref: 0041D26F
CoCreateInstance.COMBASE(004677D0,00000000,00000001,004677C0,?), ref: 0041D286
_wcsncpy.LIBCMT ref: 0041D43B
CoUninitialize.COMBASE ref: 0041D480

Strings

.lnk, xrefs: 0041D251, 0041D256, 0041D264

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CreateInitializeInstanceMessageUninitialize_wcsncpy
String ID: .lnk
API String ID: 838818076-24824748
Opcode ID: 05c1c78da8f0ba36ca674eb95acefe979179947d5e444b713e591e29b4e4fb3e
Instruction ID: 05159cdee131f500c309a8ade47987847498d9fb3c13d4dc48e9b25da1553829
Opcode Fuzzy Hash: 05c1c78da8f0ba36ca674eb95acefe979179947d5e444b713e591e29b4e4fb3e
Instruction Fuzzy Hash: 32817E71E00208ABDB10EBB1C846AAE7775EF44319F1444BAE902FB291D778AE84CF54

Function 0041EA5E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 117filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000001,00000000), ref: 0041EA9C
Sleep.KERNEL32(0000000A), ref: 0041EAC9
FindNextFileW.KERNEL32(00000001,?), ref: 0041EB9D
FindClose.KERNEL32(00000001), ref: 0041EBB4

Strings

*.*, xrefs: 0041EA82

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Find$File$CloseFirstNextSleep
String ID: *.*
API String ID: 1749430636-438819550
Opcode ID: a4b33008cc78126f54786bfa852d861979d2c699a2c62dd7eb7d346323ff5308
Instruction ID: 2327df8b8f53aab0c3134182f450212502a6b77773297c3beefd8ddadd9bea59
Opcode Fuzzy Hash: a4b33008cc78126f54786bfa852d861979d2c699a2c62dd7eb7d346323ff5308
Instruction Fuzzy Hash: 7A41B035808219AFDF10DFA2CC45ADE7BB4FF00314F1444ABF845A2291E738AE95CB99

Function 00428656 Relevance: 7.7, APIs: 5, Instructions: 220comCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

MkParseDisplayName.OLE32(?,00000000,?,?), ref: 004287BD
OleInitialize.OLE32(00000000), ref: 004286C0

Part of subcall function 0040D6DA: _wcscpy.LIBCMT ref: 0040D700

CreateBindCtx.OLE32(00000000,?), ref: 00428769
CLSIDFromProgID.COMBASE(00000000,?), ref: 00428860
GetActiveObject.OLEAUT32(?,00000000,?), ref: 00428886

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ActiveBindCreateDisplayFromInitializeMessageNameObjectParseProg_wcscpy
String ID:
API String ID: 1569849523-0
Opcode ID: 27d15a50f8c44f8f59b0af0c4012518d0fa12db0eb6c7fc0176fab6984cc62f8
Instruction ID: 45edd711b8b18184e34cf7b4839159bad7bf288c39f976c69955b8c122c35607
Opcode Fuzzy Hash: 27d15a50f8c44f8f59b0af0c4012518d0fa12db0eb6c7fc0176fab6984cc62f8
Instruction Fuzzy Hash: 36719A71609204AFD700EFA2EC8586FB7E9EF84358F50493EF54197251EA38DC058B5A

Function 0042754A Relevance: 7.6, APIs: 5, Instructions: 122networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 004271B1: inet_addr.WS2_32(00000000), ref: 004271C8

socket.WS2_32(00000002,00000002,00000011), ref: 0042759F
WSAGetLastError.WS2_32(00000000,00000002,00000002,00000011,?,?,00000000,00000000), ref: 004275C0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ErrorLastMessageinet_addrsocket
String ID:
API String ID: 479597090-0
Opcode ID: f9a3a56ba54ef09390b4cb4b8d6849d27d51f7a379371b9992dc1a754c172aa0
Instruction ID: 012d38f13155d9979b1bcb4aafed225c22acb24815c66ea21bf13d4a11b49de6
Opcode Fuzzy Hash: f9a3a56ba54ef09390b4cb4b8d6849d27d51f7a379371b9992dc1a754c172aa0
Instruction Fuzzy Hash: A431B532B08214BBEB14B7B69C87AAE6795DF40728F15012FF900AB2C2DDBC5D81565D

Function 00439F63 Relevance: 7.6, APIs: 5, Instructions: 59windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00437A84: IsWindow.USER32(00000000), ref: 00437AB1

IsWindowVisible.USER32 ref: 00439F9F
IsWindowEnabled.USER32 ref: 00439FAD
GetForegroundWindow.USER32(?,?,00000001), ref: 00439FBA
IsIconic.USER32 ref: 00439FC8
IsZoomed.USER32 ref: 00439FD6

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 0d919f308e6d7fae4b629042cde9fa380d4e273c503d748488680d10b526d4d0
Instruction ID: 7f13033eb011558cad701ce4ec7d28c70aed03c416c9c99ba4a8819bc7b5e466
Opcode Fuzzy Hash: 0d919f308e6d7fae4b629042cde9fa380d4e273c503d748488680d10b526d4d0
Instruction Fuzzy Hash: 240128313086016FE7206B7A4C84A2F2A9DBF98719F14603BF005D2152EBECCD41866E

Function 0040D3AB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 0040D4F7: __wcsicmp.LIBCMT ref: 0040D507
Part of subcall function 0040D4F7: __wcsicmp.LIBCMT ref: 0040D51C

Part of subcall function 0040BBB0: RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,00000000,?,?,?,0042E784,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 0040BBCF
Part of subcall function 0040BBB0: RegQueryValueExW.ADVAPI32(00000000,?,00000000,00000000,00000000,?,?,?,0042E784,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 0040BBE6
Part of subcall function 0040BBB0: RegCloseKey.ADVAPI32(00000000,?,?,0042E784,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?,?,?,?,?,00000000), ref: 0040BBF7

mouse_event.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0040D421

Strings

SwapMouseButtons, xrefs: 0040D3BE
Control Panel\Mouse, xrefs: 0040D3C3
1, xrefs: 0040D40B

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsicmp$CloseOpenQueryValuemouse_event
String ID: 1$Control Panel\Mouse$SwapMouseButtons
API String ID: 3324267174-1333076132
Opcode ID: 1e88b7714b173cf6c3b0cc5a66203ead5aaaed453d0b375e4da4f3ac8702420b
Instruction ID: c315c89092b364021b1f242551d70469bea58c1b1c5b3e0d6c28d640509d77e2
Opcode Fuzzy Hash: 1e88b7714b173cf6c3b0cc5a66203ead5aaaed453d0b375e4da4f3ac8702420b
Instruction Fuzzy Hash: 7901DB6AE503157EE3001AF19CC6F7B21ACD74435DF644536FA42F10C1F1F86E8A906A

Function 00460147 Relevance: 6.1, APIs: 4, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004639E7
UnhandledExceptionFilter.KERNEL32(0046B514), ref: 004639F2
GetCurrentProcess.KERNEL32(C0000409), ref: 00463A0E
TerminateProcess.KERNEL32(00000000), ref: 00463A15

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 4979439936a776235a93f9a19cb7d9785398a8088a8285f7750502a1813f2190
Instruction ID: 8b3e446ca19cc36fbbc20ebe44a95eceae9e0a649eff50c0dce4826641b66d3f
Opcode Fuzzy Hash: 4979439936a776235a93f9a19cb7d9785398a8088a8285f7750502a1813f2190
Instruction Fuzzy Hash: CA21CBB4941304AFDB50EF69EC496943BB8BB0C308F1045BAE80D962B1E7B559C4CF4E

Function 0041E028 Relevance: 4.6, APIs: 3, Instructions: 132fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

FindFirstFileW.KERNEL32(00000000,?), ref: 0041E052
FindNextFileW.KERNEL32(00000000,?), ref: 0041E09E
FindClose.KERNEL32(00000000,000000FF,00000000), ref: 0041E0BE

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Find$File$CloseFirstMessageNext
String ID:
API String ID: 1079436330-0
Opcode ID: d948c1c33bacb28f1de7d0caf43a6975e20b7644f0799607c21d02d75e319b99
Instruction ID: eab778f33daa9bb538d06aee4b07686b3da3b46dbd4970fe2a4dad36cd629182
Opcode Fuzzy Hash: d948c1c33bacb28f1de7d0caf43a6975e20b7644f0799607c21d02d75e319b99
Instruction Fuzzy Hash: 4B410036608200AFD710EF66C88599A77E5FF49324F00042FFC5597292DB78FC848B6A

Function 0041C97F Relevance: 4.6, APIs: 3, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0041C98D

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000000), ref: 0041CA26
FreeLibrary.KERNEL32(?), ref: 0041CA77

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Free$DiskErrorLibraryMessageModeSpace
String ID:
API String ID: 2448952623-0
Opcode ID: 78510be7b04eccd4f7aa7240b23a080cbd9bb8ee1e31a8de61214c895740685b
Instruction ID: 19cd6573f061630c8903b0e4d96ba3736733aee78d7086a91853b534bd8eaff7
Opcode Fuzzy Hash: 78510be7b04eccd4f7aa7240b23a080cbd9bb8ee1e31a8de61214c895740685b
Instruction Fuzzy Hash: 84314D72940108ABCF05EFA5DD859EEB7B8FF04354B01852BF901B7251DB78AE85CB58

Function 00445948 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 570COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00445AA9

Strings

{0,, xrefs: 00445AA3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _strncmp
String ID: {0,
API String ID: 909875538-1249576115
Opcode ID: 7e89a20008915c3ecc948d57da9ad9e54ad97ab3f44c4c0d1fcdc65f34d9870d
Instruction ID: 17f535e6b075d271493b319b15babdeace80fb1c44ce839b2010ffb58041e355
Opcode Fuzzy Hash: 7e89a20008915c3ecc948d57da9ad9e54ad97ab3f44c4c0d1fcdc65f34d9870d
Instruction Fuzzy Hash: E0122630604E855BFF398E2884C863E7751EB02714F38861BD862C67D3D66CED82D65E

Function 0041BB4D Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

FindFirstFileW.KERNEL32(00000000,?), ref: 0041BB76
FindClose.KERNEL32(00000000), ref: 0041BB9A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Find$CloseFileFirstMessage
String ID:
API String ID: 3205698159-0
Opcode ID: 29576fd3ad17671ce72850942685154a4a95fd2c68fe6b5c673d3374ef2937c8
Instruction ID: 303933298d37fa535bc89766d4ae429e119cd19a799f999609cd0fdabb163fee
Opcode Fuzzy Hash: 29576fd3ad17671ce72850942685154a4a95fd2c68fe6b5c673d3374ef2937c8
Instruction Fuzzy Hash: 160126726181002BCB14A7B49C0A9AB33C8DF88335F00072BFC55D72C0EA78EC4086D9

Function 004121B3 Relevance: 2.1, APIs: 1, Instructions: 610COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041284D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: b7ba42e6f83d875a51634b9e11098d6bdb47c6090a43f3453bfe0cb3fff1ce81
Instruction ID: 419ca9e02455fc7b7c1feb05e127d2d1ecc4ac4517371b0bf155143c9b1c1c20
Opcode Fuzzy Hash: b7ba42e6f83d875a51634b9e11098d6bdb47c6090a43f3453bfe0cb3fff1ce81
Instruction Fuzzy Hash: 3C22847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Function 0044D99C Relevance: 2.0, Strings: 1, Instructions: 703COMMON

Download Yara Rule

Strings

ERCP, xrefs: 0044DA7E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID:
String ID: ERCP
API String ID: 0-1384759551
Opcode ID: 00af32fa6fbdd41b28502c8f187f9564ed7e29f62218ac181aac72e0a6d43574
Instruction ID: d1a9b71b6aa19ae6caf09824edfab2ba454b1006507bae748ad2bb1b12bcaab9
Opcode Fuzzy Hash: 00af32fa6fbdd41b28502c8f187f9564ed7e29f62218ac181aac72e0a6d43574
Instruction Fuzzy Hash: D642AF70D00649CFEF28CF59C8806AE7BF2BF55314F28412BE86696391D379D885CB59

Function 00411906 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0041191B

Part of subcall function 00452F3F: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,0041289C,00000000,00000000,?,?,?,00412C3C,?,00000000), ref: 00452F48
Part of subcall function 00452F3F: __aulldiv.LIBCMT ref: 00452F68

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: dd79ffdb2c076c8171b0f8cfbc02ddd1c7dc06ca21e2768bafe19140a8e171f3
Instruction ID: 9e30d3db8714523ca3dabb9b6bf04bcd2ce44348211c2002315bcbfc56628793
Opcode Fuzzy Hash: dd79ffdb2c076c8171b0f8cfbc02ddd1c7dc06ca21e2768bafe19140a8e171f3
Instruction Fuzzy Hash: 7A21B373214B058FE728CF65D8C069AB3E2EBC8310F258E3DD2A543340C7B5A949CB98

Function 0042ED72 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0042ED84

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 7cc496694b18207bd3178febef2e6378c16ccb0dfd12fc0a4e99eae989037805
Instruction ID: e095174375131c4a836fc38e35d518248cf96b1c3da38f52dd67506720fb4b9a
Opcode Fuzzy Hash: 7cc496694b18207bd3178febef2e6378c16ccb0dfd12fc0a4e99eae989037805
Instruction Fuzzy Hash: 79C04CB1404018AFC750CFC0D8889CD7BBCAB04344F1001D2E205D1010DB7456849B26

Function 00408381 Relevance: 1.5, APIs: 1, Instructions: 6keyboardCOMMON

Download Yara Rule

APIs

keybd_event.USER32(?,?,?,00000000), ref: 0040838F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: keybd_event
String ID:
API String ID: 2665452162-0
Opcode ID: 0479c103f2eca304b2ceb9ef9286318d1008d58df40571a74abf799f94d68d10
Instruction ID: dc3bc0c10ad9ce968133ae8ad726df65831a45a0230fe7c1bd6b063b48a31fa5
Opcode Fuzzy Hash: 0479c103f2eca304b2ceb9ef9286318d1008d58df40571a74abf799f94d68d10
Instruction Fuzzy Hash: A0B09232108382EBCB02CF50CC04F1EBBA2BB94300F040C1CF2A0400B083628028EB07

Function 0045EA75 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0005EA38), ref: 0045EA7A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 75e6696888ec08c50a34228201fdfdf3540764a583854191e4a951138a0ebaf5
Instruction ID: ef5df3b709a5e3eb5a347aaacd005bd6ca54480151cdc03e4db224316e4b1d6c
Opcode Fuzzy Hash: 75e6696888ec08c50a34228201fdfdf3540764a583854191e4a951138a0ebaf5
Instruction Fuzzy Hash: 8590026025610047974417769C1950565906A8CA0775146E1F441C5095EBA9454C561A

Function 00436CF3 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 19722718d04c2d14846d86f895a2a6d455a65963d3380b94437d21885ec5e027
Instruction ID: 4a1ef88e1589eae8da01e7ad87d25acf379cf9c68f71bbcf6a7540ab9e77ce14
Opcode Fuzzy Hash: 19722718d04c2d14846d86f895a2a6d455a65963d3380b94437d21885ec5e027
Instruction Fuzzy Hash: 5BE1D17250C301ABC720EF66C88155FF3E5EF88354F21982FF595A3291DB38D9498B9A

Function 004504ED Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 99f7f10c7316344e848e26dfda4d2667c7719398b7900840cafa12e7e20f0f44
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 21D19E77C1E9B30A9735812D416863FEA626FD174231FC3E29CD43F38AE22A9D0995D4

Function 004500CD Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 96d664f7d1dcdac2e4e521c84f55a9d3d7349b19ff02ab53d5e08204459e11e7
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 45D16E77C1E9B30A9735812D416813FEA626FD175231EC3E2DCD42F38AD22B5D0996D4

Function 0044FCC1 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 6f375554309336eeac528a7103455ea8478b38036a0b6af1aeedbc017cec44fb
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 8FC17F73C1E9B30AA736812D416822BEE626FD1B5132FC3F28CD43F389D62A5D0995D4

Function 0044F8ED Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 7a65da6bf613f9bb8e473bf5c7591bdcf87583dca7b78087dbc7c6c02012e0b5
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: B6C16E73D1E9B30AA735812D416822BEE626FD174132FC7F28CD43F389D62A9D0996D4

Function 00423CE0 Relevance: 67.0, APIs: 34, Strings: 4, Instructions: 477filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00423D3F
DeleteObject.GDI32(?), ref: 00423D51
GetDesktopWindow.USER32 ref: 00423D7A
GetWindowRect.USER32(00000000), ref: 00423D81
SetRect.USER32(?,00000000,00000000,00000190,00000190), ref: 00423ECA
AdjustWindowRectEx.USER32(?,000001F4,00000000,00000008), ref: 00423EDE
CreateWindowExW.USER32(50000001,AutoIt v3,00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 00423F2D
GetClientRect.USER32(00000000,?), ref: 00423F3A
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00423F7E
CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00423FA2
GetFileSize.KERNEL32(00000000,00000000), ref: 00423FB5
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00423FC2
GlobalLock.KERNEL32(00000000), ref: 00423FCB
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00423FDD
GlobalUnlock.KERNEL32(00000000), ref: 00423FE4
CloseHandle.KERNEL32(00000000), ref: 00423FEB
CreateStreamOnHGlobal.COMBASE(00000000,00000001,000001F4), ref: 00423FF9
OleLoadPicture.OLEAUT32(?,00000000,00000000,00467900,00000008), ref: 0042400F
GlobalFree.KERNEL32(00000000), ref: 00424020
CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 00424049
SendMessageW.USER32(00000190,00000172,00000000,000000FF), ref: 0042406B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020), ref: 00424095
ShowWindow.USER32(00000004), ref: 00424295

Strings

AutoIt v3, xrefs: 00423F24
DISPLAY, xrefs: 004240D4
, xrefs: 00424210
static, xrefs: 00423F74, 004240C9

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteObject$AdjustAllocClientCloseCopyDesktopFreeHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 975859826-2373415609
Opcode ID: 2b09211e7e44bf86d371f8236a2e475e7afdc18bbc51e33279854b6804c54a78
Instruction ID: 5a2b41cacd74cee0eeddb1a309b5794dc4dc712594057e42de9f7c9c30022f30
Opcode Fuzzy Hash: 2b09211e7e44bf86d371f8236a2e475e7afdc18bbc51e33279854b6804c54a78
Instruction Fuzzy Hash: 65F18A71208300AFC7119F65EC89E5F7BA9FBC5718F100A2EF545D62A0DB789944CF6A

Function 00443668 Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 293windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000136,?,?), ref: 004436E6
GetSysColorBrush.USER32(00000005), ref: 004436F7
GetClientRect.USER32(?,?), ref: 00443707
SetViewportOrgEx.GDI32(?,00000000,00000000,?), ref: 0044371A
FillRect.USER32(?,?,?), ref: 00443724
SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00443732

Strings

EDIT, xrefs: 0044395B
COMBOBOX, xrefs: 00443945

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: RectViewport$BrushClientColorFillMessageSend
String ID: COMBOBOX$EDIT
API String ID: 636829656-1358951209
Opcode ID: b7ad24ec7461ab1d5b40876b0c0e816cfad1ba2e24413f9bcc575e5ced6f7742
Instruction ID: f60723e7cb37dd53a6b4b075965b17748cdd00ccdd27f19a6f9731de42e5291e
Opcode Fuzzy Hash: b7ad24ec7461ab1d5b40876b0c0e816cfad1ba2e24413f9bcc575e5ced6f7742
Instruction Fuzzy Hash: 56A1A1B1904109BBEF10AFA4CC49DBF7BB8FB44B16F10452BF511E21A0D7B89A41DB69

Function 0043B281 Relevance: 51.2, APIs: 34, Instructions: 247COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000E), ref: 0043B2C4
SetTextColor.GDI32(?,00000000), ref: 0043B2CC
GetSysColorBrush.USER32(0000000F), ref: 0043B2FF
GetSysColor.USER32(0000000F), ref: 0043B30A
SetBkColor.GDI32(?,?), ref: 0043B321
SelectObject.GDI32(?,?), ref: 0043B32E
InflateRect.USER32(?,000000FF,000000FF), ref: 0043B352
GetSysColor.USER32(00000010), ref: 0043B35A
CreateSolidBrush.GDI32(00000000), ref: 0043B361
FrameRect.USER32(?,?,00000000), ref: 0043B36F
DeleteObject.GDI32(00000000), ref: 0043B376
InflateRect.USER32(?,000000FE,000000FE), ref: 0043B3BA
FillRect.USER32(?,00000000,?), ref: 0043B3E6

Part of subcall function 0043B073: GetSysColor.USER32(0000000E), ref: 0043B096
Part of subcall function 0043B073: SetTextColor.GDI32(?,00000000), ref: 0043B09E
Part of subcall function 0043B073: GetSysColorBrush.USER32(0000000F), ref: 0043B0D4
Part of subcall function 0043B073: GetSysColor.USER32(0000000F), ref: 0043B0E0
Part of subcall function 0043B073: GetSysColor.USER32(00000011), ref: 0043B101
Part of subcall function 0043B073: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0043B113
Part of subcall function 0043B073: SelectObject.GDI32(?,00000000), ref: 0043B125
Part of subcall function 0043B073: SetBkColor.GDI32(?,?), ref: 0043B12D
Part of subcall function 0043B073: SelectObject.GDI32(?,?), ref: 0043B13C
Part of subcall function 0043B073: InflateRect.USER32(?,000000FF,000000FF), ref: 0043B15A
Part of subcall function 0043B073: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0043B175
Part of subcall function 0043B073: SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0043B1A7

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateText$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3518701105-0
Opcode ID: 0533276530adacccae846a56c3da604de840992734d7747995cc1103325c580f
Instruction ID: eacbbd93d290d1305c25667a405b49048293e7a4ccb2cf3444725ab31638cf18
Opcode Fuzzy Hash: 0533276530adacccae846a56c3da604de840992734d7747995cc1103325c580f
Instruction Fuzzy Hash: 91819571904218BFDF009FA4DD48BAE7B79FF09325F105625FA22A61E1DBB49900CFA5

Function 00438922 Relevance: 51.2, APIs: 7, Strings: 22, Instructions: 497windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0046BF68,00000000), ref: 004389C5
IsWindowVisible.USER32(?), ref: 00438A04

Part of subcall function 0040FB8E: VariantClear.OLEAUT32(?), ref: 0040FBA8

Strings

GETLINE, xrefs: 00438F70
ISVISIBLE, xrefs: 004389D5
EDITPASTE, xrefs: 00438F1B
SHOWDROPDOWN, xrefs: 00438B36
UNCHECK, xrefs: 00438DD8
ADDSTRING, xrefs: 00438BAA
TABRIGHT, xrefs: 00438A84
CURRENTTAB, xrefs: 00438ABC
FINDSTRING, xrefs: 00438C38
HIDEDROPDOWN, xrefs: 00438B79
GETCURRENTSELECTION, xrefs: 00438CD9
CHECK, xrefs: 00438DA0
GETLINECOUNT, xrefs: 00438E65
ISENABLED, xrefs: 00438A1C
DELSTRING, xrefs: 00438BF3
GETSELECTED, xrefs: 00438E27
TABLEFT, xrefs: 00438A53
GETCURRENTCOL, xrefs: 00438ED3
SELECTSTRING, xrefs: 00438D15
SETCURRENTSELECTION, xrefs: 00438C91
ISCHECKED, xrefs: 00438D5F
GETCURRENTLINE, xrefs: 00438E92

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: BuffCharClearUpperVariantVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 2091539424-3192792913
Opcode ID: 4e304207229060f6a8fe5b81bfd165573cc00fb733e09b7ae8457d65a9247d37
Instruction ID: 54703a002f8c0825350e3215c3964613f5a77faeef7d7c635890b4e4b9d05a6d
Opcode Fuzzy Hash: 4e304207229060f6a8fe5b81bfd165573cc00fb733e09b7ae8457d65a9247d37
Instruction Fuzzy Hash: 5602B571509341AACB10EB229C1299EFBD5AF84718F145C2FF981671E2CA7CEE49C74B

Function 00431FC8 Relevance: 51.2, APIs: 4, Strings: 25, Instructions: 455COMMON

Download Yara Rule

APIs

__wcsicmp.LIBCMT ref: 00432456
__wcsicmp.LIBCMT ref: 0043249F
__wcsicmp.LIBCMT ref: 004324B2
__wcsicmp.LIBCMT ref: 004324C5

Strings

wparam, xrefs: 0043230F
lparam, xrefs: 004322E3
byte, xrefs: 004321DA
long_ptr, xrefs: 0043249A
int_ptr, xrefs: 004324AD
string, xrefs: 00432008
int, xrefs: 00432078
wstring, xrefs: 0043205D
long, xrefs: 004320DF
hwnd, xrefs: 004322B9
ulong, xrefs: 00432109
short, xrefs: 0043217F
ptr, xrefs: 00432277
ushort, xrefs: 004321AA
dword, xrefs: 0043212E
short_ptr, xrefs: 004324C0
uint64, xrefs: 0043235F
str, xrefs: 00431FD1
ubyte, xrefs: 00432205
double, xrefs: 00432259
uint, xrefs: 004320B2
udword, xrefs: 00432155
wstr, xrefs: 00432032
int64, xrefs: 0043233D
float, xrefs: 0043222E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsicmp
String ID: byte$double$dword$float$hwnd$int$int64$int_ptr$long$long_ptr$lparam$ptr$short$short_ptr$str$string$ubyte$udword$uint$uint64$ulong$ushort$wparam$wstr$wstring
API String ID: 1389419275-2360294291
Opcode ID: e20a7a8c898528fb15959e6307df9106fd5e27b03aaef31268894924e4b980c2
Instruction ID: cc7fb32c10f8ae844be6410042f29a9dd87a4101036cdfb3b37b634852c545a8
Opcode Fuzzy Hash: e20a7a8c898528fb15959e6307df9106fd5e27b03aaef31268894924e4b980c2
Instruction Fuzzy Hash: 43E14471D00A18AFDB62CF69C8406DAF7B2BF49304F1184BAE90CBB250D7B56E858F45

Function 0042E5D8 Relevance: 49.3, APIs: 7, Strings: 21, Instructions: 268COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042E600
_memset.LIBCMT ref: 0042E61A
__time64.LIBCMT ref: 0042E62A

Part of subcall function 00452F3F: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,0041289C,00000000,00000000,?,?,?,00412C3C,?,00000000), ref: 00452F48
Part of subcall function 00452F3F: __aulldiv.LIBCMT ref: 00452F68

Part of subcall function 004538B7: ___getgmtimebuf.LIBCMT ref: 004538B8

Strings

Personal, xrefs: 0042E79A
Common Desktop, xrefs: 0042E7DE
Common Favorites, xrefs: 0042E841
AppData, xrefs: 0042E929
Startup, xrefs: 0042E91A, 0042E972
Start Menu, xrefs: 0042E8DD, 0042E966
ProgramFilesDir, xrefs: 0042E76A
Common AppData, xrefs: 0042E7CC
Favorites, xrefs: 0042E86A, 0042E94E
[, xrefs: 0042E6C2
CommonFilesDir, xrefs: 0042E78E
%.2d, xrefs: 0042E712
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 0042E76F
Common Documents, xrefs: 0042E834
%.3d, xrefs: 0042E75E
Desktop, xrefs: 0042E807, 0042E942
Programs, xrefs: 0042E8A0, 0042E95A
Common Startup, xrefs: 0042E8ED
Common Programs, xrefs: 0042E877
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0042E79F, 0042E7D1, 0042E7E3, 0042E7E8, 0042E80C, 0042E846, 0042E84B, 0042E87C, 0042E881, 0042E8B5, 0042E8BA, 0042E8F2, 0042E8F7, 0042E92E
Common Start Menu, xrefs: 0042E8B0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Time_memset$FileSystem___getgmtimebuf__aulldiv__time64
String ID: %.2d$%.3d$AppData$Common AppData$Common Desktop$Common Documents$Common Favorites$Common Programs$Common Start Menu$Common Startup$CommonFilesDir$Desktop$Favorites$Personal$ProgramFilesDir$Programs$SOFTWARE\Microsoft\Windows\CurrentVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders$Start Menu$Startup$[
API String ID: 336630601-4249181872
Opcode ID: 972029c7e6779dd60ef78ca65297c7fc2769076e231a87d4a9709b905e1645aa
Instruction ID: df3ea55ad96c244b6a8076539f86d5f723fc9f56cd4a72a95d85125ed6c001a6
Opcode Fuzzy Hash: 972029c7e6779dd60ef78ca65297c7fc2769076e231a87d4a9709b905e1645aa
Instruction Fuzzy Hash: BD913BB1E04218FBDB10AA45DC86FDA7278DB40704FA041A7F509731A2C7BD6E85DB5E

Function 0043F7AE Relevance: 42.4, APIs: 22, Strings: 2, Instructions: 445windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 0043F864
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0043F925
SendMessageW.USER32(?,00001102,00000002,00000000), ref: 0043F93C

Strings

,, xrefs: 0043F988
@, xrefs: 0043FD09

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$Window
String ID: ,$@
API String ID: 2326795674-1227015840
Opcode ID: b2bf5e3f4a9a97ad638c3ca0f974d9dcc644e3f846ed250fff31c102546a7694
Instruction ID: 00488ac51f168e85f48a4a41819b5285716db2923b387bdf7ae57f221dd1ae19
Opcode Fuzzy Hash: b2bf5e3f4a9a97ad638c3ca0f974d9dcc644e3f846ed250fff31c102546a7694
Instruction Fuzzy Hash: 1F02E271908305AFEB21CF14C845BABBBE0BF48314F14592EF9959A3E1C778D948CB5A

Function 0040A4BD Relevance: 42.4, APIs: 20, Strings: 4, Instructions: 386windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,00000007,00000000,0000002C), ref: 0040A574
GetMenuItemCount.USER32(0048C258), ref: 0040A606
GetMenuItemCount.USER32(00000000), ref: 0040A690
InsertMenuItemW.USER32(00000000,00000000,00000001,0000002C), ref: 0040A6A7
GetMenuItemCount.USER32(0048CD9C), ref: 0040A74E
InsertMenuItemW.USER32(00000000,00000000,00000001,0000002C), ref: 0040A765
GetMenuItemCount.USER32(00000000), ref: 0040A800
InsertMenuItemW.USER32(00000000,00000000,00000001,0000002C), ref: 0040A817
GetMenuItemCount.USER32(0048CB94), ref: 0040A8BE
InsertMenuItemW.USER32(00000000,00000000,00000001,0000002C), ref: 0040A8D5
DeleteMenu.USER32(0048C258,00000005,00000000,000000F5,?,?,00000000), ref: 0040A910
DeleteMenu.USER32(0048C258,00000004,00000000,?,00000000), ref: 0040A917
DeleteMenu.USER32(0048C258,00000006,00000000,?,00000000), ref: 0040A91E
DeleteMenu.USER32(0048C258,00000003,00000000,?,00000000), ref: 0040A925
GetMenuItemCount.USER32(0048C258), ref: 0040A92D
SetMenuItemInfoW.USER32(0048C258,00000004,00000000,0000002C), ref: 0040A967
GetCursorPos.USER32(?), ref: 0040A971
SetForegroundWindow.USER32(00000000), ref: 0040A97A
TrackPopupMenuEx.USER32(0048C258,00000000,?,?,00000000,00000000,?,00000000), ref: 0040A98D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0040A999

Strings

@, xrefs: 0040A5C7
,, xrefs: 0040A860
2, xrefs: 0040A889
,, xrefs: 0040A4D0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Menu$Item$Count$DeleteInsert$Info$CursorForegroundMessagePopupPostTrackWindow
String ID: ,$,$2$@
API String ID: 4135860720-2197200914
Opcode ID: dca4f05e9d638e47e61285f09b043bc7fe68d0b8eb856ddbcbfd0f23d971bdf1
Instruction ID: f6c71faadf5081e2cd545e52bd7fb6e241f51b226af98ade640f6b89fe65ec49
Opcode Fuzzy Hash: dca4f05e9d638e47e61285f09b043bc7fe68d0b8eb856ddbcbfd0f23d971bdf1
Instruction Fuzzy Hash: 95F1B070900344EFEB21DF68C888B9EBBF5BF04318F14852AE465AB2D0D7B99954CF56

Function 0043B073 Relevance: 40.7, APIs: 27, Instructions: 180windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000E), ref: 0043B096
SetTextColor.GDI32(?,00000000), ref: 0043B09E
GetSysColor.USER32(00000012), ref: 0043B0B8
SetTextColor.GDI32(?,?), ref: 0043B0C0
GetSysColorBrush.USER32(0000000F), ref: 0043B0D4
GetSysColor.USER32(0000000F), ref: 0043B0E0
CreateSolidBrush.GDI32(?), ref: 0043B0EB
GetSysColor.USER32(00000011), ref: 0043B101
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0043B113
SelectObject.GDI32(?,00000000), ref: 0043B125
SetBkColor.GDI32(?,?), ref: 0043B12D
SelectObject.GDI32(?,?), ref: 0043B13C
InflateRect.USER32(?,000000FF,000000FF), ref: 0043B15A
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0043B175
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0043B1A7
GetWindowTextW.USER32(?,00000000,00000001), ref: 0043B1D3
InflateRect.USER32(?,000000FD,000000FD), ref: 0043B1F5
DrawFocusRect.USER32(?,?), ref: 0043B201
GetSysColor.USER32(00000011), ref: 0043B210
SetTextColor.GDI32(?,00000000), ref: 0043B218
DrawTextW.USER32(?,?,000000FF,?,?), ref: 0043B22E
SelectObject.GDI32(?,?), ref: 0043B243
DeleteObject.GDI32(?), ref: 0043B24F
SelectObject.GDI32(?,?), ref: 0043B256
DeleteObject.GDI32(?), ref: 0043B25C
SetTextColor.GDI32(?,?), ref: 0043B263
SetBkColor.GDI32(?,?), ref: 0043B26E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflate$FocusMessageRoundSendSolidWindow
String ID:
API String ID: 1441705042-0
Opcode ID: 85398f20050d7633c1c7966badbb3a5e93d4f8cf590a8cf1c85cb1c316e13ff3
Instruction ID: 3b74116fd13b2b6e60d3972453a419fe497846dcca1a02ba61a3bb4539d5546b
Opcode Fuzzy Hash: 85398f20050d7633c1c7966badbb3a5e93d4f8cf590a8cf1c85cb1c316e13ff3
Instruction Fuzzy Hash: DE518171008304AFD7109F64DD48B6BBBF9FF48764F100A29F666962E1E7B5A804CF66

Function 00424395 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 280windowCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00424499
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 004244D6
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000001), ref: 004244E7
CreateWindowExW.USER32(00000001,AutoIt v3,00000000,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0042452D

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

GetClientRect.USER32(00000000,?), ref: 00424539
CreateWindowExW.USER32(00000000,static,00000000,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 0042457B
GetStockObject.GDI32(00000011), ref: 00424594
SelectObject.GDI32(00000000,00000000), ref: 0042459C
GetTextFaceW.GDI32(00000000,00000040,?), ref: 004245AC
DeleteDC.GDI32(00000000), ref: 004245BF
CreateFontW.GDI32(000000FF,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004245EC
SendMessageW.USER32(00000030,00000000,00000001), ref: 00424603
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00424636
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00424649
SendMessageW.USER32(00000404,00000001,00000000), ref: 00424659
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00424687
GetStockObject.GDI32(00000011), ref: 00424692
SendMessageW.USER32(00000030,00000000), ref: 004246A1
ShowWindow.USER32(00000004), ref: 004246AB

Strings

msctls_progress32, xrefs: 0042462C
AutoIt v3, xrefs: 00424525
DISPLAY, xrefs: 00424580
static, xrefs: 00424575, 00424681

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$CreateMessage$Send$ObjectRect$Stock$AdjustClientDeleteFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 3146017082-517079104
Opcode ID: 4811df5b26621ed0ce3bd37845cd523bdc11ccc9b80c2b88582800375c732b15
Instruction ID: 0ea4e11e3e79c58e147cb1b1b7bcc1d5b0af1ef9540a7792acd9cf9f67e6e92e
Opcode Fuzzy Hash: 4811df5b26621ed0ce3bd37845cd523bdc11ccc9b80c2b88582800375c732b15
Instruction Fuzzy Hash: 38919F72A00219BBDB219FB5DC4AFAF7B79EB85714F10412AF601E61D0D7789940CF68

Function 00406F4A Relevance: 36.9, APIs: 11, Strings: 10, Instructions: 189COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00406F6F
__wcsnicmp.LIBCMT ref: 00406F93
__wcsnicmp.LIBCMT ref: 00406FB0
__wcsicmp.LIBCMT ref: 00406FCE
__wcsnicmp.LIBCMT ref: 0040700C
__wcsnicmp.LIBCMT ref: 00407075
__wcsnicmp.LIBCMT ref: 00407089
__wcsnicmp.LIBCMT ref: 004070D0
__wcsnicmp.LIBCMT ref: 004070E4
__wcsnicmp.LIBCMT ref: 004070F8
__wcsnicmp.LIBCMT ref: 0040710C

Strings

#include, xrefs: 00407006
#comments-start, xrefs: 0040706F, 004070CA
#comments-end, xrefs: 004070F2
#notrayicon, xrefs: 00406F69
Unterminated group of comments, xrefs: 00407151
#ce, xrefs: 00407106
#include-once, xrefs: 00406FAA
Cannot parse #include, xrefs: 00407056
#requireadmin, xrefs: 00406F8D
#cs, xrefs: 00407083, 004070DE

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsnicmp$__wcsicmp
String ID: #ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
API String ID: 3245997131-3491316598
Opcode ID: 8c53a99e159a77eb3c8305982ffbf7191bf33cd9814f51bb302c6f18a69d0df4
Instruction ID: fd8ca7a7d6653f8ebf9a8b55ade8515512f25caea2e0b919a49b948067e8bbee
Opcode Fuzzy Hash: 8c53a99e159a77eb3c8305982ffbf7191bf33cd9814f51bb302c6f18a69d0df4
Instruction Fuzzy Hash: 9D512D31744206AFEB21AA11DC42F6A33A49F15314F10403BFD06BA2C2E77DED1596AF

Function 004187CB Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 138COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 0041881F
LoadStringW.USER32(?,?,00000FFF), ref: 00418832
__swprintf.LIBCMT ref: 0041886D
__swprintf.LIBCMT ref: 00418887
_wcscat.LIBCMT ref: 004188A0
_wcscat.LIBCMT ref: 004188AD
_wcscpy.LIBCMT ref: 004188C3
_wcscat.LIBCMT ref: 004188E0
_wcscat.LIBCMT ref: 004188F3
_wcscat.LIBCMT ref: 00418900
_wcscat.LIBCMT ref: 00418914
_wcscat.LIBCMT ref: 00418927
_printf.LIBCMT ref: 00418956
_printf.LIBCMT ref: 0041896C

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00418951
Error: , xrefs: 0041890E
Line %d:, xrefs: 00418867
==> %s, xrefs: 00418967
Line %d (File "%s"):, xrefs: 00418881
^ ERROR, xrefs: 004188DA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscat$LoadString__swprintf_printf$_wcscpy
String ID: Error: $%s (%d) : ==> %s: %s %s$==> %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 3489144772-3631278857
Opcode ID: 15d3e355fcf6c6fa2a9bd54a7ea35bc469e6ce0e7bacd291fb19b996094feb9d
Instruction ID: ccb4e0e673c022e8bc6463fd1aa55f329a3297598555cddc220932b96b526485
Opcode Fuzzy Hash: 15d3e355fcf6c6fa2a9bd54a7ea35bc469e6ce0e7bacd291fb19b996094feb9d
Instruction Fuzzy Hash: 8E4179B6D00118AADB51EB65CC85FEA777DBB44308F0440BBB648D2151EB789A888F5D

Function 00406424 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 120windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000FFF,00000000,?,00000104,?,00407AEF,?,0000006A,?,0046C758,00000010,00000000), ref: 00406455
LoadStringW.USER32(00000000,?,00407AEF,?), ref: 0040645E
GetModuleHandleW.KERNEL32(00000000,00000104,?,00000FFF,?,00407AEF,?,0000006A,?,0046C758,00000010,00000000,?,00406B57,00000001), ref: 0040646D
LoadStringW.USER32(00000000,?,00407AEF,?), ref: 00406470
__swprintf.LIBCMT ref: 004064A7
__swprintf.LIBCMT ref: 004064C1
_wcscat.LIBCMT ref: 004064D1
_wcscat.LIBCMT ref: 004064E3
_wcscpy.LIBCMT ref: 004064FA
_wcscat.LIBCMT ref: 00406514
_wcscat.LIBCMT ref: 00406527
_wcscat.LIBCMT ref: 00406534
_wcscat.LIBCMT ref: 00406548
_wcscat.LIBCMT ref: 0040655B
_printf.LIBCMT ref: 00406586
MessageBoxW.USER32(00000000,?,?,00011010), ref: 004065A5

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00406581
Error: , xrefs: 00406542
Line %d:, xrefs: 004064A1
Line %d (File "%s"):, xrefs: 004064BB
^ ERROR, xrefs: 0040650E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscat$HandleLoadModuleString__swprintf$Message_printf_wcscpy
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 1706439037-2268648507
Opcode ID: 9476ac9f024a31567de0fb207836f7cfb473fd0fdbb833066b313d042bfcf234
Instruction ID: 18808b91695d2313069144ea207e495185c92113326dd98d35dc705b474eb827
Opcode Fuzzy Hash: 9476ac9f024a31567de0fb207836f7cfb473fd0fdbb833066b313d042bfcf234
Instruction Fuzzy Hash: E54145B2C0411E7ADF10EBA1CC86EFA776CAF04354F0544B7F50992181EB7C9A54CB65

Function 00424755 Relevance: 36.1, APIs: 24, Instructions: 118threadCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 0042476C
LoadCursorW.USER32(00000000,00007F00), ref: 00424777
LoadCursorW.USER32(00000000,00007F03), ref: 00424782
LoadCursorW.USER32(00000000,00007F8B), ref: 0042478D
LoadCursorW.USER32(00000000,00007F01), ref: 00424798
LoadCursorW.USER32(00000000,00007F81), ref: 004247A3
LoadCursorW.USER32(00000000,00007F88), ref: 004247AE
LoadCursorW.USER32(00000000,00007F80), ref: 004247B9
LoadCursorW.USER32(00000000,00007F86), ref: 004247C4
LoadCursorW.USER32(00000000,00007F83), ref: 004247CF
LoadCursorW.USER32(00000000,00007F85), ref: 004247DA
LoadCursorW.USER32(00000000,00007F82), ref: 004247E5
LoadCursorW.USER32(00000000,00007F84), ref: 004247F0
LoadCursorW.USER32(00000000,00007F04), ref: 004247FB
LoadCursorW.USER32(00000000,00007F02), ref: 00424806
GetCursorPos.USER32(?), ref: 0042480F
WindowFromPoint.USER32(?,?), ref: 0042481B
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0042482E
GetCurrentThreadId.KERNEL32 ref: 00424837
AttachThreadInput.USER32(00000000), ref: 0042483A
GetCursor.USER32 ref: 00424840
GetWindowThreadProcessId.USER32(?,00000000), ref: 0042484E
GetCurrentThreadId.KERNEL32 ref: 00424851
AttachThreadInput.USER32(00000000), ref: 00424854

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Cursor$Load$Thread$Window$AttachCurrentInputProcess$FromPoint
String ID:
API String ID: 25922675-0
Opcode ID: 02d165496c3eb0e64a5f070881b5cb90ef7cf5931ef0a421913aac2d4ab67e9e
Instruction ID: df3482417753693c6ce38815068ac3eafb7f32975cf613a9e94272d75589f2ef
Opcode Fuzzy Hash: 02d165496c3eb0e64a5f070881b5cb90ef7cf5931ef0a421913aac2d4ab67e9e
Instruction Fuzzy Hash: A5311070D083197ADF10ABF69C49CAFBEBCEF85B50B10056BF105E7190DAB8A401CE65

Function 004228EF Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 308libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004279C3: LoadLibraryA.KERNEL32(Wininet.dll,004225AF,?,00000000,?,?,?,?,?), ref: 004279CE
Part of subcall function 004279C3: GetProcAddress.KERNEL32(00000000,InternetConnectW), ref: 004279E0

FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,?,?,00000000,00000000), ref: 004229A2

Part of subcall function 004187CB: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 0041881F
Part of subcall function 004187CB: LoadStringW.USER32(?,?,00000FFF), ref: 00418832
Part of subcall function 004187CB: __swprintf.LIBCMT ref: 0041886D
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 004188A0
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 004188AD
Part of subcall function 004187CB: _wcscpy.LIBCMT ref: 004188C3
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 004188E0
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 004188F3
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 00418900
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 00418914
Part of subcall function 004187CB: _wcscat.LIBCMT ref: 00418927

FreeLibrary.KERNEL32(?,0000008C,000000FF,00000000,00000000), ref: 00422949
LoadLibraryA.KERNEL32(Wininet.dll), ref: 00422A3A
GetProcAddress.KERNEL32(00000000,HttpOpenRequestW), ref: 00422A49
LoadLibraryA.KERNEL32(Wininet.dll), ref: 00422AA4
GetProcAddress.KERNEL32(00000000,HttpSendRequestW), ref: 00422AB3
FreeLibrary.KERNEL32(?), ref: 00422B38
FreeLibrary.KERNEL32(?), ref: 00422B42
FreeLibrary.KERNEL32(?), ref: 00422BE3
FreeLibrary.KERNEL32(?), ref: 00422BED
FreeLibrary.KERNEL32(?), ref: 00422C0E
FreeLibrary.KERNEL32(?), ref: 00422C18
FreeLibrary.KERNEL32(?), ref: 00422C41
FreeLibrary.KERNEL32(?), ref: 00422C4B
FreeLibrary.KERNEL32(?), ref: 00422C55
FreeLibrary.KERNEL32(?), ref: 00422C5F

Strings

HttpSendRequestW, xrefs: 00422AAD
Wininet.dll, xrefs: 00422A34, 00422A39, 00422AA3
HttpOpenRequestW, xrefs: 00422A43
, xrefs: 00422AF2

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$Free$_wcscat$Load$AddressProc$String$__swprintf_wcscpy
String ID: $HttpOpenRequestW$HttpSendRequestW$Wininet.dll
API String ID: 1753536495-2827713860
Opcode ID: 045a0c82986c2d19534092c15b5db1876f5aeb385b4a8161e7d2b8201d415307
Instruction ID: 751a41108121307ecda0b9662a7b60f27b1cc92170ceb8a0375a6344560324e3
Opcode Fuzzy Hash: 045a0c82986c2d19534092c15b5db1876f5aeb385b4a8161e7d2b8201d415307
Instruction Fuzzy Hash: A1B15C71E00129BADF11AFA5ED859EEB779BF44304F90402AF510B3211CBB86E81DB69

Function 00439FF5 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 321windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0043A13C
GetDesktopWindow.USER32 ref: 0043A151
GetWindowRect.USER32(00000000), ref: 0043A15E

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0043A21C
SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 0043A23A
SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 0043A261
SendMessageW.USER32(?,00000421,?,?), ref: 0043A276
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 0043A28B
IsWindowVisible.USER32(?), ref: 0043A293
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0043A2AE
SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 0043A2C2
GetWindowRect.USER32(?,?), ref: 0043A2DD
CopyRect.USER32(?,?), ref: 0043A393
FreeLibrary.KERNEL32(00000000), ref: 0043A3E0
FreeLibrary.KERNEL32(00000000), ref: 0043A3ED
SendMessageW.USER32(?,00000412,00000000,00000010), ref: 0043A410

Strings

,, xrefs: 0043A0ED
(, xrefs: 0043A357
tooltips_class32, xrefs: 0043A215

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message$Send$Window$Rect$FreeLibrary$CopyCreateCursorDesktopVisible
String ID: ($,$tooltips_class32
API String ID: 707417996-3320066284
Opcode ID: 2368569dffee9a7fe49dda09d731e8d3920df7213c47799bbca1dfd3ffa4b4ee
Instruction ID: dfa72f44a824a53eb9f7c4943b7ea511967b4a7f7db1d6f453af2dfa1755c6d4
Opcode Fuzzy Hash: 2368569dffee9a7fe49dda09d731e8d3920df7213c47799bbca1dfd3ffa4b4ee
Instruction Fuzzy Hash: DBC1A0715483009EEB10EF65C845B5FBBE4EF88708F10092EF985E62A1DB789949CF5B

Function 0043BACC Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 287windowtimeCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,00040000), ref: 0043BBD8
GetClientRect.USER32(?,00000000), ref: 0043BBE3
GetSystemMetrics.USER32(00000007), ref: 0043BBF1
GetSystemMetrics.USER32(00000008), ref: 0043BBFB
GetSystemMetrics.USER32(00000004), ref: 0043BC02
SystemParametersInfoW.USER32(00000030,00000000,00040000,00000000), ref: 0043BC37
GetSystemMetrics.USER32(00000007), ref: 0043BC3F
SystemParametersInfoW.USER32(00000030,00000000,00040000,00000000), ref: 0043BC67
GetSystemMetrics.USER32(00000008), ref: 0043BC6F
GetSystemMetrics.USER32(00000004), ref: 0043BC95
SetRect.USER32(00040000,00000000,00000000,?,00000000), ref: 0043BCB1
AdjustWindowRectEx.USER32(00040000,00040000,00000000,?), ref: 0043BCC2
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,00040000,?,00000000,00040000,00000000,?,00000000,00000000), ref: 0043BCF5
GetSysColorBrush.USER32(0000000F), ref: 0043BD17
SetClassLongW.USER32(00000000,000000F6,00000000), ref: 0043BD22
GetStockObject.GDI32(00000011), ref: 0043BD2B
SendMessageW.USER32(00000000,00000030,00000000), ref: 0043BD36
SetTimer.USER32(00000000,00000002,00000028,00444A40), ref: 0043BE40

Strings

AutoIt v3 GUI, xrefs: 0043BCED

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: System$Metrics$Rect$Window$InfoParameters$AdjustBrushClassClientColorCreateLongMessageObjectSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1781331807-248962490
Opcode ID: ecb83d5b4f238292c0ab2f7b1202605a0c8645312d1f5b2e486c565de6485544
Instruction ID: a91afc32010e76df554ac7acab5fe93f962c83334b07bc691fbbb7f8590d8c6c
Opcode Fuzzy Hash: ecb83d5b4f238292c0ab2f7b1202605a0c8645312d1f5b2e486c565de6485544
Instruction Fuzzy Hash: 94C148B1900709DFDB20DF69C885ADBBBF4FB58304F10492EE7AA92250D778A950CF59

Function 004551E3 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 0045524F
__invoke_watson.LIBCMT ref: 00455260
GetModuleFileNameA.KERNEL32(00000000,00478AA9,00000104), ref: 0045527C
_strcpy_s.LIBCMT ref: 00455291
__invoke_watson.LIBCMT ref: 004552A4
_strlen.LIBCMT ref: 004552AD
_strlen.LIBCMT ref: 004552BA
__invoke_watson.LIBCMT ref: 004552E7
_strcat_s.LIBCMT ref: 004552FA
__invoke_watson.LIBCMT ref: 0045530B
_strcat_s.LIBCMT ref: 0045531C
__invoke_watson.LIBCMT ref: 0045532D
GetStdHandle.KERNEL32(000000F4,?,?,00000000,76EC5E70,00000003,004553AF,000000FC,00450B11,00000001,00000000,00000000,?,00456F44,?,00000001), ref: 0045534C
_strlen.LIBCMT ref: 0045536D
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,00456F44,?,00000001,?,004554BC,00000018,00472858,0000000C,0045554B,?), ref: 00455377

Strings

..., xrefs: 004552CB
Runtime Error!Program: , xrefs: 0045523E
Microsoft Visual C++ Runtime Library, xrefs: 0045533A
<program name unknown>, xrefs: 00455286

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: aa87b010eddb3fa176b5ab8e96c83ae5417a720fe101bd15f254419da4b61a71
Instruction ID: 1d82004233294e0a924edc4c587be4b3fb32911c013675b12b2cf0eec8b8e010
Opcode Fuzzy Hash: aa87b010eddb3fa176b5ab8e96c83ae5417a720fe101bd15f254419da4b61a71
Instruction Fuzzy Hash: 013129629407113AE62032759C5BF7F360D9B1139BF14012BFD0DA1693FA9D994886FF

Function 004189B9 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 129COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00418A0D
LoadStringW.USER32(00000000,?,00000FFF), ref: 00418A20
__swprintf.LIBCMT ref: 00418A5B
__swprintf.LIBCMT ref: 00418A6F
_wcscat.LIBCMT ref: 00418A8A
_wcscat.LIBCMT ref: 00418A99
_wcscat.LIBCMT ref: 00418AA6
_wcscat.LIBCMT ref: 00418ABA
_wcscat.LIBCMT ref: 00418ACD
_wcscat.LIBCMT ref: 00418ADE
_wcscat.LIBCMT ref: 00418AF6
_printf.LIBCMT ref: 00418B22
_printf.LIBCMT ref: 00418B32

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00418B1D
Error: , xrefs: 00418AB4
Line %d (File "%s"):, xrefs: 00418A69
Line %d:, xrefs: 00418A55
==> %s, xrefs: 00418B2D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscat$LoadString__swprintf_printf
String ID: Error: $%s (%d) : ==> %s: %s %s$==> %s$Line %d (File "%s"):$Line %d:
API String ID: 3162818975-1269900534
Opcode ID: 47041d88fa9be1c24c53dd10df38261f204719b9419588098f5fa5b15ce4ad00
Instruction ID: 37da118907ff02b030625a89f57623f55f5ee40260ab4738ac99cc4e49722fe9
Opcode Fuzzy Hash: 47041d88fa9be1c24c53dd10df38261f204719b9419588098f5fa5b15ce4ad00
Instruction Fuzzy Hash: D341B7B6D04218BADF11EB61CC46FDA7B7CAF05304F0440BBB608A6151EA7D9A84CB59

Function 00431175 Relevance: 31.9, APIs: 21, Instructions: 412COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000), ref: 00431257
FreeLibrary.KERNEL32(?,00000000), ref: 00431263
FreeLibrary.KERNEL32(?,00000000), ref: 0043126F
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004312C0

Part of subcall function 0040DAA5: LoadLibraryA.KERNEL32(Psapi.dll,0040BE93,00000000,75920F00,0048BA08,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040DAB0
Part of subcall function 0040DAA5: GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0040DAC2

_wcscat.LIBCMT ref: 00431361
__wcsicmp.LIBCMT ref: 00431388
CloseHandle.KERNEL32(?), ref: 004313AF
FreeLibrary.KERNEL32(?), ref: 004313D9
FreeLibrary.KERNEL32(?), ref: 004313E5
FreeLibrary.KERNEL32(?,00000000), ref: 00431417
FreeLibrary.KERNEL32(?,00000000), ref: 00431423
FreeLibrary.KERNEL32(?,00000000), ref: 0043142F

Part of subcall function 0040D9E9: LoadLibraryA.KERNEL32(kernel32.dll,0040BCD1,75920F00,0048BA08), ref: 0040D9F4
Part of subcall function 0040D9E9: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0040DA06

_wcscat.LIBCMT ref: 0043150D
__wcsicmp.LIBCMT ref: 00431534
CloseHandle.KERNEL32(00000000), ref: 00431586
FreeLibrary.KERNEL32(?), ref: 0043159E
FreeLibrary.KERNEL32(?), ref: 004315AA
FreeLibrary.KERNEL32(?), ref: 004315B6
FreeLibrary.KERNEL32(?,00000000), ref: 00431694
FreeLibrary.KERNEL32(?,00000000), ref: 004316A0
FreeLibrary.KERNEL32(?,00000000), ref: 004316AC

Part of subcall function 0040DA18: LoadLibraryA.KERNEL32(kernel32.dll,0040BCE1,75920F00,0048BA08), ref: 0040DA23
Part of subcall function 0040DA18: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0040DA35

Part of subcall function 0040DA47: LoadLibraryA.KERNEL32(kernel32.dll,0040BCF1,75920F00,0048BA08), ref: 0040DA52
Part of subcall function 0040DA47: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0040DA64

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$Free$AddressLoadProc$CloseHandle__wcsicmp_wcscat$OpenProcess
String ID:
API String ID: 3831895178-0
Opcode ID: dcbe2c8e1b939942e55c476014c7e0364b28b707ef0b7463df4401f07287a179
Instruction ID: 03cd494afa5a765d585dd5ef8c0b25e968e3e5ed9b9d9d2a4b12c3e33150d926
Opcode Fuzzy Hash: dcbe2c8e1b939942e55c476014c7e0364b28b707ef0b7463df4401f07287a179
Instruction Fuzzy Hash: 94E1A072908300ABDB11DF55C841A9FB7E4EFC8314F04192FF985A31A1DB79E949CB5A

Function 00438FD6 Relevance: 31.9, APIs: 5, Strings: 13, Instructions: 377COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0043903F

Strings

GETTEXT, xrefs: 004390F9
ISSELECTED, xrefs: 00439198
GETITEMCOUNT, xrefs: 00439071
SELECTALL, xrefs: 004391F9
DESELECT, xrefs: 004392FC
FINDITEM, xrefs: 004393C1
VIEWCHANGE, xrefs: 00439424
SELECT, xrefs: 00439265
GETSUBITEMCOUNT, xrefs: 004390AC
GETSELECTED, xrefs: 0043935F
SELECTCLEAR, xrefs: 0043922F
GETSELECTEDCOUNT, xrefs: 00439157
SELECTINVERT, xrefs: 004392C3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3964851224-719923060
Opcode ID: 4e6766cc0e1f86fa91a8799184e7e7b3c8a0ceb20031f8465bbae226c62bfe6c
Instruction ID: 0f57f213e1708bb5bd0a3a5e3a29f3ccfea9ac9a17a1fe83503b9d738c2f31ca
Opcode Fuzzy Hash: 4e6766cc0e1f86fa91a8799184e7e7b3c8a0ceb20031f8465bbae226c62bfe6c
Instruction Fuzzy Hash: 4BC1C531508340AADA10EB769C5299FB794AF84718F144D2FF941771D2CABCAE0D8B9F

Function 00440787 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 205windowlibraryCOMMON

Download Yara Rule

APIs

__wcsicmp.LIBCMT ref: 004407C2
__wcsicmp.LIBCMT ref: 004407E3
__wcsicmp.LIBCMT ref: 00440804

Part of subcall function 0044E8B8: __wcsicmp_l.LIBCMT ref: 0044E93E

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00440834
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,00440762,?,?,?,?,?,0041F974,00000000,00000001), ref: 00440846
LoadImageW.USER32(?,00000000,00000001,?,?,00000000), ref: 0044087C
LoadImageW.USER32(?,00440762,00000001,?,?,00000000), ref: 0044089A
LoadImageW.USER32(00000000,00440762,00000001,?,?,00000000), ref: 004408B6
LoadImageW.USER32(?,00000000,00000001,?,?,00000000), ref: 004408DD
FreeLibrary.KERNEL32(?), ref: 004408EC
ExtractIconExW.SHELL32(?,00440762,00000000,?,00000001), ref: 00440931
DestroyCursor.USER32(?), ref: 0044093F
SendMessageW.USER32(?,00000170,?,00000000), ref: 0044095E
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0044096C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?,00440762,?,?,?,?,?,0041F974), ref: 00440987

Strings

.icl, xrefs: 004407B1
.dll, xrefs: 004407F0
.exe, xrefs: 004407CF

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Load$Image$__wcsicmp$LibraryMessageSend$CursorDestroyExtractFreeIconMoveWindow__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 2821903103-1154884017
Opcode ID: 7d48020d39262bea8e721651114f332967cc79a1594fdca158e3498eb661bc7a
Instruction ID: f23d337d68f157dae9fc308fb83934582488931c6bf3bbfdc20c18e53da4982e
Opcode Fuzzy Hash: 7d48020d39262bea8e721651114f332967cc79a1594fdca158e3498eb661bc7a
Instruction Fuzzy Hash: 3B6194B1804219BEFF10AFA4DC819BE7BBCFB08704F10406BFA01E6181D7799995CBA5

Function 00403886 Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 116COMMON

Download Yara Rule

APIs

__wcsicmp.LIBCMT ref: 004038B3
__wcsicmp.LIBCMT ref: 004038CA
__wcsnicmp.LIBCMT ref: 004038EB

Strings

LAST, xrefs: 004038AD
[CLASS:, xrefs: 0040393E
[HANDLE:, xrefs: 004038F7
HANDLE=, xrefs: 004038E5
CLASSNAME=, xrefs: 0040392C
[ALL, xrefs: 00403991
REGEXP=, xrefs: 00403901
ACTIVE, xrefs: 004038C4
ALL, xrefs: 00403980
[REGEXPTITLE:, xrefs: 00403913
[ACTIVE, xrefs: 004038D5
[LAST, xrefs: 00403998

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsicmp$__wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 74746167-1810252412
Opcode ID: fcc990ed5dd8eae4cb7ffa56fd23780aa9e2265bfd48453e38632b54edf34e1e
Instruction ID: d97a053ce6c8fe7af3a1ff5c8caad3a4ae0f237680b571b49196cb039ded1fb4
Opcode Fuzzy Hash: fcc990ed5dd8eae4cb7ffa56fd23780aa9e2265bfd48453e38632b54edf34e1e
Instruction Fuzzy Hash: AE318971B44204B6EB10FAE7DC83E9E77AC9F01719B20443BF940B21C2F67DAA44865E

Function 00454D93 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00453D46), ref: 00454D99
__mtterm.LIBCMT ref: 00454DA5

Part of subcall function 00454A7E: TlsFree.KERNEL32(00000017,00454F12), ref: 00454AA9
Part of subcall function 00454A7E: RtlDeleteCriticalSection.NTDLL(00000000), ref: 00455420
Part of subcall function 00454A7E: RtlDeleteCriticalSection.NTDLL(00000017), ref: 0045544A

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00454DBB
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00454DC8
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00454DD5
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00454DE2
TlsAlloc.KERNEL32 ref: 00454E32
TlsSetValue.KERNEL32(00000000), ref: 00454E4D
__init_pointers.LIBCMT ref: 00454E57
__calloc_crt.LIBCMT ref: 00454ECC
GetCurrentThreadId.KERNEL32 ref: 00454EFC

Strings

KERNEL32.DLL, xrefs: 00454D94
FlsAlloc, xrefs: 00454DB5
FlsFree, xrefs: 00454DD7
FlsGetValue, xrefs: 00454DBD
FlsSetValue, xrefs: 00454DCA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: a91f65bf8ae03dbad21a79275e2f26f6042d89102eac341d9598e3ba631a69d3
Instruction ID: 9d68b90e921f3db3b4a9f1b86605ec15c038b20e339c970240df50b602b87da7
Opcode Fuzzy Hash: a91f65bf8ae03dbad21a79275e2f26f6042d89102eac341d9598e3ba631a69d3
Instruction Fuzzy Hash: DD31A9724843119BD7216F75AC0D6063BA8AB8436E714053FFC1D9AAB2EF7884C4DB5D

Function 0040C2D6 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 172COMMON

Download Yara Rule

APIs

74D315C0.VERSION(?,?), ref: 0040C2E4
_wcscpy.LIBCMT ref: 0040C337
_wcscat.LIBCMT ref: 0040C354
_wcscat.LIBCMT ref: 0040C3B7
_wcscat.LIBCMT ref: 0040C3BE
__wcsicmp.LIBCMT ref: 0040C3D7
_wcsncpy.LIBCMT ref: 0040C3EC

Strings

DefaultLangCodepage, xrefs: 0040C3D1
StringFileInfo\, xrefs: 0040C34E
%u.%u.%u.%u, xrefs: 0040C449
04090000, xrefs: 0040C3A8
\VarFileInfo\Translation, xrefs: 0040C36F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscat$D315__wcsicmp_wcscpy_wcsncpy
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 4078815740-1459072770
Opcode ID: 87c3c7b899783373cba4421efe3a5b675310fdc4e141698decda28053c332d86
Instruction ID: 3889e43d95ee9682a2cb71e3f36a495663fbd813d4dd37edec1d3fd37c37b6db
Opcode Fuzzy Hash: 87c3c7b899783373cba4421efe3a5b675310fdc4e141698decda28053c332d86
Instruction Fuzzy Hash: D041B272500204BAFB00AB669CC3DBF776CEF41324B14452FFD05A61C2EB3DAA01966D

Function 00448BFB Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 488COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00448CF0
_strncmp.LIBCMT ref: 00448D1B
_strncmp.LIBCMT ref: 00448D3A
_strncmp.LIBCMT ref: 00448D59
_strncmp.LIBCMT ref: 00448D78
_strncmp.LIBCMT ref: 00448D9A
_strncmp.LIBCMT ref: 00448DFC
_strlen.LIBCMT ref: 00448EA8

Strings

LF), xrefs: 00448D15
BSR_UNICODE), xrefs: 00448DF6
CR), xrefs: 00448CEA
ANYCRLF), xrefs: 00448D72
ANY), xrefs: 00448D53
BSR_ANYCRLF), xrefs: 00448D94
CRLF), xrefs: 00448D34

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _strncmp$_strlen
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)
API String ID: 1402201865-501577721
Opcode ID: 16a32c2625ddbfff33df8d753e8f921b7cc07b9171a2e576bee7499a265dcd30
Instruction ID: 5d6a6b1c2e7de474ffc98797f4a540a4a617867c62fe29d48610db23a7de32cc
Opcode Fuzzy Hash: 16a32c2625ddbfff33df8d753e8f921b7cc07b9171a2e576bee7499a265dcd30
Instruction Fuzzy Hash: 57129CB1D00209ABEB21CF98C884BEEBBF4AF14304F24415FE855E7281E7789E45DB59

Function 004013FE Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 241COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\regsvr.exe,00000104,?,00000104), ref: 0040143E

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

__wcsicmp.LIBCMT ref: 00401546
__wcsicmp.LIBCMT ref: 0040156F
__wcsicmp.LIBCMT ref: 00401598
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\regsvr.exe,00000104,?,?,?,00000000,?,?,00000100,CMDLINE,00000000,00000000,?,?,00000001), ref: 004015BA

Part of subcall function 0040E27C: MessageBoxA.USER32(00000000,AStack: top(): Out of bounds.,Fatal Error,00000010), ref: 0040E28F

__wcsicmp.LIBCMT ref: 004015F4
_wcscpy.LIBCMT ref: 00401615
_wcscpy.LIBCMT ref: 0040163A

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 00401437, 0040143C, 004015B1, 004015E7, 00401614, 0040162D, 00401639
/AutoIt3ExecuteScript, xrefs: 004015EF
/ErrorStdOut, xrefs: 00401541
CMDLINE, xrefs: 004014BB, 004014FE
CMDLINERAW, xrefs: 00401474
/AutoIt3ExecuteLine, xrefs: 00401593
/AutoIt3OutputDebug, xrefs: 0040156A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsicmp$FileModuleName_wcscpy$Message_malloc
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\Users\user\Desktop\regsvr.exe$CMDLINE$CMDLINERAW
API String ID: 2926296014-1559103961
Opcode ID: 56d8d6a0d69f4c8fcfad1f0d5d44e947697b4a62802a192e1416724999e6818a
Instruction ID: 8baaea8769b03da17686fea3c2718552191f02dec867cb6267ff56e3343e8ccc
Opcode Fuzzy Hash: 56d8d6a0d69f4c8fcfad1f0d5d44e947697b4a62802a192e1416724999e6818a
Instruction Fuzzy Hash: 10817172D40209AEDF11FBA6DC429DEBB78EF44318F10443BF600B61E2DB7995858B99

Function 00406339 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000100,?,00406F25,?,?,?,Unterminated string,?), ref: 00406356
LoadStringW.USER32(00000000,?,00406F25,?), ref: 0040635D
_printf.LIBCMT ref: 00406382
__swprintf.LIBCMT ref: 004063A4
_wcscat.LIBCMT ref: 004063CC
_wcscat.LIBCMT ref: 004063DD
_wcscat.LIBCMT ref: 004063EC
_wcscat.LIBCMT ref: 004063FD
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0040641A

Strings

Error: , xrefs: 004063D7
Line %d:, xrefs: 0040639E
., xrefs: 004063F7
%s (%d) : ==> %s.: %s %s, xrefs: 0040637D
Line %d (File "%s"):, xrefs: 004063B4

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscat$HandleLoadMessageModuleString__swprintf_printf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 2694856617-4153970271
Opcode ID: e17a6d26f222d3779a490a25de55361a281bafd17fa1d6a413b55399a5a50f9d
Instruction ID: e151ed4fb6ffda387a16dc85b2441e9dce5ada2fe4fbde2f1c543733043571ba
Opcode Fuzzy Hash: e17a6d26f222d3779a490a25de55361a281bafd17fa1d6a413b55399a5a50f9d
Instruction Fuzzy Hash: CB21997190020EBBDF11FFD1CC4BFDA3768AB04304F048497FA14A1192E6B99664DB6A

Function 00404EEA Relevance: 25.7, APIs: 17, Instructions: 183windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(000000A1), ref: 00404EFD
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00404F0F
SetWindowTextW.USER32(?,?), ref: 00404F20
GetDlgItem.USER32(?,000003EA), ref: 00404F39
SetWindowTextW.USER32(00000000,?), ref: 00404F3F
GetDlgItem.USER32(?,000003E9), ref: 00404F54
SetWindowTextW.USER32(00000000,?), ref: 00404F5A
SendDlgItemMessageW.USER32(000003E9,000003E9,000000CC,?,00000000), ref: 00404F7E
SendDlgItemMessageW.USER32(000003E9,000003E9,000000C5,?,00000000), ref: 00404F93
GetWindowRect.USER32(?,?), ref: 00404F9C
SetWindowTextW.USER32(?,?), ref: 0040502C
GetDesktopWindow.USER32 ref: 00405036
GetWindowRect.USER32(00000000), ref: 0040503D
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00405089
GetClientRect.USER32(?,?), ref: 00405096
PostMessageW.USER32(?,00000005,00000000,?), ref: 004050BB
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 004050E6

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 45e913b3e83ba03e4089e82c3362d87de76d298c38a88d8c2b64e9d937621f74
Instruction ID: 4e8b0a2e980f2a70a03bb40557044616ecd6405306d1f05948111485336c3ef2
Opcode Fuzzy Hash: 45e913b3e83ba03e4089e82c3362d87de76d298c38a88d8c2b64e9d937621f74
Instruction Fuzzy Hash: DE615A71A0061ABFDB109FA9DC48B9EBBB8FB08345F004166F605F25A0D775B961CF94

Function 004394AC Relevance: 24.8, APIs: 3, Strings: 11, Instructions: 341windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0043951A
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00439585

Strings

GETITEMCOUNT, xrefs: 004396A6
GETTEXT, xrefs: 0043973F
GETTOTALCOUNT, xrefs: 0043954C
COLLAPSE, xrefs: 004395CE
SELECT, xrefs: 0043982B
EXISTS, xrefs: 00439603
CHECK, xrefs: 00439599
EXPAND, xrefs: 00439656
GETSELECTED, xrefs: 004396F1
UNCHECK, xrefs: 00439874
ISCHECKED, xrefs: 004397C1

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 02a3fad684b6108baf82588eb52a400f963381795ba7a4c90274b67bf3a4085f
Instruction ID: c2b1a124e3249057a2f65bede07fb55ca5e135e7cc4637c685c7e7daefab9227
Opcode Fuzzy Hash: 02a3fad684b6108baf82588eb52a400f963381795ba7a4c90274b67bf3a4085f
Instruction Fuzzy Hash: E6B1C5316083406ADA10BB369856B5EB7D5AF84718F044C3FF981B72D2DABC9E09875F

Function 00460668 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,00478A90,00455345,00478A90,Microsoft Visual C++ Runtime Library,00012010), ref: 00460695
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004606B1

Part of subcall function 0045492A: TlsGetValue.KERNEL32(00000000,0045499F,00000000,00460676,00000000,00000000,00000314,?,?,?,00478A90,00455345,00478A90,Microsoft Visual C++ Runtime Library,00012010), ref: 00454937
Part of subcall function 0045492A: TlsGetValue.KERNEL32(00000006,?,?,?,00478A90,00455345,00478A90,Microsoft Visual C++ Runtime Library,00012010), ref: 0045494E

GetProcAddress.KERNEL32(00000000,00000000), ref: 004606CE

Part of subcall function 0045492A: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00478A90,00455345,00478A90,Microsoft Visual C++ Runtime Library,00012010), ref: 00454963
Part of subcall function 0045492A: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0045497E

GetProcAddress.KERNEL32(00000000,00000000), ref: 004606E3
__invoke_watson.LIBCMT ref: 00460704

Part of subcall function 00454F21: _memset.LIBCMT ref: 00454FAD
Part of subcall function 00454F21: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 00454FD5
Part of subcall function 00454F21: UnhandledExceptionFilter.KERNEL32(00478A90,?,?,00000000), ref: 00454FDF
Part of subcall function 00454F21: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 00454FFA
Part of subcall function 00454F21: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00455001

Part of subcall function 004549A1: TlsGetValue.KERNEL32(00000000,00454A51,?,0045321E), ref: 004549AE
Part of subcall function 004549A1: TlsGetValue.KERNEL32(00000006,?,0045321E), ref: 004549C5

Part of subcall function 004549A1: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0045321E), ref: 004549DA
Part of subcall function 004549A1: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004549F5

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00460718
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00460730
__invoke_watson.LIBCMT ref: 004607A3

Strings

GetLastActivePopup, xrefs: 004606D6
GetUserObjectInformationA, xrefs: 00460712
USER32.DLL, xrefs: 00460690
GetActiveWindow, xrefs: 004606C1
GetProcessWindowStation, xrefs: 0046072A
MessageBoxA, xrefs: 004606AB

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentLibraryLoadTerminate_memset
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3396755237-232180764
Opcode ID: 57a44964ac64d5b11d8b1c4044489f767c09f84903454ab62b6a2c21a82893ad
Instruction ID: 317ab2de07a184bf9ed46fd5c37fab9b7c3e79e5134d6e8e902db75470fe0d6b
Opcode Fuzzy Hash: 57a44964ac64d5b11d8b1c4044489f767c09f84903454ab62b6a2c21a82893ad
Instruction Fuzzy Hash: 8D4177B1904209BADF14BFB59D8695F7BA8EF4431AF10087FE404D6152FB3899C48A5F

Function 0040D4F7 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 72COMMON

Download Yara Rule

APIs

__wcsicmp.LIBCMT ref: 0040D507
__wcsicmp.LIBCMT ref: 0040D51C
__wcsicmp.LIBCMT ref: 0040D531

Strings

MIDDLE, xrefs: 0040D52B
PRIMARY, xrefs: 0040D56A
LEFT, xrefs: 0040D501
RIGHT, xrefs: 0040D516
SECONDARY, xrefs: 0040D57F
MAIN, xrefs: 0040D540
MENU, xrefs: 0040D555

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsicmp
String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
API String ID: 1389419275-4202584635
Opcode ID: dc929546045c7104619eacdf44a17ef7b863ab2511e8f23ede725b48b707e6c7
Instruction ID: 8057e5b7c29695faab4cceaa99c9a4802369ae5119d862717dd59953e0cbe8e0
Opcode Fuzzy Hash: dc929546045c7104619eacdf44a17ef7b863ab2511e8f23ede725b48b707e6c7
Instruction Fuzzy Hash: EB0148626DA70038FE2972B6AC13BAB02989B51B3BF30012FF940E50C5FF5E9605504E

Function 00410321 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 395timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040FB8E: VariantClear.OLEAUT32(?), ref: 0040FBA8

VariantCopy.OLEAUT32(00000000,0042983F), ref: 0041037E
VariantClear.OLEAUT32(00000000), ref: 0041038E
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 004103FC
__swprintf.LIBCMT ref: 00410429
VarR4FromDec.OLEAUT32(?,0042983F), ref: 00410448
VariantInit.OLEAUT32(00000000), ref: 0041064C
VariantCopy.OLEAUT32(00000000,0042983F), ref: 00410655
VariantClear.OLEAUT32(00000000), ref: 00410665
SafeArrayAccessData.OLEAUT32(C1EC4D8B,00000000), ref: 0041067F
SafeArrayAccessData.OLEAUT32(C1EC4D8B,?), ref: 004106F9
SafeArrayAccessData.OLEAUT32(C1EC4D8B,?), ref: 00410766
SafeArrayUnaccessData.OLEAUT32(C1EC4D8B), ref: 004107C7

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00410423

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Variant$ArrayDataSafe$AccessClear$CopyTime$FromInitSystemUnaccess__swprintf
String ID: %4d%02d%02d%02d%02d%02d
API String ID: 32631658-1568723262
Opcode ID: 2b8bc5bbc800b56403a2da82b8ccf884d14755505377944e4c038d112345b3fa
Instruction ID: 0a53b11e712b3718507fe26e3e3bd42dc4545f3d970e85883008e37ac446a216
Opcode Fuzzy Hash: 2b8bc5bbc800b56403a2da82b8ccf884d14755505377944e4c038d112345b3fa
Instruction Fuzzy Hash: CBE19B70600211EFDB10DF6AC484BAAB7B5BF05704F1484AAE856DB2A1D7B8ECC1DF59

Function 0041C6F4 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

CharLowerBuffW.USER32(?,?), ref: 0041C73F
GetDriveTypeW.KERNEL32(?,open,close), ref: 0041C7BE
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0041C82A
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0041C858
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0041C87A

Strings

open , xrefs: 0041C7FB
open, xrefs: 0041C77B
closed, xrefs: 0041C76B, 0041C772, 0041C79D
wait, xrefs: 0041C846
type cdaudio alias cd wait, xrefs: 0041C812
set cd door , xrefs: 0041C830
close, xrefs: 0041C745
close cd wait, xrefs: 0041C867

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerMessageType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2211858068-4113822522
Opcode ID: e759f7d6bbdbb16698bfb4315c44b07ade8e0f1fa8f4f0f04223affbd9afef47
Instruction ID: 6c5257b6ec700783efadaf7baaaee008c686eabfce340e565260301087c3ce98
Opcode Fuzzy Hash: e759f7d6bbdbb16698bfb4315c44b07ade8e0f1fa8f4f0f04223affbd9afef47
Instruction Fuzzy Hash: C041D472900259AADF01BBB2DC919EE7B75EF40758B10883BF810771D2EB7C9E458B58

Function 0043E4F9 Relevance: 21.4, APIs: 14, Instructions: 424windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001308,?,00000000), ref: 0043E59D
DeleteObject.GDI32(?), ref: 0043EA1A
DeleteObject.GDI32(?), ref: 0043EA24
DestroyCursor.USER32(?), ref: 0043EA2E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: DeleteObject$CursorDestroyMessageSend
String ID:
API String ID: 2743624342-0
Opcode ID: 4ecfba3a1a4699e3378cf87a9f81c863a6aea31db3fb579d2d41a6e2682bebb6
Instruction ID: f7229816c0aaf798ac1b5cfac2ee67e9f65f11b14df41f1edbf78cc30dc7d1e9
Opcode Fuzzy Hash: 4ecfba3a1a4699e3378cf87a9f81c863a6aea31db3fb579d2d41a6e2682bebb6
Instruction Fuzzy Hash: 49F1BC70205741AFDB20EF26C888B67B7E0BF18314F14195AE5A2C76E1D338E885CB5A

Function 0043DCA6 Relevance: 21.2, APIs: 14, Instructions: 211windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000143,000000FF), ref: 0043DDA1
SendMessageW.USER32(0000014B,0000014B,00000000,00000000), ref: 0043DDB3
CharNextW.USER32(?,?,00000143,000000FF,?,0041FDAC), ref: 0043DDE6
SendMessageW.USER32(0000014B,0041FDAC,00000000,00000000), ref: 0043DDFC
SendMessageW.USER32(0000014B,?,00000000,?), ref: 0043DE17
SendMessageW.USER32(0000014B,00000143,000000FF,00000000), ref: 0043DE46
SendMessageW.USER32(0000014B,0000014B,00000000,00000000), ref: 0043DE5C
SendMessageW.USER32(?,000000C2,00000001), ref: 0043DE7B
SendMessageW.USER32(0000014B,00001002,00000000,?), ref: 0043DF14
SendMessageW.USER32 ref: 0043E16D
InvalidateRect.USER32(0041FDAC,00000000,00000001), ref: 0043E18B
SetWindowTextW.USER32 ref: 0043E241

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$CharInvalidateNextRectTextWindow
String ID:
API String ID: 2270220186-0
Opcode ID: d756a9f7446d9df098ef97ead8a5f0e769d94820e650de9758e42f09c51ce64b
Instruction ID: 71575e49528c5db37b8b99981aa3aa767182ade2916124aeefa16e3c595376f1
Opcode Fuzzy Hash: d756a9f7446d9df098ef97ead8a5f0e769d94820e650de9758e42f09c51ce64b
Instruction Fuzzy Hash: C171E371508300AFE7208F11DC44B6BBBE9BF4D718F101A6FF595A62E0C7B89905DB5A

Function 0041BFB7 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041BFE0
_memset.LIBCMT ref: 0041BFF9
CoInitialize.OLE32(00000000), ref: 0041C009
SHGetMalloc.SHELL32(?), ref: 0041C016
SHGetDesktopFolder.SHELL32(?), ref: 0041C086
_wcscpy.LIBCMT ref: 0041C0AA
_wcscpy.LIBCMT ref: 0041C107
_wcscpy.LIBCMT ref: 0041C13C
SHBrowseForFolderW.SHELL32(?), ref: 0041C159
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0041C17C

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

CoUninitialize.COMBASE ref: 0041C1C8

Strings

@, xrefs: 0041C052

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocMessagePathUninitialize
String ID: @
API String ID: 2954865823-2766056989
Opcode ID: cb5d83b83f134cffb1941c8b7e24cbf8fff3535e222c16a22082972738369067
Instruction ID: aced68c843bad2faca577efe092138eb3eddef4f07f4e4d3922cff580fb51100
Opcode Fuzzy Hash: cb5d83b83f134cffb1941c8b7e24cbf8fff3535e222c16a22082972738369067
Instruction Fuzzy Hash: BC517071900218AFCB10EFA5CC899DEB7B9EF48309F14456BF505E7241DB789E848F59

Function 00407EE7 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 133keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00407F39
MapVirtualKeyW.USER32(00000010,00000000), ref: 00407F43
MapVirtualKeyW.USER32(00000000), ref: 00407F51
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00407F5E
MapVirtualKeyW.USER32(00000011,00000000), ref: 00407F68
MapVirtualKeyW.USER32(00000012,00000000), ref: 00407F72
GetKeyboardLayoutNameA.USER32(?), ref: 00407F7D
VkKeyScanA.USER32(00000000), ref: 00407F90
_strncmp.LIBCMT ref: 00407FC7

Strings

0409, xrefs: 00407FA8
0809, xrefs: 00407FEA
0002, xrefs: 00407FC1

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Virtual$KeyboardLayoutNameScan_strncmp
String ID: 0002$0409$0809
API String ID: 1585530699-2507973371
Opcode ID: 17e7217e618673f7fb0b3ab063125f77c822ad39de37a88e90bdc1c421a54322
Instruction ID: f4589159273ea8524884ce451454c2b01fd318127f3562d9e445f7b5cc0eee43
Opcode Fuzzy Hash: 17e7217e618673f7fb0b3ab063125f77c822ad39de37a88e90bdc1c421a54322
Instruction Fuzzy Hash: 9441B071A48384ADE704DBB9AC4AB5A3FD8DB11308F14047FE581D61D2EF78A54887AE

Function 0044057E Relevance: 21.1, APIs: 14, Instructions: 123filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,00000001,?), ref: 004405A1
GetFileSize.KERNEL32(00000000,00000000), ref: 004405B7
GlobalAlloc.KERNEL32(00000002,00000000), ref: 004405C3
GlobalLock.KERNEL32(00000000), ref: 004405CC
ReadFile.KERNEL32(00000000,00000000,000000FF,000000FF,00000000), ref: 004405DC
GlobalUnlock.KERNEL32(00000000), ref: 004405E3
CloseHandle.KERNEL32(00000000), ref: 004405EA
CreateStreamOnHGlobal.COMBASE(00000000,00000001,000000FF), ref: 004405F7
OleLoadPicture.OLEAUT32(000000FF,00000000,00000000,00467900,?), ref: 0044060B
GlobalFree.KERNEL32(00000000), ref: 0044061B
GetObjectW.GDI32(00000001,00000018,?), ref: 0044063B
CopyImage.USER32(00000001,00000000,?,000000FF,00002000), ref: 00440672
DeleteObject.GDI32(?), ref: 00440694
SendMessageW.USER32(?,00000172,00000000,00000001), ref: 004406AA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3969911579-0
Opcode ID: f9fcca3677ac8062e0a3a9c3a3efe7e56e376da3ff41eaada435d9752107cbd5
Instruction ID: 24f7dc57787f5485d8d61bd88917a9ff937e9a3def8c4dea298511fa8aa15da6
Opcode Fuzzy Hash: f9fcca3677ac8062e0a3a9c3a3efe7e56e376da3ff41eaada435d9752107cbd5
Instruction Fuzzy Hash: EE416A71900214BFDB119FA0DC88DAFBB79FF8A714B108066F902E7260D7749951CFA5

Function 0040C9DA Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 0040C9EC
_wcscpy.LIBCMT ref: 0040C9FB
_wcscpy.LIBCMT ref: 0040CA68
_wcscpy.LIBCMT ref: 0040CA87
_wcscpy.LIBCMT ref: 0040CA97
_wcscat.LIBCMT ref: 0040CAA4
_wcscat.LIBCMT ref: 0040CAFB
_wcscat.LIBCMT ref: 0040CB31
_wcscat.LIBCMT ref: 0040CB41

Strings

., xrefs: 0040CA50
., xrefs: 0040CA6F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscat_wcscpy$_wcschr
String ID: .$.
API String ID: 1766671649-3769392785
Opcode ID: 914dbbaa8903bc26c1409dc351f811b41fe4a5462a63659048ee304ecceaf96c
Instruction ID: 95beb12b571e07c4b3fcb6b14ebd9bb743c313e059d296a0428f21cf889bbef3
Opcode Fuzzy Hash: 914dbbaa8903bc26c1409dc351f811b41fe4a5462a63659048ee304ecceaf96c
Instruction Fuzzy Hash: A341E5B280411DA9DF61EB51DC46EDE73BCAB04314F1041EBB505A2081EA79ABD98FA9

Function 004027D1 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 004027E0
GetClassNameW.USER32(00000000,?,00000100), ref: 004027F5
__wcsicmp.LIBCMT ref: 0040281A
__wcsicmp.LIBCMT ref: 00402835
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00402882

Strings

smallicons, xrefs: 0040284A
SHELLDLL_DefView, xrefs: 00402801
list, xrefs: 00402865
details, xrefs: 0040282F
largeicons, xrefs: 00402814

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsicmp$ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 7836182-3381328864
Opcode ID: 5dd6843d1f2ede7808f8b6080265d7f1f438d0aa80e9f475d01216b713322e71
Instruction ID: b08ab6248bc50ce0ad3101dcc044c7495cd534409aacc10e854c5019f6e43ea9
Opcode Fuzzy Hash: 5dd6843d1f2ede7808f8b6080265d7f1f438d0aa80e9f475d01216b713322e71
Instruction Fuzzy Hash: FC116D76648305BEFA1476A25D0AE77279CDB04729B20416BFD01E31D1FAECE842496E

Function 0040A1D1 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 68windowCOMMON

Download Yara Rule

APIs

__wcsicmp.LIBCMT ref: 0040A1EC
__wcsicmp.LIBCMT ref: 0040A208
LoadIconW.USER32(00000000,00007F03), ref: 0040A261

Strings

stop, xrefs: 0040A232
blank, xrefs: 0040A1E6
info, xrefs: 0040A202
question, xrefs: 0040A21A
warning, xrefs: 0040A24A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsicmp$IconLoad
String ID: blank$info$question$stop$warning
API String ID: 4260361741-404129466
Opcode ID: 1823751d4d475c1db501a0717702528feca2c90563e5bb3170018dffad61b1c0
Instruction ID: ba6e58bbbbbd64570c897e67d9d3b1defe15f80a5f334dec41f9fb007f32b1fd
Opcode Fuzzy Hash: 1823751d4d475c1db501a0717702528feca2c90563e5bb3170018dffad61b1c0
Instruction Fuzzy Hash: 0A11333128D305BDFA05B762AC07D6B2298EF11725B20007FF841F22C1FA7EAA11555F

Function 0040BE51 Relevance: 19.7, APIs: 13, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 0040DA76: LoadLibraryA.KERNEL32(Psapi.dll,0040BE7D,00000000,75920F00,0048BA08,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040DA81
Part of subcall function 0040DA76: GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0040DA93

FreeLibrary.KERNEL32(0041902D,00000000,75920F00,0048BA08,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040C06E

Part of subcall function 0040DAA5: LoadLibraryA.KERNEL32(Psapi.dll,0040BE93,00000000,75920F00,0048BA08,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040DAB0
Part of subcall function 0040DAA5: GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0040DAC2

FreeLibrary.KERNEL32(?,00000000,75920F00,0048BA08,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040C064

Part of subcall function 0040DAD4: LoadLibraryA.KERNEL32(Psapi.dll,0040BEA3,00000000,75920F00,0048BA08,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040DADF
Part of subcall function 0040DAD4: GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040DAF1

FreeLibrary.KERNEL32(00000001,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040BEE3
FreeLibrary.KERNEL32(?,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040BEED
FreeLibrary.KERNEL32(0041902D,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040BEFB

Part of subcall function 0044EF6F: _strtol.LIBCMT ref: 0044EF77

OpenProcess.KERNEL32(00000410,00000000,?,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040BF43
_wcscat.LIBCMT ref: 0040BFD1
__wcsicmp.LIBCMT ref: 0040BFE0
CloseHandle.KERNEL32(?,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040C016
FreeLibrary.KERNEL32(00000001,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040C038
FreeLibrary.KERNEL32(?,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040C042
FreeLibrary.KERNEL32(0041902D,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040C04C
FreeLibrary.KERNEL32(00000001,00000000,75920F00,0048BA08,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040C05A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$Free$AddressLoadProc$CloseHandleOpenProcess__wcsicmp_strtol_wcscat
String ID:
API String ID: 2602667755-0
Opcode ID: d61cc667b7835ab6853b59277e496039c8afb2d1f9b4de2794f86d782953e0f8
Instruction ID: 56ebe760d5a469f108e129d8574b549897e0d44da98d1eee39eabc2c6de3ef73
Opcode Fuzzy Hash: d61cc667b7835ab6853b59277e496039c8afb2d1f9b4de2794f86d782953e0f8
Instruction Fuzzy Hash: D461C472D00219EBCF11EFE5CC81ADEB7B5AB08304F10417AE901B22A1D7796A45DFA9

Function 00433F9A Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 251COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,00000000), ref: 00433FAD

Strings

HKEY_CLASSES_ROOT, xrefs: 004340B2
HKCU, xrefs: 004341C4
HKU, xrefs: 0043424B
HKLM, xrefs: 00434049
HKCC, xrefs: 0043414A
HKEY_CURRENT_CONFIG, xrefs: 0043412C
HKEY_CURRENT_USER, xrefs: 004341A6
HKCR, xrefs: 004340D0
HKEY_LOCAL_MACHINE, xrefs: 0043402B
HKEY_USERS, xrefs: 00434225

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: f0801aa1abd3ef248cdae24e7f96a4dda09766534d84e6bb2618a3cbe49b14ee
Instruction ID: e4456d1138c056a5321253eefd50be2e5c89f66ccb633fcf386c145300cb8eb7
Opcode Fuzzy Hash: f0801aa1abd3ef248cdae24e7f96a4dda09766534d84e6bb2618a3cbe49b14ee
Instruction Fuzzy Hash: A29108315003459EEF01AF6AEC567DE3B60EF41368F04885AFD50372E2D77C6A95C698

Function 00409D4F Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 170windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(0048C258,000000FF,00000000,0000002C), ref: 00409DBF
SetMenuItemInfoW.USER32(0048C258,00000004,00000000,0000002C), ref: 00409DF5
Sleep.KERNEL32(000001F4,0048C258), ref: 00409E06
GetMenuItemCount.USER32(?), ref: 00409E4D
GetMenuItemID.USER32(?,00000000), ref: 00409E6E
GetMenuItemID.USER32(?,-00000001), ref: 00409E93
GetMenuItemID.USER32(?,?), ref: 00409EC8
CheckMenuRadioItem.USER32(?,?,?,?,00000400), ref: 00409F03
GetMenuItemInfoW.USER32(?,000000FF,00000000,0000002C), ref: 00409F1C
SetMenuItemInfoW.USER32(?,000000FF,00000000,0000002C), ref: 00409F3B

Strings

,, xrefs: 00409D62

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: ,
API String ID: 1460738036-3772416878
Opcode ID: d54fbac617ba3394bef3d630c9ff5494c340c2e62df62154e220661a047cd606
Instruction ID: 2a22892b49afed48f81b27d93027d98337d9210b4c28f2d31f6b5bdafcdd1208
Opcode Fuzzy Hash: d54fbac617ba3394bef3d630c9ff5494c340c2e62df62154e220661a047cd606
Instruction Fuzzy Hash: D051BE70904209AEDF11DFA4C884AEEBBB9EF01308F20807BE541B72D2D7785E85CB59

Function 004280C5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 140registryCOMMON

Download Yara Rule

APIs

StringFromIID.COMBASE(?,?), ref: 004280E5

Part of subcall function 0040D6DA: _wcscpy.LIBCMT ref: 0040D700

CoTaskMemFree.COMBASE(?), ref: 00428130
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00428148
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 00428176
CLSIDFromString.COMBASE(00000000,?), ref: 004281A5
RegQueryValueExW.ADVAPI32(?,Version,00000000,00000000,?,00000001), ref: 004281DA
LoadRegTypeLib.OLEAUT32(?,00000000,00000000), ref: 0042822D

Part of subcall function 00451654: __wtof_l.LIBCMT ref: 0045165A

RegCloseKey.ADVAPI32(?), ref: 00428256

Strings

interface\, xrefs: 00428104
Version, xrefs: 004281CB
\TypeLib, xrefs: 00428119

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: FromQueryStringValue$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
String ID: Version$\TypeLib$interface\
API String ID: 943498556-939221531
Opcode ID: a1d15348556cf66bcdc0cb42cdcb2bfbb7b03f165823dbf8b20fbb5a6350ee48
Instruction ID: 3d3e318f2cb5111273247ffab3a4b5002f674caa10f5f47532352b726c1dabe7
Opcode Fuzzy Hash: a1d15348556cf66bcdc0cb42cdcb2bfbb7b03f165823dbf8b20fbb5a6350ee48
Instruction Fuzzy Hash: 7C413B72C00118EBCF11EBE5DC888DEBBB8FF48354F1045AAF915B3251EA399A54CB65

Function 0042826C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 130registryshareCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004282FF
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00428333
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 0042834E
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?), ref: 0042836E
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 00428398
CLSIDFromString.COMBASE(00000000,?), ref: 004283C5
RegCloseKey.ADVAPI32(?), ref: 004283D7
RegCloseKey.ADVAPI32(?), ref: 004283DC

Strings

\CLSID, xrefs: 004282B2
\IPC$, xrefs: 00428315
SOFTWARE\Classes\, xrefs: 0042829A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1687751970-22481851
Opcode ID: 5c6d2722f241780e415c12530e078d4e73ec7a9b24fdaa5f2637a44f9cb54fb9
Instruction ID: 9cb335a863502e44f73f4fc5ddb5ee815b9b4a4335ba87f11416018ffe3a9f35
Opcode Fuzzy Hash: 5c6d2722f241780e415c12530e078d4e73ec7a9b24fdaa5f2637a44f9cb54fb9
Instruction Fuzzy Hash: 82417031D01118ABCB10EFA2DC45CDEBBB8FF44754F50446AF500B21A1EB799E548B98

Function 00427F88 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 106registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00427FCB
RegEnumKeyExW.ADVAPI32(?,00000000,?,00000028,00000000,00000000,00000000,?), ref: 00427FFD
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?,00000000,interface\), ref: 0042803F
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,000001FE), ref: 00428058
__wcsicmp.LIBCMT ref: 0042807B
IIDFromString.COMBASE(00000000,00000000), ref: 0042808D
RegCloseKey.ADVAPI32(?), ref: 00428099
RegCloseKey.ADVAPI32(?), ref: 004280B7

Strings

(, xrefs: 004280A8
interface\, xrefs: 00428014
interface, xrefs: 00427FC0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CloseOpen$EnumFromQueryStringValue__wcsicmp
String ID: ($interface$interface\
API String ID: 2232923661-3327702407
Opcode ID: e5d7d0b0675df7653fdcdeb56f1c2e35951249a3fe2d299e4e5d27ad850f7547
Instruction ID: 3243c2b5daf0432cb4a17ffbf76eea3d2d028ecfb0acc963761d9c74434f0f59
Opcode Fuzzy Hash: e5d7d0b0675df7653fdcdeb56f1c2e35951249a3fe2d299e4e5d27ad850f7547
Instruction Fuzzy Hash: 7931097290521DEBEF10DBA1DD45EEEB7BCFB04348F20406AE900F2191E7789A049F69

Function 0040C0FE Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 80sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0040C108
timeGetTime.WINMM ref: 0040C11E
Sleep.KERNEL32(0000000A), ref: 0040C132
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 0040C176
SetActiveWindow.USER32 ref: 0040C197
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0040C1A5
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040C1C5
Sleep.KERNEL32(000000FA), ref: 0040C1D0
IsWindow.USER32 ref: 0040C1DC
EndDialog.USER32(00000000), ref: 0040C1ED

Part of subcall function 0040D375: GetWindowThreadProcessId.USER32(?,00000000), ref: 0040D396
Part of subcall function 0040D375: GetCurrentThreadId.KERNEL32 ref: 0040D39D
Part of subcall function 0040D375: AttachThreadInput.USER32(00000000), ref: 0040D3A4

Strings

BUTTON, xrefs: 0040C168

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$Thread$MessageSendSleepTimetime$ActiveAttachCurrentDialogFindInputProcess
String ID: BUTTON
API String ID: 2994871518-3405671355
Opcode ID: 7feae41d173d9c25965804a5a81675744189c9a03c11f2e4549ececfeb94c251
Instruction ID: f7b49b4b1143b5e56d5be54055dc5d07e824ba47b1f3b776ffa78f7e280b4b15
Opcode Fuzzy Hash: 7feae41d173d9c25965804a5a81675744189c9a03c11f2e4549ececfeb94c251
Instruction Fuzzy Hash: C32192B1108605FFDB111B60FCC8E6E3B68E704359B14467AF502B51F2EAB94C42AF6E

Function 0040D1CD Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0040D234
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0040D248
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0040D258
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0040D26B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0040D278

Strings

open , xrefs: 0040D1E1
alias PlayMe, xrefs: 0040D20D
status PlayMe mode, xrefs: 0040D22F
play PlayMe wait, xrefs: 0040D266
close PlayMe, xrefs: 0040D23D, 0040D247, 0040D270
play PlayMe, xrefs: 0040D273

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 13f698b10254c1e619dc330319388c8105513ecc05685312b349ab564dbbfa46
Instruction ID: 21f41cf1200f56aec09ca5427a3cf159b1276f970a239394b68112021b7638be
Opcode Fuzzy Hash: 13f698b10254c1e619dc330319388c8105513ecc05685312b349ab564dbbfa46
Instruction Fuzzy Hash: 4D1151B1D4011C7AEB10AAA2DCC5DBE7B6CDB4079CF5045BBB01472091E7B89E448AA9

Function 00427D08 Relevance: 18.2, APIs: 12, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00427D1F
SysAllocString.OLEAUT32(?), ref: 00427DAB
CoTaskMemFree.COMBASE(?), ref: 00427DB7
SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,00000000), ref: 00427DD6
SafeArrayAllocData.OLEAUT32(00000000), ref: 00427E27
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00427E3C
VariantInit.OLEAUT32(?), ref: 00427E6D
VariantCopy.OLEAUT32(?,?), ref: 00427E97
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00427EB4
SafeArrayDestroyData.OLEAUT32(00000000), ref: 00427EC6
SafeArrayDestroyDescriptor.OLEAUT32(00000000), ref: 00427ED5
VariantCopy.OLEAUT32(?,?), ref: 00427EFC

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ArraySafe$DataVariant$Alloc$CopyDescriptorDestroyInit$AccessFreeStringTaskUnaccess
String ID:
API String ID: 2357396938-0
Opcode ID: b95c6e65530efb454013ee0b7425e765706e9a57df5be9b58ef508cc060b3a7d
Instruction ID: 6f5537f683651e9b32ff6c4263a33c438a228174f3afa289b84319554c349ee5
Opcode Fuzzy Hash: b95c6e65530efb454013ee0b7425e765706e9a57df5be9b58ef508cc060b3a7d
Instruction Fuzzy Hash: 2B71A931718226DFCB10DF95E8859AEB7B4FF04314BA144AEE805E7310E7789D41DBA9

Function 004050F6 Relevance: 18.2, APIs: 12, Instructions: 170COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0040510B
GetWindowRect.USER32(00000000,?), ref: 00405123
MoveWindow.USER32(?,0000000A,?,?,?,00000000), ref: 00405181
GetDlgItem.USER32(?,00000002), ref: 00405190
GetWindowRect.USER32(00000000,?), ref: 004051A2
MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 004051F6
GetDlgItem.USER32(?,000003E9), ref: 00405203
GetWindowRect.USER32(00000000,?), ref: 00405215
MoveWindow.USER32(?,0000000A,00000000,?,?,00000000), ref: 00405255
GetDlgItem.USER32(?,000003EA), ref: 00405262
MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 0040527B
InvalidateRect.USER32(?,00000000,00000001), ref: 00405287

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 98b34d1d321fcfa138617dd29b0f5ad7f0d2af4a82214095a1b38b72c1e11ed3
Instruction ID: df784a5c501df33d32623606d2407a73d2ef5cd1658e1004e46ce22e34e15a81
Opcode Fuzzy Hash: 98b34d1d321fcfa138617dd29b0f5ad7f0d2af4a82214095a1b38b72c1e11ed3
Instruction Fuzzy Hash: 1B511BB1A00209AFDB14CFA8DD85AAEBBB9FB44311F14816AF515E7290E770AE00CF55

Function 0043C28D Relevance: 18.2, APIs: 12, Instructions: 156COMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,?), ref: 0043C2FF
ShowWindow.USER32(00000000,00000006,00000058,00000000,00000000), ref: 0043C391

Part of subcall function 00440DF3: ShowWindow.USER32(00000003,00000000,00004160,00000000,?,?,0043C2F6,?), ref: 00440E4A
Part of subcall function 00440DF3: EnableWindow.USER32(00000000,00000000), ref: 00440E5E
Part of subcall function 00440DF3: ShowWindow.USER32(00000003,00000000,00004160,00000000,?,?,0043C2F6,?), ref: 00440EAB
Part of subcall function 00440DF3: ShowWindow.USER32(00000000,00000004,?,?,0043C2F6,?), ref: 00440EB3
Part of subcall function 00440DF3: EnableWindow.USER32(00000000,00000001), ref: 00440EC7
Part of subcall function 00440DF3: SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00440EEB

ShowWindow.USER32(00000000,00000000,00000058,00000000,00000000), ref: 0043C39F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$Show$Enable$ClientMessageRectSend
String ID:
API String ID: 33439115-0
Opcode ID: 40ed79a081112762abf612aa60e79c16a11a3cbe79436d830e6d614f1b797db4
Instruction ID: 672905dc48b99d706b66b6574e6895404dd24c2ba808b51363bbb33bb23dd04f
Opcode Fuzzy Hash: 40ed79a081112762abf612aa60e79c16a11a3cbe79436d830e6d614f1b797db4
Instruction Fuzzy Hash: 8151F730608340EAE7215F38CDC877B7BA5BB69314F14A45BE543B26A1D7BCA840CB5E

Function 004293C6 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 223COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00429426
VariantInit.OLEAUT32(?), ref: 004294D9
VariantInit.OLEAUT32(?), ref: 004295A5
VariantClear.OLEAUT32(?), ref: 004295B5

Strings

get__NewEnum, xrefs: 004293EA
Incorrect Object type in FOR..IN loop, xrefs: 00429597
F, xrefs: 00429422
_NewEnum, xrefs: 004293E3
Null Object assignment in FOR..IN loop, xrefs: 0042946C, 00429615

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Variant$Init$Clear_memset
String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 3437250866-1153829046
Opcode ID: c2e1d9958f0d7aa538177d83342c53307b4914418d1807aa18b309dc53b4630a
Instruction ID: e821f5128966be974faa0cfed74388a250788acac7db47d10b0d09004602c120
Opcode Fuzzy Hash: c2e1d9958f0d7aa538177d83342c53307b4914418d1807aa18b309dc53b4630a
Instruction Fuzzy Hash: CE81CD72A00219AFDF20DFA4D884EDEB7B8AF04304F50415EF615A7291D7B89E85CB69

Function 00428C71 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 200COMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

CoTaskMemFree.COMBASE(?), ref: 00428D55
StringFromCLSID.COMBASE(?,?), ref: 00428D35

Part of subcall function 0040D6DA: _wcscpy.LIBCMT ref: 0040D700

StringFromIID.COMBASE(?,?), ref: 00428E52
CoTaskMemFree.COMBASE(?), ref: 00428E6C

Strings

localserver32, xrefs: 00428DBF
ToolBoxBitmap32, xrefs: 00428D99
inprocserver32, xrefs: 00428DA3
Interface\, xrefs: 00428E72
CLSID\, xrefs: 00428D65
ProgID, xrefs: 00428DCB

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: FreeFromStringTask$Message_wcscpy
String ID: CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32
API String ID: 3908383328-2412192186
Opcode ID: 8d163a86d389fc0b40b57f6c24cf890a03ce465061dc8c1a7b4f23301be01532
Instruction ID: 28b7bace9bb34d75845db43a23bf539245773b247e34a785eff03f685e2c8efe
Opcode Fuzzy Hash: 8d163a86d389fc0b40b57f6c24cf890a03ce465061dc8c1a7b4f23301be01532
Instruction Fuzzy Hash: 76617D71209301AFC700EF61D88585FB7A9FF88348F50482EF445E62A1DB79E9498B5A

Function 00406CC1 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00406339: GetModuleHandleW.KERNEL32(00000000,00000066,?,00000100,?,00406F25,?,?,?,Unterminated string,?), ref: 00406356
Part of subcall function 00406339: LoadStringW.USER32(00000000,?,00406F25,?), ref: 0040635D
Part of subcall function 00406339: _printf.LIBCMT ref: 00406382

GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,C:\Users\user\Desktop\regsvr.exe), ref: 00406D76
GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00406D8D
_wcscpy.LIBCMT ref: 00406DCD
_wcscat.LIBCMT ref: 00406DE2
SetCurrentDirectoryW.KERNEL32(?), ref: 00406DF2
SetCurrentDirectoryW.KERNEL32(?), ref: 00406F3B

Strings

Unterminated string, xrefs: 00406F10
C:\Users\user\Desktop\regsvr.exe, xrefs: 00406CDE
Error opening the file, xrefs: 00406D41
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00406CEA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CurrentDirectory$FullHandleLoadModuleNamePathString_printf_wcscat_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$C:\Users\user\Desktop\regsvr.exe$Error opening the file$Unterminated string
API String ID: 3880677318-2066809824
Opcode ID: f48b456df21b36b7dde4fed0c0ad37d699c0276e9691097058bdbe164f86c5eb
Instruction ID: 363d3c4044e331e6bf707280c63f17c47f13031cb355ad5cd5efae00aa961de3
Opcode Fuzzy Hash: f48b456df21b36b7dde4fed0c0ad37d699c0276e9691097058bdbe164f86c5eb
Instruction Fuzzy Hash: F861B1720083469ADB21EF50C801FDF7BE8AF85308F05083FF986A2191DB79D659979B

Function 0040D0AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 0040D0C2
gethostname.WS2_32(?,00000100), ref: 0040D0DB
gethostbyname.WS2_32(?), ref: 0040D0E7
_wcscpy.LIBCMT ref: 0040D110
inet_ntoa.WS2_32(?), ref: 0040D12E
_strcat.LIBCMT ref: 0040D13B
_wcscpy.LIBCMT ref: 0040D155
WSACleanup.WS2_32 ref: 0040D163
_wcscpy.LIBCMT ref: 0040D172

Strings

0.0.0.0, xrefs: 0040D108

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2620052-3771769585
Opcode ID: 1dba5a339320690d74ef9bd2776e4f59eea8b64ebc69b8a17c402debd972ef3c
Instruction ID: 6576159ad66fd3fb2ff566f10bafdada74c2173c16ac1c71be99918ab5e1ccaa
Opcode Fuzzy Hash: 1dba5a339320690d74ef9bd2776e4f59eea8b64ebc69b8a17c402debd972ef3c
Instruction Fuzzy Hash: BE11E4719001147AEF10BBB2CC42ADE37ACAF54318F104177B504BA0D2EE7C9A898AA9

Function 00454ABB Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00472810,0000000C,00454BCC,00000000,00000000,?,00000000,00455081,0044EB47,00000001,004548D9,?,00000000), ref: 00454ACC
GetProcAddress.KERNEL32(?,EncodePointer), ref: 00454B00
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00454B10
InterlockedIncrement.KERNEL32(004763A0), ref: 00454B32
__lock.LIBCMT ref: 00454B3A
___addlocaleref.LIBCMT ref: 00454B59

Strings

KERNEL32.DLL, xrefs: 00454AC7
DecodePointer, xrefs: 00454B08
EncodePointer, xrefs: 00454AF2
PmG, xrefs: 00454AD8

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL$PmG
API String ID: 1036688887-4022621149
Opcode ID: 2661ea3f0638e1064bbf9f40519b0d2430feb54b20b55e3241bdd88832414c48
Instruction ID: dc5c2ea8bde614cc792db02f5a2abed29ba042dcaacd544b6ab2bc80afcc0d3b
Opcode Fuzzy Hash: 2661ea3f0638e1064bbf9f40519b0d2430feb54b20b55e3241bdd88832414c48
Instruction Fuzzy Hash: 1B118670940701AFD7209F75C80179ABBE4BF44319F10851FE89997392E7B8D944CF59

Function 0040A062 Relevance: 17.5, APIs: 4, Strings: 6, Instructions: 47COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0040A0FC
_wcscpy.LIBCMT ref: 0040A10C
_wcscpy.LIBCMT ref: 0040A12C
_wcscpy.LIBCMT ref: 0040A137

Strings

Exit, xrefs: 0040A112
Exit, xrefs: 0040A07C
Script Paused, xrefs: 0040A106, 0040A10B, 0040A131
Exit, xrefs: 0040A081, 0040A086, 0040A111
Script Paused, xrefs: 0040A132
Script Paused, xrefs: 0040A101

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscpy
String ID: Exit$Exit$Exit$Script Paused$Script Paused$Script Paused
API String ID: 3048848545-2203000711
Opcode ID: b052645a2dfa8bdad3af04dcb69a3d7d478f87c22335165361279bc74dd104b8
Instruction ID: 348da1acaf8d96e4dba103ed0bb368aec68b5451cb23e833a54dd66dfcce6503
Opcode Fuzzy Hash: b052645a2dfa8bdad3af04dcb69a3d7d478f87c22335165361279bc74dd104b8
Instruction Fuzzy Hash: 3F11197184A38099D301EFAABCD6A5E7F60A762728B540ABED094572F2D3790049CB7D

Function 00426927 Relevance: 16.7, APIs: 11, Instructions: 233networkmemoryCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 004269DC
FreeLibrary.KERNEL32(?,00000000,00000101,?), ref: 004269C4

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

inet_addr.WS2_32(00000000), ref: 00426A00
gethostbyname.WS2_32(00000000), ref: 00426A0A
_memset.LIBCMT ref: 00426A71
GlobalAlloc.KERNEL32(00000040,00000040), ref: 00426A7D
FreeLibrary.KERNEL32(?,00000000,00000000,00000101,?), ref: 00426AC2
FreeLibrary.KERNEL32(?,00000000,00000000,00000101,?), ref: 00426ACE
FreeLibrary.KERNEL32(?,00000000,00000000,00000101,?), ref: 00426ADA
GlobalFree.KERNEL32(00000000), ref: 00426BD9
WSACleanup.WS2_32 ref: 00426BDF

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Free$Library$Global$AllocCleanupMessageStartup_memsetgethostbynameinet_addr
String ID:
API String ID: 2742574630-0
Opcode ID: 0e183e5ed87b915aa1b7cc6d4449dfa966f7a19444f8ec3b29e16ffe4705e3c9
Instruction ID: a919453fccc41775e4647c5b33e6b7f6cc080a7334b136740fd594e217e54653
Opcode Fuzzy Hash: 0e183e5ed87b915aa1b7cc6d4449dfa966f7a19444f8ec3b29e16ffe4705e3c9
Instruction Fuzzy Hash: 9B819131608320ABCB10EF65A841A5BBBE4EF85318F41092FF991E3291C779ED45CB5B

Function 00408729 Relevance: 16.6, APIs: 11, Instructions: 112keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0040874D
GetAsyncKeyState.USER32(00000011), ref: 004087ED
GetKeyState.USER32(00000011), ref: 00408801
GetAsyncKeyState.USER32(00000012), ref: 0040881D
GetKeyState.USER32(00000012), ref: 00408826
GetAsyncKeyState.USER32(?), ref: 00408845
GetKeyState.USER32(?), ref: 0040884E
GetAsyncKeyState.USER32(000000A1), ref: 00408872
GetKeyState.USER32(000000A1), ref: 0040887A
GetAsyncKeyState.USER32(0000005B), ref: 0040889A
GetKeyState.USER32(0000005B), ref: 004088A3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: f0bc7148331a3a12826116558cc405fd5f42fd13a9c9d4fede8dc4563aeab1c1
Instruction ID: 49a8d46c4f0500cb5570797a9b3f6ca61b17343d43a4eab2c04ecfa008ae406f
Opcode Fuzzy Hash: f0bc7148331a3a12826116558cc405fd5f42fd13a9c9d4fede8dc4563aeab1c1
Instruction Fuzzy Hash: 8E41C2355053449AEB34EF24CA887977B94AF90744F58843ED9C8372C6DF788948CB7A

Function 004288DC Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 251comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00428924
CLSIDFromProgID.COMBASE(00000000,?), ref: 00428944
CoCreateInstance.COMBASE(?,00000000,00000005,004678E0,?), ref: 004289A8
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00428A1F
_memset.LIBCMT ref: 00428A2F
_memset.LIBCMT ref: 00428B45
CoCreateInstanceEx.COMBASE(?,00000000,00000010,?,00000001,?), ref: 00428B74
CoSetProxyBlanket.COMBASE(?,?,?,?,?,?,?,00000800), ref: 00428BB2

Strings

NULL Pointer assignment, xrefs: 00428BD0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity
String ID: NULL Pointer assignment
API String ID: 662438516-2785691316
Opcode ID: 478fe740e64ff4dfd8d43bd03cc3ee00198a22e5d45fffbc8907c229cec89d2a
Instruction ID: b8cd914e1027da44da0fa057c9d94436d6653ca86a6c9c268abc3a26b8912bb3
Opcode Fuzzy Hash: 478fe740e64ff4dfd8d43bd03cc3ee00198a22e5d45fffbc8907c229cec89d2a
Instruction Fuzzy Hash: 099169B1D00219AFDF10EFA5DC84AEEBBB8FB04308F10456EF505A7251EB799E448B55

Function 00426315 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 203COMMON

Download Yara Rule

APIs

__wcsicmp.LIBCMT ref: 004263C8
_wcsncat.LIBCMT ref: 004264D0
_wcsncat.LIBCMT ref: 004264E7
_wcsncat.LIBCMT ref: 00426509
_wcscpy.LIBCMT ref: 00426541

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Strings

, $, xrefs: 004264CA
CALLARGARRAY, xrefs: 004263B9
%s(, xrefs: 00426439
AUTOITCALLVARIABLE%d, xrefs: 0042645C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcsncat$Message__wcsicmp_wcscpy
String ID: %s($, $$AUTOITCALLVARIABLE%d$CALLARGARRAY
API String ID: 3855920302-2848625563
Opcode ID: 652eb92f70bd82196a24118808bcafc5e0696d47186ff9d19c612351b9f68d83
Instruction ID: d6190e63be30f02bb565c03451e2f88f1c6807cf34589e290ec74498b0fa6eb6
Opcode Fuzzy Hash: 652eb92f70bd82196a24118808bcafc5e0696d47186ff9d19c612351b9f68d83
Instruction Fuzzy Hash: EA51C772A002186BDF15FFA5D8469EF73A9EB04318F50447FF905F3182EA38AE458A5D

Function 0040B0F2 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 170windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D6DA: _wcscpy.LIBCMT ref: 0040D700

_wcscpy.LIBCMT ref: 0040B17B
GetMenuItemInfoW.USER32(?,000000FF,00000000,0000002C), ref: 0040B1E7
SetMenuItemInfoW.USER32(?,000000FF,00000000,0000002C), ref: 0040B29F
SetMenuDefaultItem.USER32(?,000000FF,00000000,?,000000FF,00000000,0000002C,?,000000FF,00000000,0000002C), ref: 0040B2BC

Strings

Exit, xrefs: 0040B176
,, xrefs: 0040B1BA
Script Paused, xrefs: 0040B159
Exit, xrefs: 0040B16E
Script Paused, xrefs: 0040B15E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ItemMenu$Info_wcscpy$Default
String ID: ,$Exit$Exit$Script Paused$Script Paused
API String ID: 3556342642-3192828056
Opcode ID: 9f73942c67fa2079e5e9bedb43c9f4073bddb04194ac220655855402fc2a0f7b
Instruction ID: 7ca41266b1e39d2eeb594c2b4204ed57ece2ac72f75c114817d0965d8483089a
Opcode Fuzzy Hash: 9f73942c67fa2079e5e9bedb43c9f4073bddb04194ac220655855402fc2a0f7b
Instruction Fuzzy Hash: 1B510730904244AAEF21EFA9D84879FBBB1EB41354F20847FE861762D1D7BD4A44CB9D

Function 0040A282 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,0048C258), ref: 0040A2C9
_memset.LIBCMT ref: 0040A37C
_wcsncpy.LIBCMT ref: 0040A3A4
_wcscpy.LIBCMT ref: 0040A3BE
_memset.LIBCMT ref: 0040A3E2
_wcsncpy.LIBCMT ref: 0040A413
_wcscpy.LIBCMT ref: 0040A430
Shell_NotifyIconW.SHELL32(00000001,?), ref: 0040A441

Strings

Line: , xrefs: 0040A338

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset_wcscpy_wcsncpy$IconLoadNotifyShell_String
String ID: Line:
API String ID: 1930742743-1585850449
Opcode ID: edd99b903ae735c41f4b472aa62f05d713a6e23da016623e0049ac061481323b
Instruction ID: a1c83a4647b523b593b75610f6452174990dc273f7069fa8f94ecd0bd6f081ed
Opcode Fuzzy Hash: edd99b903ae735c41f4b472aa62f05d713a6e23da016623e0049ac061481323b
Instruction Fuzzy Hash: 43415D72408344AAD321EF55DC85BDFB7E8BB84304F00093FF599A2191EB3499588B5B

Function 0040FEA7 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 118COMMON

Download Yara Rule

APIs

__itoa.LIBCMT ref: 0040FEDD
__i64toa.LIBCMT ref: 0040FEF8
__swprintf.LIBCMT ref: 0040FF18
__swprintf.LIBCMT ref: 0040FF2D
_wcscpy.LIBCMT ref: 0040FF4C

Strings

%.15g, xrefs: 0040FF12
False, xrefs: 0040FF46
0x%p, xrefs: 0040FF27
True, xrefs: 0040FF3F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __swprintf$__i64toa__itoa_wcscpy
String ID: %.15g$0x%p$False$True
API String ID: 3260093989-2263619337
Opcode ID: dc37291ea12a4c640794f16defff0e980838e4029e0b5c73597874b065a23686
Instruction ID: 14e876be3d488ff3e9aadbac0904dcdc393aa83d50ae357ce1f3ed625a5a76b8
Opcode Fuzzy Hash: dc37291ea12a4c640794f16defff0e980838e4029e0b5c73597874b065a23686
Instruction Fuzzy Hash: C731D772A04206EAEB20A765DC42F56B7A8FF05304F208477F509E24D1EB78985D9B5A

Function 00402263 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403615: GetClassNameW.USER32(?,?,000000FF), ref: 00403638

SendMessageW.USER32(?,0000018C,00000000,?), ref: 004022DF
GetDlgCtrlID.USER32(00000000), ref: 004022F0
GetParent.USER32 ref: 00402302
SendMessageW.USER32(00000000,?,00000111,?), ref: 00402309
GetDlgCtrlID.USER32(00000000), ref: 0040230F
GetParent.USER32 ref: 00402325
SendMessageW.USER32(00000000,?,00000111,?), ref: 0040232C

Strings

ComboBox, xrefs: 0040226B
ListBox, xrefs: 0040229E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: ebc464aeefbd4af9651326ffcf6c340f0f11feceff56b765effd4581028ac19f
Instruction ID: c0d53bd78e8ef9695899ed5a7a6ac7a14c24d22a0fd448da908f073b520bda0f
Opcode Fuzzy Hash: ebc464aeefbd4af9651326ffcf6c340f0f11feceff56b765effd4581028ac19f
Instruction Fuzzy Hash: 8B21D270A40114BAEB006BA5CC49AFFBBACEF05354F10046BFA01E32D1D7BD9D119B68

Function 00402090 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403615: GetClassNameW.USER32(?,?,000000FF), ref: 00403638

SendMessageW.USER32(?,00000186,?,00000000), ref: 0040210A
GetDlgCtrlID.USER32(00000000), ref: 0040211B
GetParent.USER32 ref: 0040212D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00402134
GetDlgCtrlID.USER32(00000000), ref: 0040213A
GetParent.USER32 ref: 00402150
SendMessageW.USER32(00000000,?,00000111,?), ref: 00402157

Strings

ComboBox, xrefs: 00402098
ListBox, xrefs: 004020CB

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 058d31418dbd8a0dd80f7aa592518e0b022582e3849baf126690bb8faf79cddf
Instruction ID: 05ed0ba99410c3e0f3fe6d4b3ee9bd10ce47225c1c5e52cfe5d4c2d80d5dfc30
Opcode Fuzzy Hash: 058d31418dbd8a0dd80f7aa592518e0b022582e3849baf126690bb8faf79cddf
Instruction Fuzzy Hash: 3D11B770A41225BAEB006765CC49AFEBBACEF05354F100467F611E72D2D7B99C119B68

Function 004414CA Relevance: 15.2, APIs: 10, Instructions: 163windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00441536
SendMessageW.USER32(00000000), ref: 00441539
_memset.LIBCMT ref: 0044155E
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00441572
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 004415D4
SendMessageW.USER32(?,00001074,?,00000007), ref: 0044160F
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00441630
SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 0044164F
SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 00441664
SendMessageW.USER32(?,00001008,?,00000007), ref: 004416B8

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$_memset
String ID:
API String ID: 1515505866-0
Opcode ID: 18c1d5e27dea04332ca6e0819c9243cfb120140a5bae5d5ab9062ab27ac6ec1e
Instruction ID: 0b3a27045f77bb261558ba6fe20a6bc2357bdfe3a9e411e34c8443787e130321
Opcode Fuzzy Hash: 18c1d5e27dea04332ca6e0819c9243cfb120140a5bae5d5ab9062ab27ac6ec1e
Instruction Fuzzy Hash: B6517D71900248BFEF11DF94CC41BEE7BB5AF09314F14015AFA10AB2E1D7B9A995CB58

Function 0040828C Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004082AD
GetForegroundWindow.USER32(00000000), ref: 004082C1
GetWindowThreadProcessId.USER32(00000000), ref: 004082CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 004082E1
GetWindowThreadProcessId.USER32(?,00000000), ref: 004082EF
AttachThreadInput.USER32(00000000,00000000,00000001,?,00000000), ref: 00408304
AttachThreadInput.USER32(?,00000000,00000001,?,00000000), ref: 00408314
AttachThreadInput.USER32(00000000,00000000), ref: 00408359
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 0040836D
AttachThreadInput.USER32(?,00000000), ref: 00408379

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 00dce79af4b6e74bbe8857b7e4496ad65dd51a2c598fa8e692184e87f073a769
Instruction ID: 50dc5e60f148f27fb3ca6f26ab3f4511777edfbedc2d90d1776252501f3e1413
Opcode Fuzzy Hash: 00dce79af4b6e74bbe8857b7e4496ad65dd51a2c598fa8e692184e87f073a769
Instruction Fuzzy Hash: 6A310F70D04204ABCF20DB65DE8496EBBB9AB84750F10847FE841A32A0EB759940CFD8

Function 0041991A Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 429sleepCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00489FEC), ref: 0041997E
InterlockedDecrement.KERNEL32(00489FEC), ref: 0041998F
Sleep.KERNEL32(0000000A), ref: 00419997
InterlockedIncrement.KERNEL32(00489FEC), ref: 0041999E

Part of subcall function 0041A21D: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 0041A230

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

InterlockedDecrement.KERNEL32(00489FEC), ref: 00419A9D
InterlockedDecrement.KERNEL32(00489FEC), ref: 00419B4D
InterlockedDecrement.KERNEL32(00489FEC), ref: 00419EA2

Strings

@COM_EVENTOBJ, xrefs: 00419ACC, 00419E3C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Interlocked$Decrement$IncrementMessage$Sleep
String ID: @COM_EVENTOBJ
API String ID: 1589888435-2228938565
Opcode ID: 9b5ab465844ed267d5c0b46cf64b12a0b5f25561b8c5908cbb1292f01aa0d31c
Instruction ID: 3ee6a0e4d9e5fa6965528ff373595e1c8ad8c7d67fadfee303b63a2ab6fb0d70
Opcode Fuzzy Hash: 9b5ab465844ed267d5c0b46cf64b12a0b5f25561b8c5908cbb1292f01aa0d31c
Instruction Fuzzy Hash: 03F17971D002099BCF14EFA5D8859EEB7B8BF04308F14446BE915B7292DB38AD85CF59

Function 00422F2E Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 376COMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 00426BE9: GetForegroundWindow.USER32(?), ref: 00426BEF
Part of subcall function 00426BE9: GetWindowRect.USER32(00000000,?), ref: 00426C01

SelectObject.GDI32(?,00000000), ref: 00423173
SelectObject.GDI32(?,?), ref: 0042319B
_malloc.LIBCMT ref: 004231AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 004231C4
DeleteObject.GDI32(?), ref: 004231D8
DeleteDC.GDI32(?), ref: 004231E1
GetPixel.GDI32(00000007,00000000,?), ref: 00423292

Strings

(, xrefs: 00423132

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Object$DeleteSelectWindow$BitsForegroundMessagePixelRect_malloc
String ID: (
API String ID: 983436255-3887548279
Opcode ID: 47b61701bc552d267229bd066d33c132dade2bd46a011742c1a10bb4d088939b
Instruction ID: a5e41a1a77a1299046c64ea68ed5ec73a8b615b4a5998ca350ee3f67d2e1f268
Opcode Fuzzy Hash: 47b61701bc552d267229bd066d33c132dade2bd46a011742c1a10bb4d088939b
Instruction Fuzzy Hash: 47E1CD30E04269AFCF10DFE8D8856EEBFB2AF05314F5440ABE550B7282C7795A45CB69

Function 0040904A Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 349COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0040906A

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

_strlen.LIBCMT ref: 0040907E

Part of subcall function 0044E9ED: std::exception::exception.LIBCMT ref: 0044EA3C
Part of subcall function 0044E9ED: __CxxThrowException@8.LIBCMT ref: 0044EA51

VkKeyScanA.USER32(00000000), ref: 00409119
_sprintf.LIBCMT ref: 00409198
VkKeyScanA.USER32(00000000), ref: 004091CD

Part of subcall function 004083F6: VkKeyScanA.USER32(?), ref: 00408405

Strings

0%d, xrefs: 00409192
off, xrefs: 0040915A
down, xrefs: 0040912C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Scan$_strlen$Exception@8Throw_malloc_sprintfstd::exception::exception
String ID: 0%d$down$off
API String ID: 1688272004-2112978555
Opcode ID: f8405180154c2ad1bda66c28b87ceb93a524735fab348719485f1fc0a96b7980
Instruction ID: f5728bd3138d434e1ba3f10ec5be52ab0f7b3eb3d45a64e729055742662fe48e
Opcode Fuzzy Hash: f8405180154c2ad1bda66c28b87ceb93a524735fab348719485f1fc0a96b7980
Instruction Fuzzy Hash: 02C11430609205AAEF148F55C845FBABB71AB45708F1480BFEA417B2C3D67C9D46C75A

Function 0041835A Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 302comCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0041839C
mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 004183BD
UnregisterHotKey.USER32(?), ref: 00418409
FindClose.KERNEL32(?), ref: 004184C5
FreeLibrary.KERNEL32(?), ref: 00418557
VirtualFree.KERNEL32(00008000,00000000,00008000), ref: 004185A9
OleUninitialize.OLE32(0046BF68,00000000,00000000,00000000), ref: 00418679

Strings

close all, xrefs: 004183B8

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Free$Library$CloseFindSendStringUninitializeUnregisterVirtual
String ID: close all
API String ID: 1612041120-3243417748
Opcode ID: 68be926c66576e1d8846893f2918f271ce3e1968c2550404712fc11ce528ba7f
Instruction ID: 0ff10385bef7f6db31c5dadedc31ded73952fb4dca2b603beea13e40fd44ac3a
Opcode Fuzzy Hash: 68be926c66576e1d8846893f2918f271ce3e1968c2550404712fc11ce528ba7f
Instruction Fuzzy Hash: FCB16931504044EFC611BBAAEC8295D37A2FB46398755483FF901A7272CF39AC859B6E

Function 0042962D Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 275COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0042969B, 004298F9
Not an Object type, xrefs: 00429684
Conversion of parameters failed, xrefs: 00429755

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID:
String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
API String ID: 0-4206948668
Opcode ID: e1edff6608c6ab453c0962dbba3e1aa7d19bbba4afbdb0fab0e52803f9b798d9
Instruction ID: 2b6a14bd9c65df6ab39adb27a746a7df4833eff62a681db2248999a97ff7cbc4
Opcode Fuzzy Hash: e1edff6608c6ab453c0962dbba3e1aa7d19bbba4afbdb0fab0e52803f9b798d9
Instruction Fuzzy Hash: 84A1AB71A10219AFDF14EFA5E885AEEB7B5EF44300F64401FF911A7290E7B89D40CB59

Function 00405841 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 226libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0000007F,00000000), ref: 004058C3
GetProcAddress.KERNEL32(0000007F,AU3_FreeVar), ref: 004058D0
_malloc.LIBCMT ref: 004058FB
_strlen.LIBCMT ref: 00405982
_malloc.LIBCMT ref: 0040598A
_strcat.LIBCMT ref: 00405995

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Strings

AU3_FreeVar, xrefs: 004058C5
@, xrefs: 004058DB

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressProc_malloc$Message_strcat_strlen
String ID: @$AU3_FreeVar
API String ID: 3818856688-3964185217
Opcode ID: bbe1dbf115c381996aeb7fe85691c8f22739b07111eb0eb0de39e5aa615e2dfd
Instruction ID: 7b7d5ff8284fc4041242c1ba779b5e8589bdbe3cda2b5c1156322a13c702428e
Opcode Fuzzy Hash: bbe1dbf115c381996aeb7fe85691c8f22739b07111eb0eb0de39e5aa615e2dfd
Instruction Fuzzy Hash: 3371A172A00A0A9FDF10AF65C8819AFB7A0FF04315B14453FE805B7291DB7C9950CF59

Function 00441336 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004413E0
SendMessageW.USER32(?,00001036,00000000,00000010), ref: 004413EE
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,00000010,00000010,SysListView32,0046BF68,00000000,?), ref: 00441406
_wcscat.LIBCMT ref: 00441443
SendMessageW.USER32(?,00001057,00000000,?), ref: 0044145A
SendMessageW.USER32(?,00001061,00000000,0000000F), ref: 0044148C

Strings

SysListView32, xrefs: 004413AF
-----, xrefs: 0044143B

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: -----$SysListView32
API String ID: 307300125-3975388722
Opcode ID: fbc3f1b382f2f08d9b76450400f4fbce971e13ec3d97e422298fba314c43feb9
Instruction ID: 3786c749294728af4032415c0016cb3ab033b9624890b586acd3afe4326a6c11
Opcode Fuzzy Hash: fbc3f1b382f2f08d9b76450400f4fbce971e13ec3d97e422298fba314c43feb9
Instruction Fuzzy Hash: 86417D31900208EBEF219F64C845BDE7FF4EF08758F15016BF904A62A2D3B99984CF98

Function 00406857 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0040690C
_wcscat.LIBCMT ref: 00406915
_wcscpy.LIBCMT ref: 0040692B
_wcscpy.LIBCMT ref: 00406948
_wcscat.LIBCMT ref: 00406951
_wcscpy.LIBCMT ref: 00406967

Strings

*p@, xrefs: 00406937, 004068FD
*p@, xrefs: 004068F0, 0040694D, 00406911

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscpy$_wcscat
String ID: *p@$*p@
API String ID: 2037614760-3860410141
Opcode ID: f95e2a06ec0da33a2b24b0d729009966363cce38e9ac136e28d218356bd140dc
Instruction ID: 022abc65a565040fc7d37f2956060ce9ced7e950940044f8a832aa398059bc0a
Opcode Fuzzy Hash: f95e2a06ec0da33a2b24b0d729009966363cce38e9ac136e28d218356bd140dc
Instruction Fuzzy Hash: DD312BB3404215B9DF21BBAA8841ABE7764FF10354F86507BE843365C3CA3D98B2939D

Function 0040CC93 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C4DB: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\regsvr.exe,00000104,0048D8B0,C:\Users\user\Desktop\regsvr.exe,?,?,00406C7E,C:\Users\user\Desktop\regsvr.exe,00000104), ref: 0040C4F9

lstrcmpiW.KERNEL32(?,?), ref: 0040CCC8
MoveFileW.KERNEL32(?,?), ref: 0040CCFE
GetFileAttributesW.KERNEL32(?), ref: 0040CD1A
GetFileAttributesW.KERNEL32(?), ref: 0040CD34
GetFileAttributesW.KERNEL32(?), ref: 0040CD5E
_wcscat.LIBCMT ref: 0040CD79
SHFileOperationW.SHELL32(?), ref: 0040CDD8

Strings

\*.*, xrefs: 0040CD73

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: File$Attributes$FullMoveNameOperationPath_wcscatlstrcmpi
String ID: \*.*
API String ID: 2423804421-1173974218
Opcode ID: 927f2329cea3fb4c51c27dd48eaea2a043cee003714d341157ec5d111fdfb4ab
Instruction ID: ab64a8b1db66391e6fb00298c530c9a8b07241a67b377dfd1c09853d48533d42
Opcode Fuzzy Hash: 927f2329cea3fb4c51c27dd48eaea2a043cee003714d341157ec5d111fdfb4ab
Instruction Fuzzy Hash: A84141B180421DAADF10DFB49C859DEB7BCAF09318F5046BBE514F3181E738D6498B58

Function 0043DA04 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000005,80000000,80000000,80000000,80000000,00000000,00000000,00000000,?), ref: 0043DAA3
SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 0043DAC0
GetDesktopWindow.USER32 ref: 0043DAC9
GetWindowRect.USER32(00000000), ref: 0043DAD0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0043DAE1
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0043DAF5

Strings

tooltips_class32, xrefs: 0043DA9C
,, xrefs: 0043DA3E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSendWindow$CreateDesktopRect
String ID: ,$tooltips_class32
API String ID: 1032049750-3856767331
Opcode ID: b71b3153f9e58f7de3c7429db650863082a38fe5874105050f6b307e3bdd4bad
Instruction ID: 72087242910ebef34e86a35f731a7ee3f814ce733571841e93bf40c08d15fd13
Opcode Fuzzy Hash: b71b3153f9e58f7de3c7429db650863082a38fe5874105050f6b307e3bdd4bad
Instruction Fuzzy Hash: 89318471A40204BFDB10EFA8DD84EAE7BFCFB49704F14446AFA45E3250D6B999118B64

Function 00409980 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 79libraryfileloaderCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,?), ref: 004099B6
OpenProcess.KERNEL32(00000438,00000000,?,?,?,?,?,?,004024F8,00000028), ref: 004099CC
LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,?,?,004024F8,00000028), ref: 004099E1
GetProcAddress.KERNEL32(00000000,VirtualAllocEx), ref: 004099F3
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,?,00000000,?,?,?,?,?,004024F8,00000028), ref: 00409A2A
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,?,?,?,004024F8,00000028), ref: 00409A41

Strings

VirtualAllocEx, xrefs: 004099ED
kernel32.dll, xrefs: 004099DC

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: FileProcess$AddressCreateLibraryLoadMappingOpenProcThreadViewWindow
String ID: VirtualAllocEx$kernel32.dll
API String ID: 687405250-4123781057
Opcode ID: c1904b9fc30f0923417b7caee397edb0c7834f94d5a4b0b1f195fa57dd2270dc
Instruction ID: 2882448cedf50eb8beea9744bd510d06e24e8b8e6f3abb65c43c34375462d8d3
Opcode Fuzzy Hash: c1904b9fc30f0923417b7caee397edb0c7834f94d5a4b0b1f195fa57dd2270dc
Instruction Fuzzy Hash: 0B21BBB2200209FFDB105F54CC84D7BBBA8FB44359B10453EF696D6291E7749D40DB65

Function 0041CB99 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 79COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0041CBA6

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0041CBF9
GetLastError.KERNEL32 ref: 0041CC03

Strings

UNKNOWN, xrefs: 0041CC23
NOTREADY, xrefs: 0041CC2A
INVALID, xrefs: 0041CC3D
READONLY, xrefs: 0041CC36
READY, xrefs: 0041CC44

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Error$DiskFreeLastMessageModeSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 409837840-14809454
Opcode ID: c8f04cff7802e7b550b6909b707ad5a85df5219d4a75975e8ca64b08b7213ab5
Instruction ID: 86a4153a38fc339fd75b69d753cbf489c997190e597aa3f288f9b7e6b871df22
Opcode Fuzzy Hash: c8f04cff7802e7b550b6909b707ad5a85df5219d4a75975e8ca64b08b7213ab5
Instruction Fuzzy Hash: 9121F63264420C66C710ABB99D8AEEF7764EB05708B104537F805E6281FA7CDD8186DE

Function 0041C8B6 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0041C8C3

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

GetDriveTypeW.KERNEL32(?), ref: 0041C904

Strings

RAMDisk, xrefs: 0041C929
Unknown, xrefs: 0041C922
Network, xrefs: 0041C937
CDROM, xrefs: 0041C930
Removable, xrefs: 0041C945
Fixed, xrefs: 0041C93E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: DriveErrorMessageModeType
String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown
API String ID: 3517251692-706929342
Opcode ID: ea9674b7f96dd6e8c38ccc7ad4dd001dece2156570b2d707ac315991a02d9240
Instruction ID: 392e7c7a8151e9c811c593dc5e31bd8079697a73d10b334e2292953d4f7c4739
Opcode Fuzzy Hash: ea9674b7f96dd6e8c38ccc7ad4dd001dece2156570b2d707ac315991a02d9240
Instruction Fuzzy Hash: BC11B6716A810866CB106775DD87ADE3710FB41758B244437B842E62D1EABCECC5869F

Function 0043ACC5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 53registrywindowclipboardCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 0043ACE4
RegisterClassExW.USER32(?), ref: 0043AD2F
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 0043AD3A
LoadIconW.USER32(000000A9), ref: 0043AD7D

Strings

TaskbarCreated, xrefs: 0043AD35
AutoIt v3 GUI, xrefs: 0043AD21
0, xrefs: 0043AD09
+, xrefs: 0043AD10

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: 7a5340438e9abfa1dc68b2dfb1a54458dac8bd12a51d9f26fcb4f8d674e4c82e
Instruction ID: 06e444212cd24750f076d9bf8612b824658396df9a0845f6f816f80cf5a3ffae
Opcode Fuzzy Hash: 7a5340438e9abfa1dc68b2dfb1a54458dac8bd12a51d9f26fcb4f8d674e4c82e
Instruction Fuzzy Hash: F021F771910208EFEB00DFA4ED49BDD7BB4FB09315F10452AE611AA2A0D7F90588CF9A

Function 0040BB27 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000100,?,?,C:\Users\user\Desktop\regsvr.exe), ref: 0040BB4A
LoadStringW.USER32(00000000), ref: 0040BB53
GetModuleHandleW.KERNEL32(00000000,00000068,?,00000100), ref: 0040BB62
LoadStringW.USER32(00000000), ref: 0040BB65
_printf.LIBCMT ref: 0040BB87
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0040BBA5

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0040BB82
C:\Users\user\Desktop\regsvr.exe, xrefs: 0040BB30

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: HandleLoadModuleString$Message_printf
String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\regsvr.exe
API String ID: 220974073-1598792518
Opcode ID: 410cc36363009af3a828ebe82d38b221ee0da9a61af9ecc01913751088ecc8cc
Instruction ID: 5acaa4a208e78139c3278e61eb18a7e01496dd17d942a65ec290cd73e2407d83
Opcode Fuzzy Hash: 410cc36363009af3a828ebe82d38b221ee0da9a61af9ecc01913751088ecc8cc
Instruction Fuzzy Hash: 5C014FE690021C7BE711A7948D85EE7776CDB08344F0044E7BB45F3081EAB4AE854BB9

Function 0041BBF4 Relevance: 13.8, APIs: 9, Instructions: 291COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041BC1A

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

_wcsncpy.LIBCMT ref: 0041BC6D
_wcsncpy.LIBCMT ref: 0041BC9C
_wcsncpy.LIBCMT ref: 0041BCC6
_wcstok.LIBCMT ref: 0041BCDF
_wcstok.LIBCMT ref: 0041BD6B
_wcscpy.LIBCMT ref: 0041BDC3
_memset.LIBCMT ref: 0041BE1A
7516D1A0.COMDLG32(?), ref: 0041BF8C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcsncpy$_memset_wcstok$7516Message_wcscpy
String ID:
API String ID: 2115595892-0
Opcode ID: 0e559741c3888d59b009d31f6b999150e70e14ff6c3c65a09e0af5efa8614e03
Instruction ID: 397846afa9139c6f5dca488184eb05a1e01a655e80fe63b60f0869703a8c41e1
Opcode Fuzzy Hash: 0e559741c3888d59b009d31f6b999150e70e14ff6c3c65a09e0af5efa8614e03
Instruction Fuzzy Hash: 92A19F71A00208AADB10EFA6DC829DE7778EF44318F10457FF905B7291EB389A45CF99

Function 0045B0D3 Relevance: 13.7, APIs: 9, Instructions: 186COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0045B0E8
__calloc_crt.LIBCMT ref: 0045B0FB

Part of subcall function 00456F77: __calloc_impl.LIBCMT ref: 00456F85
Part of subcall function 00456F77: Sleep.KERNEL32(00000000), ref: 00456F9C

__calloc_crt.LIBCMT ref: 0045B17E
GetFileType.KERNEL32(00000038), ref: 0045B1FE
___crtInitCritSecAndSpinCount.LIBCMT ref: 0045B232
GetStdHandle.KERNEL32(-000000F6), ref: 0045B288
GetFileType.KERNEL32(00000000), ref: 0045B29A
___crtInitCritSecAndSpinCount.LIBCMT ref: 0045B2C8
SetHandleCount.KERNEL32 ref: 0045B2F2

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: 80740bbc2d17eae80b4dfef83e4b3a6a20bfcda720d9ae8a9b7640f2f53294c5
Instruction ID: 48c50c1279a8d309dc57ed5b7784ba91ad1eca9906c5f1647642182917357f77
Opcode Fuzzy Hash: 80740bbc2d17eae80b4dfef83e4b3a6a20bfcda720d9ae8a9b7640f2f53294c5
Instruction Fuzzy Hash: 1E6129715047418EC7118B68DC48B2A7BE0EF12336F24879AEC659B2E2D738D449CBA9

Function 0040EC0D Relevance: 13.6, APIs: 9, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

_wcscpy.LIBCMT ref: 0040EC6A
VariantInit.OLEAUT32(?), ref: 0040ECB8
VariantInit.OLEAUT32(?), ref: 0040ECBE
VariantInit.OLEAUT32(?), ref: 0040ECC4
VariantInit.OLEAUT32(?), ref: 0040ECCA
VariantInit.OLEAUT32(?), ref: 0040ECD3
VariantInit.OLEAUT32(?), ref: 0040ECD9
VariantInit.OLEAUT32(?), ref: 0040ECE2
VariantInit.OLEAUT32(?), ref: 0040ECEB

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: InitVariant$_malloc_wcscpy
String ID:
API String ID: 2582978398-0
Opcode ID: a873a48c15ae24db8172ee45b037f6d4f3e101b9b092cb8e25fb18ebb97c53a8
Instruction ID: 8068e766eda6158f977d13777cf56e68e33163e75965930f06032a1715f00e58
Opcode Fuzzy Hash: a873a48c15ae24db8172ee45b037f6d4f3e101b9b092cb8e25fb18ebb97c53a8
Instruction Fuzzy Hash: 4A3150B290064AAFDB00DFB6DC8499ABBACFF48304704892BE919C3641D779E564CF95

Function 00435523 Relevance: 13.6, APIs: 9, Instructions: 70fileCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(000000FF,000000FF,00000000,?,?,?,004354E8,000000FF,?,?,00000000,000000FF,?,?,00435273,?), ref: 00435533
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,?,?,004354E8,000000FF,?,?,00000000,000000FF,?,?,00435273), ref: 0043554A
ReadFile.KERNEL32(000000FF,?,?,?,00000000,?,?,?,004354E8,000000FF,?,?,00000000,000000FF), ref: 00435564
GetLastError.KERNEL32(?,?,?,004354E8,000000FF,?,?,00000000,000000FF,?,?,00435273,?,00000000,00000000), ref: 0043556E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,?,?,004354E8,000000FF,?,?,00000000,000000FF,?,?,00435273), ref: 0043557D
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,?,?,?,004354E8,000000FF,?,?,00000000,000000FF,?,?,00435273), ref: 00435589
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,?,?,004354E8,000000FF,?,?,00000000,000000FF,?,?,00435273), ref: 00435595
SetLastError.KERNEL32(00000000,?,?,?,004354E8,000000FF,?,?,00000000,000000FF,?,?,00435273,?,00000000,00000000), ref: 004355A0
SetLastError.KERNEL32(00000006,000000FF,00000000,?,?,?,004354E8,000000FF,?,?,00000000,000000FF,?,?,00435273,?), ref: 004355AD

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: File$Pointer$ErrorLast$ReadType
String ID:
API String ID: 74101062-0
Opcode ID: 7f8a67f42752878d4db513beec11ca89d9747497a064c1adce2420c73804a72b
Instruction ID: fdde7ecccd58ccd28b5323eca001b2279be93b57a860fd9bb9e787b15cd71c66
Opcode Fuzzy Hash: 7f8a67f42752878d4db513beec11ca89d9747497a064c1adce2420c73804a72b
Instruction Fuzzy Hash: 25116D71900108BFDB119F60CC88C7F3B6EEF493A8B004066F90596254E7749D519BB6

Function 00401E83 Relevance: 13.6, APIs: 9, Instructions: 57sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403679: SendMessageTimeoutW.USER32(0046BF68,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00403696
Part of subcall function 00403679: GetWindowThreadProcessId.USER32(0046BF68,00000000), ref: 004036AB
Part of subcall function 00403679: GetCurrentThreadId.KERNEL32 ref: 004036B2
Part of subcall function 00403679: AttachThreadInput.USER32(00000000,?,004034E9), ref: 004036B9

MapVirtualKeyW.USER32(00000025,00000000), ref: 00401E9A
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00401EB8
Sleep.KERNEL32(00000000,?,00000000,00438ABA,00000001,TABRIGHT,TABLEFT,ISENABLED,ISVISIBLE), ref: 00401EBB
MapVirtualKeyW.USER32(00000025,00000000), ref: 00401EC4
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00401EDC
Sleep.KERNEL32(00000000,?,00000000,00438ABA,00000001,TABRIGHT,TABLEFT,ISENABLED,ISVISIBLE), ref: 00401EDF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00401EE8
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00401EFC
Sleep.KERNEL32(00000000,?,00000000,00438ABA,00000001,TABRIGHT,TABLEFT,ISENABLED,ISVISIBLE), ref: 00401EFF

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message$PostSleepThreadVirtual$AttachCurrentInputProcessSendTimeoutWindow
String ID:
API String ID: 2686503918-0
Opcode ID: 6702793ced17b5000555f012982d37de520cdebba95b8c9214a6444e52a16c55
Instruction ID: 0c26a11094f54464014c0082303f67214ec380c461f44fb37c6c4937c8f06428
Opcode Fuzzy Hash: 6702793ced17b5000555f012982d37de520cdebba95b8c9214a6444e52a16c55
Instruction Fuzzy Hash: A9018430144208BFF6202B52DC49F5A7E9DDB45789F110829F281690F0CAF768809A3D

Function 0042334A Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,00000005), ref: 0042341C
SelectObject.GDI32(?,?), ref: 00423446
GetDIBits.GDI32(?,00000005,00000000,00000005,00000000,?,00000000), ref: 0042347D

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

GetDIBits.GDI32(?,00000005,00000000,00000005,00000000,00000028,00000000), ref: 004234B0
DeleteObject.GDI32(00000005), ref: 004234BC
DeleteDC.GDI32(?), ref: 004234C5

Strings

(, xrefs: 0042345D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Object$BitsDeleteSelect$Message
String ID: (
API String ID: 3834983687-3887548279
Opcode ID: 31f3d09dbbab8a9a7916ca3ed333c302104f2726cd835eab182c2fe609e8a6c2
Instruction ID: 5ef8ba6460cd4f5894c0716c63a5e950ba004e219fd443c5a7bb488d96c086fd
Opcode Fuzzy Hash: 31f3d09dbbab8a9a7916ca3ed333c302104f2726cd835eab182c2fe609e8a6c2
Instruction Fuzzy Hash: C9918E72E00218AFCF149FA9DC455AEBFB5EF44305F24812AF905EB250DB788A81DF95

Function 00436812 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 202COMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 0040D6DA: _wcscpy.LIBCMT ref: 0040D700

_wcspbrk.LIBCMT ref: 004368E3
__swprintf.LIBCMT ref: 0043694C
__swprintf.LIBCMT ref: 00436984
_wcsncpy.LIBCMT ref: 004369C9
__swprintf.LIBCMT ref: 004369EB

Strings

diouxXeEfgGs, xrefs: 004368DD, 004369AF
%, xrefs: 00436A39

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __swprintf$Message_wcscpy_wcsncpy_wcspbrk
String ID: %$diouxXeEfgGs
API String ID: 2290775584-4092231847
Opcode ID: 474a544d5fd082cb3add2edce9d4a8518b88581eeeb0772be71d37c604d7588f
Instruction ID: 8e829415d4e2888d003b49b0ac72f3da4eac738e380e8e0951312a0f3b604c8c
Opcode Fuzzy Hash: 474a544d5fd082cb3add2edce9d4a8518b88581eeeb0772be71d37c604d7588f
Instruction Fuzzy Hash: 4A61D172418302A7D324EF69C88596BB3E4FF89314F51992FF881E2252E73CDD48875A

Function 00403FFD Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000000,?,00000400), ref: 00404034
GetWindowTextW.USER32(00000000,?,00000400), ref: 00404072
CharUpperBuffW.USER32(?,00000000), ref: 0040408F
GetClassNameW.USER32(00000000,?,00000400), ref: 00404100
GetWindowTextW.USER32(00000000,?,00000400), ref: 0040413B
GetClassNameW.USER32(00000000,?,00000400), ref: 004041A6

Strings

ThumbnailClass, xrefs: 0040410D, 004041B3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ClassName$TextWindow$BuffCharUpper
String ID: ThumbnailClass
API String ID: 2577230361-1241985126
Opcode ID: c443d0d7ae3d9b678318f17cdb92688f46da987f4315337c581a7a9ae3721be4
Instruction ID: cbfdf2b259f29ff357c7fb18f6592c22d514e08fd52421d574a0cc1a2151a8cb
Opcode Fuzzy Hash: c443d0d7ae3d9b678318f17cdb92688f46da987f4315337c581a7a9ae3721be4
Instruction Fuzzy Hash: 3B7153B1904108BFDF21DF61CC44AAABBB9FF44305F1480A7EA45B6196D734DE86CB54

Function 0040AC7F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 133windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,0000002C), ref: 0040AD10
IsMenu.USER32(?), ref: 0040AD26
CreatePopupMenu.USER32 ref: 0040AD62
GetMenuItemCount.USER32(?), ref: 0040ADC6
InsertMenuItemW.USER32(?,?,00000001,0000002C), ref: 0040ADED

Strings

2, xrefs: 0040AD4D
,, xrefs: 0040ACC7

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: ,$2
API String ID: 93392585-4146714288
Opcode ID: 921160202a71db988153040a7a0feacb5ed1cac0836cf639228291cf51a0be55
Instruction ID: ce37795ca049b3688bfd7b788b34a8157eec92823ee090c7dd515667bc4a57b8
Opcode Fuzzy Hash: 921160202a71db988153040a7a0feacb5ed1cac0836cf639228291cf51a0be55
Instruction Fuzzy Hash: 50518D70900305DBDF20DF64C848BAEBBA5AF54315F24863AE851A66D0E7B89960CB5A

Function 00440441 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,00000001,?,000000FF,000000FF,00000000,?,000000FF,000000FF,000000FF,static,00000000,00000000,00000001,?,00000000), ref: 004404DE
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00440508
SelectObject.GDI32(00000000,00000000), ref: 00440510
GetPixel.GDI32(00000000,00000000,00000000), ref: 00440519
DeleteDC.GDI32(00000000), ref: 00440523
FreeLibrary.KERNEL32(00000001), ref: 00440563

Strings

static, xrefs: 0044047A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: DeleteFreeLibraryMessageMoveObjectPixelSelectSendWindow
String ID: static
API String ID: 109832112-2160076837
Opcode ID: c0ee122fbbd450a017091c7509156a9de89e99f6e1020308d054f212af312c37
Instruction ID: 167ea03aa5bc884e29d185edfa03bee2b115640b5cf9c708f34112fddebfbf62
Opcode Fuzzy Hash: c0ee122fbbd450a017091c7509156a9de89e99f6e1020308d054f212af312c37
Instruction Fuzzy Hash: A4415F31800214BFDF119FA5DC48DDF3BB8EF89314F00426AFA25A22A0D7788925DF69

Function 0044482D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_logf.LIBCPMT ref: 0044489B
_logf.LIBCPMT ref: 004448B3
LineTo.GDI32(00000001,-00000010,?), ref: 004448D1
_logf.LIBCPMT ref: 004448F0
_logf.LIBCPMT ref: 00444908
LineTo.GDI32(00000001,-00000010,?), ref: 00444920

Strings

0DD, xrefs: 0044487B

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _logf$Line
String ID: 0DD
API String ID: 3969295912-1049506570
Opcode ID: 9926fbea29d853f44453643d4f9a3b2d157f64b9f27255005079a188cec1aab3
Instruction ID: 001683863537e4e2f1fb7a4e2a66078a22c61dedab29c50d73077a2e83936e49
Opcode Fuzzy Hash: 9926fbea29d853f44453643d4f9a3b2d157f64b9f27255005079a188cec1aab3
Instruction Fuzzy Hash: C331607150010DDFDF046F61EA495EE3F78FF50380F624559E88162165EB3889B1DF99

Function 00409BAD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0040A062: _wcscpy.LIBCMT ref: 0040A0FC
Part of subcall function 0040A062: _wcscpy.LIBCMT ref: 0040A10C
Part of subcall function 0040A062: _wcscpy.LIBCMT ref: 0040A12C
Part of subcall function 0040A062: _wcscpy.LIBCMT ref: 0040A137

DestroyCursor.USER32 ref: 00409BC1
DestroyCursor.USER32 ref: 00409BC9
DestroyCursor.USER32 ref: 00409BD1
DestroyCursor.USER32 ref: 00409BD9
DestroyCursor.USER32 ref: 00409BE1

Strings

Exit, xrefs: 00409C03
Script Paused, xrefs: 00409C0A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CursorDestroy$_wcscpy
String ID: Exit$Script Paused
API String ID: 256247387-2163292816
Opcode ID: aff04c1962ec9f604ca4ef7e1730cb15275b7ef46051e3d55d0575f8cae06274
Instruction ID: 8f6c6012ffaa7a46f9da8fc18a849473dbe864ac2d6ec31d78b766ae10b1b1ac
Opcode Fuzzy Hash: aff04c1962ec9f604ca4ef7e1730cb15275b7ef46051e3d55d0575f8cae06274
Instruction Fuzzy Hash: 7D114871E052109AE7116F26FC8141DBFA1FB05368750093FE208AB2B2DB365C86EB5D

Function 00434B25 Relevance: 12.2, APIs: 8, Instructions: 164registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 00433F9A: CharUpperBuffW.USER32(?,?,?,?,00000000), ref: 00433FAD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00434BD2
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00434BFB
RegCloseKey.ADVAPI32(?,00000000,00000000), ref: 00434C26
RegDeleteValueW.ADVAPI32(?,00000000), ref: 00434C54
RegCloseKey.ADVAPI32(?), ref: 00434C7C
RegCloseKey.ADVAPI32(?,00000002,00000000), ref: 00434CC2

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Close$BuffCharConnectDeleteMessageOpenRegistryUpperValue
String ID:
API String ID: 425017642-0
Opcode ID: db03612454f99240be60e479857bc9ca2623b636040d4cc89284cb58197a1023
Instruction ID: 42790630bcba0781485c117772ed592602506a2403a798fb9e9435d98c405882
Opcode Fuzzy Hash: db03612454f99240be60e479857bc9ca2623b636040d4cc89284cb58197a1023
Instruction Fuzzy Hash: 34518E72C00108BBCF10EFA1DC428EEB779EF48318F15556AF901B7291DB39AE409B69

Function 00408BF6 Relevance: 12.2, APIs: 8, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00408C1A
GetKeyboardState.USER32(?), ref: 00408C2F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00408C8F
PostMessageW.USER32(?,00000101,00000011,?), ref: 00408CB5
PostMessageW.USER32(?,00000101,?,?), ref: 00408CDF
PostMessageW.USER32(?,00000101,00000010,?), ref: 00408D05
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00408D2B
SetKeyboardState.USER32(?), ref: 00408D81

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: df5e2e4aab303cade1a2cb16f41a212c5d2a87eeb06e77b514950e68c2505f49
Instruction ID: d50dee0f36cc695c926402184e3c28f64805c0e7d6a461f6c5a839dea20ee8bc
Opcode Fuzzy Hash: df5e2e4aab303cade1a2cb16f41a212c5d2a87eeb06e77b514950e68c2505f49
Instruction Fuzzy Hash: 7551F67041475C6AEB214739CD45BFB7EE8DF01344F18886EF9D9AA1C2CA789D80DB64

Function 004089EA Relevance: 12.2, APIs: 8, Instructions: 157windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00408A12
GetKeyboardState.USER32(?), ref: 00408A27
SetKeyboardState.USER32(?), ref: 00408A91
PostMessageW.USER32(?,00000100,0000005B,?), ref: 00408ABD
PostMessageW.USER32(?,00000100,?,?), ref: 00408AE0
PostMessageW.USER32(?,00000100,00000010,?), ref: 00408AFF
PostMessageW.USER32(?,00000100,00000011,?), ref: 00408B1E
PostMessageW.USER32(?,00000100,00000012,?), ref: 00408B71

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 9bc574f981ab146678d9d502e8c91229ab6b776594551fb2521a4d86bc58e748
Instruction ID: c176879fab5291af0d8a1add5bc76fc150dff4048e8cf95a0208d22f89546653
Opcode Fuzzy Hash: 9bc574f981ab146678d9d502e8c91229ab6b776594551fb2521a4d86bc58e748
Instruction Fuzzy Hash: 5451E7B05007586EE72156798D89BFF7AB8EB40344F08486EF5E9A61D2CA7C6940DF24

Function 0043B988 Relevance: 12.1, APIs: 8, Instructions: 115COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 0043B9B0
GetSysColor.USER32(00000005), ref: 0043BA2D
GetSysColor.USER32(00000005), ref: 0043BA51
GetPixel.GDI32(00000000,00000000,00000000), ref: 0043BA72
SetTextColor.GDI32(?,?), ref: 0043BA90
SetBkMode.GDI32(00000000,00000001), ref: 0043BAA3
GetStockObject.GDI32(00000005), ref: 0043BAAB
SetBkColor.GDI32(?,00000000), ref: 0043BAB8

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Color$ModeObjectPixelStockText
String ID:
API String ID: 3335329649-0
Opcode ID: 3bbbc46cfc1cbb526f2e30048087870d29753e9ef8c7783330b90f7d664edd41
Instruction ID: 3e1a90b3df566b46fe10e2d7d2748dc1cf44321494f908229bf81397f2884963
Opcode Fuzzy Hash: 3bbbc46cfc1cbb526f2e30048087870d29753e9ef8c7783330b90f7d664edd41
Instruction Fuzzy Hash: 1E311930608A415BD6257B288C4877A7FC1EF4D324F182217F3A5867F2C3A88C9697DA

Function 00443B45 Relevance: 12.1, APIs: 8, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00443B5D
IsChild.USER32(00000000,00000000), ref: 00443B6F
SendMessageW.USER32(?,00000087,00000000,00000000), ref: 00443B8D
SendMessageW.USER32(?,00000087,00000000,00000000), ref: 00443B99
SendMessageW.USER32(?,000000B1,00000001,0000FFFF), ref: 00443BB7
SendMessageW.USER32(?,000000B1,00000000,FFFF0000), ref: 00443BD0
GetDlgCtrlID.USER32(?), ref: 00443BE2
SetFocus.USER32(00000000,00000000), ref: 00443BF8

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$Focus$ChildCtrl
String ID:
API String ID: 1532865770-0
Opcode ID: adcfbfc8f4f5a7a3d07d24f273a854bd55fc2bb8986d63186026e0eda8b803e3
Instruction ID: 02016402800605174c8f456f4301c2def5c8974382cd1f014edd1af86c621a2d
Opcode Fuzzy Hash: adcfbfc8f4f5a7a3d07d24f273a854bd55fc2bb8986d63186026e0eda8b803e3
Instruction Fuzzy Hash: 8511B4705043456BF7219F25DC05F2B7EE8EF40B49F14082DF581652D1D7B9E9088B9A

Function 0040EFEE Relevance: 12.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0040EFFF
VariantClear.OLEAUT32(?), ref: 0040F005
VariantClear.OLEAUT32(?), ref: 0040F00B
VariantClear.OLEAUT32(?), ref: 0040F011
VariantClear.OLEAUT32(?), ref: 0040F01A
VariantClear.OLEAUT32(?), ref: 0040F020
VariantClear.OLEAUT32(?), ref: 0040F029
VariantClear.OLEAUT32(?), ref: 0040F032

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 01bcccfa0623907894e5014d68cc07ce2b52f2e367987be76801a632a003bbfa
Instruction ID: 3b0ca1872af9b2dc67cb145a3d75ae535922fbc49dfa6bfd2e9439ef43d99484
Opcode Fuzzy Hash: 01bcccfa0623907894e5014d68cc07ce2b52f2e367987be76801a632a003bbfa
Instruction Fuzzy Hash: E0F0F9B6400B486ADA31E7B9DC48BC7B3DC6B84200F454D2AE696C3555DA78F188CB14

Function 0044432D Relevance: 10.7, APIs: 7, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 004446D9: DeleteObject.GDI32(00000000), ref: 00444712
Part of subcall function 004446D9: ExtCreatePen.GDI32(?,00000001,00000000,00000000,00000000,?,?,00000000,?,?), ref: 0044474D
Part of subcall function 004446D9: SelectObject.GDI32(?,00000000), ref: 0044475C
Part of subcall function 004446D9: BeginPath.GDI32(?), ref: 00444773
Part of subcall function 004446D9: SelectObject.GDI32(?,00000000), ref: 00444796

MoveToEx.GDI32(?,-00000010,00000001,?), ref: 004443D8
AngleArc.GDI32(?,-00000010,00000001), ref: 00444423

Part of subcall function 00444946: MoveToEx.GDI32(?,FFFFFFFE,00000000,00000000), ref: 00444984
Part of subcall function 00444946: _logf.LIBCPMT ref: 00444997
Part of subcall function 00444946: _logf.LIBCPMT ref: 004449B5
Part of subcall function 00444946: LineTo.GDI32(?,?,00000000), ref: 004449D1

LineTo.GDI32(?,-00000010,00000001), ref: 00444433
CloseFigure.GDI32(?), ref: 0044443A
Ellipse.GDI32(?,-00000010,?,?,?), ref: 00444486
Rectangle.GDI32(?,-00000010,00000001,-0000000F,00000002), ref: 004444E9

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Object$LineMoveSelect_logf$AngleBeginCloseCreateDeleteEllipseFigurePathRectangle
String ID:
API String ID: 2270488568-0
Opcode ID: a52131ab50e3b85b290a8081c4bdc1fef5849eb58601cfe73ee5f5e99f0f82b8
Instruction ID: 6da5b42c02b2d1dc1c9181ef8388f99a7fe77f5e4c1647829c6905155f29417e
Opcode Fuzzy Hash: a52131ab50e3b85b290a8081c4bdc1fef5849eb58601cfe73ee5f5e99f0f82b8
Instruction Fuzzy Hash: ED814770D04209AFEF15DF98C889BAEBBB4FF89314F14415AE511B7291C738AA118F69

Function 0043F166 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0043F1B8
GetWindowRect.USER32(?,?), ref: 0043F1E7
GetClientRect.USER32(?,00000000), ref: 0043F22D
GetWindowRect.USER32(?,?), ref: 0043F275
ScreenToClient.USER32(?,?), ref: 0043F29A

Strings

`, xrefs: 0043F33C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID: `
API String ID: 1296646539-2679148245
Opcode ID: 6621cd87d08a81463a1af69bd0c42f1ddb8f9a250b8d9b31ea92b7649d581b88
Instruction ID: 3465c166391d92f5db4c8a5de4a8853c6cb642f8e3b451863ea79ad7d3ba27c3
Opcode Fuzzy Hash: 6621cd87d08a81463a1af69bd0c42f1ddb8f9a250b8d9b31ea92b7649d581b88
Instruction Fuzzy Hash: 9F916B79E0070ADACB14CFA8C4846EFFBB1FF08314F14552AE995A3760E734A985CB59

Function 00435158 Relevance: 10.7, APIs: 7, Instructions: 221fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000), ref: 004351C6
GetStdHandle.KERNEL32(000000F6,0046BF68), ref: 00435207

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

GetLastError.KERNEL32(00000000), ref: 00435285
GetExitCodeProcess.KERNEL32(?,?), ref: 004352B8
GetLastError.KERNEL32(00000000), ref: 004352DE
ReadFile.KERNEL32(?,?,000000FF,?,00000000), ref: 00435387
GetLastError.KERNEL32(00000000), ref: 0043539C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ErrorLast$CodeExitFileHandleMessageProcessRead
String ID:
API String ID: 1559811874-0
Opcode ID: c1ac45fd72a0dccd27cae367a1e0dbfa12a937b3afbc219c3ea4479572b81519
Instruction ID: 9fc56297345dec3520d23637491176040ab01530f8cf5e1f777a7610d00f6f87
Opcode Fuzzy Hash: c1ac45fd72a0dccd27cae367a1e0dbfa12a937b3afbc219c3ea4479572b81519
Instruction Fuzzy Hash: D581F630904608EBCF10AF65C845AEE77B0AF09364F24827BF825A72D1D7788A85CB59

Function 00434EC2 Relevance: 10.7, APIs: 7, Instructions: 176registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 00433F9A: CharUpperBuffW.USER32(?,?,?,?,00000000), ref: 00433FAD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00434F71
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00434FB9
RegCloseKey.ADVAPI32(?,00000000,?,00000000), ref: 00434FFA
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0043502C
RegCloseKey.ADVAPI32(?,00000000,?,00000000), ref: 00435069
RegCloseKey.ADVAPI32(?), ref: 004350A4

Part of subcall function 00418B7F: GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000003), ref: 00418BA3
Part of subcall function 00418B7F: FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000003), ref: 00418BB5

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Close$Message$BuffCharConnectEnumErrorFormatLastOpenRegistryUpperValue
String ID:
API String ID: 980969892-0
Opcode ID: ff84b539c70bd5e76793e219b5fb035a86bd3b7778c90fc8dd44d9ec850093d9
Instruction ID: a467c0aaf9e2d002c05f2fb05d8bf625c584b4418078722113225be4f164aed1
Opcode Fuzzy Hash: ff84b539c70bd5e76793e219b5fb035a86bd3b7778c90fc8dd44d9ec850093d9
Instruction Fuzzy Hash: DB516172D00108ABCF04EFE1D8869DEBB79EF08318F14442BF501B7191DB78AE858B69

Function 00430E75 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00430E9F
_memset.LIBCMT ref: 00430F60
ShellExecuteExW.SHELL32(?), ref: 00430FA2

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 0040D6DA: _wcscpy.LIBCMT ref: 0040D700

CloseHandle.KERNEL32(?,00000001), ref: 00431044

Strings

open, xrefs: 00430E7E
@, xrefs: 00430F76

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset$CloseExecuteHandleMessageShell_wcscpy
String ID: @$open
API String ID: 124690895-267353779
Opcode ID: 32d48889e58fefe60ec297321213f7efe84e0b6c76905c8746730d97baa013ac
Instruction ID: 79a6f78ca9893277e11b525ad23edaa7b89c7971ea5e1db8a9703bc8aa29b47c
Opcode Fuzzy Hash: 32d48889e58fefe60ec297321213f7efe84e0b6c76905c8746730d97baa013ac
Instruction Fuzzy Hash: 33517C72D002589BCF20EFA1989699E77A4EB08318F14057BF905BB281DA7C9D85CB99

Function 00425D61 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 160sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00427AE9: LoadLibraryA.KERNEL32(kernel32.dll,00425D80), ref: 00427AF4
Part of subcall function 00427AE9: GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 00427B06

Sleep.KERNEL32(00000000), ref: 00425D89
Sleep.KERNEL32(00000000), ref: 00425E55
GlobalMemoryStatus.KERNEL32 ref: 00425E68
FreeLibrary.KERNEL32(?,?,?,?,?,?,00000003,00000002,00000001), ref: 00425F82

Strings

, xrefs: 00425E60
@, xrefs: 00425D8F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: LibrarySleep$AddressFreeGlobalLoadMemoryProcStatus
String ID: $@
API String ID: 3770225440-1077428164
Opcode ID: ae6e2769acdc6483d6691bdd2877241c15a1d48daa25edbb4aa56e45999e23f0
Instruction ID: 36fb34ed18304f52e7ebc4daf97624bf09186803a6b801568cd4d3704746d347
Opcode Fuzzy Hash: ae6e2769acdc6483d6691bdd2877241c15a1d48daa25edbb4aa56e45999e23f0
Instruction Fuzzy Hash: E8518D30708A14CBE3006F76ED4662AB7E4FF89B08F41486DF9D985292DBB98564C71F

Function 00454227 Relevance: 10.7, APIs: 7, Instructions: 158COMMON

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 00454240

Part of subcall function 004541AD: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004541BA
Part of subcall function 004541AD: GetOEMCP.KERNEL32(00000000), ref: 004541D4

setSBCS.LIBCMT ref: 00454252

Part of subcall function 00453F2A: _memset.LIBCMT ref: 00453F3D

IsValidCodePage.KERNEL32(-00000030), ref: 00454298
GetCPInfo.KERNEL32(00000000,?), ref: 004542AB
_memset.LIBCMT ref: 004542C3
setSBUpLow.LIBCMT ref: 00454396

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: bddb2742f32a086ef8fd86ce37615916aa239781cd33c37b6cde83547bbabe72
Instruction ID: 20e0eee75841bc2e5c60e20d229308ec88004ad5df90a6ae24ddff937b37c46d
Opcode Fuzzy Hash: bddb2742f32a086ef8fd86ce37615916aa239781cd33c37b6cde83547bbabe72
Instruction Fuzzy Hash: 4D51E830A042159BDB15CF65C4812BEBBB4EF8534AF1440ABEC95DF253D73C898ACB99

Function 00403337 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0040335E
__swprintf.LIBCMT ref: 004033F3
GetDlgCtrlID.USER32(?), ref: 0040341A
GetClassNameW.USER32(?,?,00000100), ref: 00403445
GetWindowTextW.USER32(?,?,00000400), ref: 0040347C

Strings

%s%u, xrefs: 004033ED

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ClassName$CtrlTextWindow__swprintf
String ID: %s%u
API String ID: 1494404061-679674701
Opcode ID: 096c522bd2d9aaca38537f46ee95da6ec7e5801da3ad91ee026391c232d43d37
Instruction ID: 0888d887ebef4d6566b50af7a3b30fa5b5dc89e100164802d73fcd70751c484f
Opcode Fuzzy Hash: 096c522bd2d9aaca38537f46ee95da6ec7e5801da3ad91ee026391c232d43d37
Instruction Fuzzy Hash: E441E972500704AFDB22DF61CC84AABBBBCFB00306F1045BBE546D6581E779FA898B55

Function 0043F639 Relevance: 10.6, APIs: 7, Instructions: 129windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 0043F6DD
ShowWindow.USER32(?,00000005,?,00000000), ref: 0043F6E3
SetFocus.USER32(?,?,00000000), ref: 0043F6EC

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ShowWindow$Focus
String ID:
API String ID: 3918694803-0
Opcode ID: 8b8c8c928160894ec18fd1c00cd3b4219fb3340570874c3d861df759491bb647
Instruction ID: 225f73440f05c295bf9ba1c591afbc958af972752b278ad712563bc184ad98ad
Opcode Fuzzy Hash: 8b8c8c928160894ec18fd1c00cd3b4219fb3340570874c3d861df759491bb647
Instruction Fuzzy Hash: 4E410A74D00204BEEF308F24CDC5F6E7B64AB0D364F20297BF542A27A1C779AD499A59

Function 0040DD6B Relevance: 10.6, APIs: 7, Instructions: 129timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0040DD75
_wcsncpy.LIBCMT ref: 0040DDDA
_wcsncpy.LIBCMT ref: 0040DE0B
_wcsncpy.LIBCMT ref: 0040DDAA

Part of subcall function 0044EF6A: _strtol.LIBCMT ref: 0044EF61

_wcsncpy.LIBCMT ref: 0040DE4D
_wcsncpy.LIBCMT ref: 0040DE83
_wcsncpy.LIBCMT ref: 0040DEB0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcsncpy$LocalTime_strtol
String ID:
API String ID: 3624483480-0
Opcode ID: 40cc7a637b6f2338651b91aa49790e24c7065cbc306a22772c63ecafda8aa6a9
Instruction ID: 5e051624fdc212ea3451c999b0155efd0865022393acda4f482468b8ee5f6b8c
Opcode Fuzzy Hash: 40cc7a637b6f2338651b91aa49790e24c7065cbc306a22772c63ecafda8aa6a9
Instruction Fuzzy Hash: B64182A2C11619B6DF10EBE6CC859EF73ACBF14308F45482BF915F3142E678D60987A9

Function 0045B722 Relevance: 10.6, APIs: 7, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 0045B739

Part of subcall function 0045546F: __FF_MSGBANNER.LIBCMT ref: 0045548B

__lock.LIBCMT ref: 0045B74D
__lock.LIBCMT ref: 0045B796
___crtInitCritSecAndSpinCount.LIBCMT ref: 0045B7B1
RtlEnterCriticalSection.NTDLL(?), ref: 0045B7D7
RtlLeaveCriticalSection.NTDLL(?), ref: 0045B7E4

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CriticalSection__lock$CountCritEnterInitLeaveSpin___crt__mtinitlocknum
String ID:
API String ID: 2236623020-0
Opcode ID: 340911b5a6da731d01b31620caaee38d199164dfaefa5e97a6627965af7cecf1
Instruction ID: b75c6b8aee8c271de0bc160daeda08099923d1da712b298870f45d695b404e12
Opcode Fuzzy Hash: 340911b5a6da731d01b31620caaee38d199164dfaefa5e97a6627965af7cecf1
Instruction Fuzzy Hash: B9413930D007068BDB20AF65C84576DBBE4EF45336F24821FD822562D2C77C8949CB9D

Function 00423A4E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00426BE9: GetForegroundWindow.USER32(?), ref: 00426BEF
Part of subcall function 00426BE9: GetWindowRect.USER32(00000000,?), ref: 00426C01

GetDesktopWindow.USER32 ref: 00423A7A
GetWindowRect.USER32(00000000), ref: 00423A81
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00423AB3

Part of subcall function 0040D649: Sleep.KERNEL32(000000FA,0048BA08,0048BA08,00000001,00000000,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe), ref: 0040D6CF

GetCursorPos.USER32(?), ref: 00423AE4

Strings

d, xrefs: 00423AD2

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$Rect$CursorDesktopForegroundSleepmouse_event
String ID: d
API String ID: 547981324-2564639436
Opcode ID: 83cee22ebd948f6d7cf26cbc37683e2e883b76dba3aadd7f2c49ba425ade0615
Instruction ID: 8df8fd94db31a35fb48a586cabb2f7c8105256e0e33bd1acbfcca329d50d5c7f
Opcode Fuzzy Hash: 83cee22ebd948f6d7cf26cbc37683e2e883b76dba3aadd7f2c49ba425ade0615
Instruction Fuzzy Hash: 0631E772308315AFD700DF54DC85F6A7BE9FB88308F40053AF588D6192E678EA49CB96

Function 00440EF7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,00000000,0000002C), ref: 00440F7C
IsMenu.USER32(?), ref: 00440F8F
CreatePopupMenu.USER32 ref: 00440F99
InsertMenuItemW.USER32(?,?,00000001,0000002C), ref: 00440FCB
DrawMenuBar.USER32(?), ref: 00440FD3

Strings

,, xrefs: 00440F09

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Menu$Item$CreateDrawInfoInsertPopup
String ID: ,
API String ID: 2727366139-3772416878
Opcode ID: b0d788992a31a387628c016495ab1bab4e0a02631a340dd072e6b7fd9bf57b65
Instruction ID: 6b78c16b7d82ca5ed1d585d58f60ca6dd34e1e15268e67fcb64b487a493cbbd9
Opcode Fuzzy Hash: b0d788992a31a387628c016495ab1bab4e0a02631a340dd072e6b7fd9bf57b65
Instruction Fuzzy Hash: AB319E75900208EFEF10CF54D844ADEBBB5FF48314F10816AE901AB360DBB4E919CB64

Function 004409A6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00440A00
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00440A0F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00440A1A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00440A29
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00440A35

Strings

Msctls_Progress32, xrefs: 004409D7

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend
String ID: Msctls_Progress32
API String ID: 3850602802-3636473452
Opcode ID: 697f27f51b90500546e756a9eaa3db5516726332e831bae7c374c23cda2bfaf1
Instruction ID: b92dbeaa2a059efcea1236ff011c2dea35a5b81120707142e99da2675fd37147
Opcode Fuzzy Hash: 697f27f51b90500546e756a9eaa3db5516726332e831bae7c374c23cda2bfaf1
Instruction Fuzzy Hash: C31173B1500219BEFF115F608C81EEB7F29FB14368F204126F714651A1C7765C61EB58

Function 0045492A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,0045499F,00000000,00460676,00000000,00000000,00000314,?,?,?,00478A90,00455345,00478A90,Microsoft Visual C++ Runtime Library,00012010), ref: 00454937
TlsGetValue.KERNEL32(00000006,?,?,?,00478A90,00455345,00478A90,Microsoft Visual C++ Runtime Library,00012010), ref: 0045494E
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00478A90,00455345,00478A90,Microsoft Visual C++ Runtime Library,00012010), ref: 00454963
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0045497E

Strings

KERNEL32.DLL, xrefs: 0045495E
EncodePointer, xrefs: 00454978

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 808edc22024412fc92907a0ad2dfa4efd85087c52e9ced06c6dec172512a9143
Instruction ID: 533f86644e208d988e5729208b4243dde29ae67d0476ed6a780933ee63da5ef4
Opcode Fuzzy Hash: 808edc22024412fc92907a0ad2dfa4efd85087c52e9ced06c6dec172512a9143
Instruction Fuzzy Hash: 98F0F6B01016239F8B215B34DC019AB7AD89F80369715413BFD1CD6371EB36CCC58A5E

Function 004549A1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00454A51,?,0045321E), ref: 004549AE
TlsGetValue.KERNEL32(00000006,?,0045321E), ref: 004549C5
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0045321E), ref: 004549DA
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004549F5

Strings

KERNEL32.DLL, xrefs: 004549D5
DecodePointer, xrefs: 004549EF

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: d360f46e1e7009b55880cfe4a8153529ec0e511f63e662ce4631ffc73fcc35e1
Instruction ID: 5865600a878e118214431f304109912cd63f15fec1153728a7111d625ecce679
Opcode Fuzzy Hash: d360f46e1e7009b55880cfe4a8153529ec0e511f63e662ce4631ffc73fcc35e1
Instruction Fuzzy Hash: 08F090B0105612AB97119B35DC0496B3A98AF81769B054137FC08DB3B1EB78CCC58AAE

Function 0043EA4A Relevance: 9.4, APIs: 6, Instructions: 419windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 0043EB10
SetMenu.USER32(?,00000000), ref: 0043EB1C
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0043EFA9
SelectObject.GDI32(00000000,00000000), ref: 0043EFB7
SelectObject.GDI32(00000000,?), ref: 0043EFCD
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,0041F974), ref: 0043F07E

Part of subcall function 0040FB8E: VariantClear.OLEAUT32(?), ref: 0040FBA8

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MenuObjectSelect$ClearCreateMessageMoveSendVariantWindow
String ID:
API String ID: 3124450003-0
Opcode ID: 04e2c97309e15f0b7c36aec3af94c50112fe3fa6c9cfe41d9cf8f9396a92371a
Instruction ID: 3b512a8d21eae42477d40c86f313bff1a5d2463d4effeef441b6316fbb0c2069
Opcode Fuzzy Hash: 04e2c97309e15f0b7c36aec3af94c50112fe3fa6c9cfe41d9cf8f9396a92371a
Instruction Fuzzy Hash: 31F15475900208EFCF11DFA9C8409EEBBB5FF4C318F11416AFA15A72A1C339A915DB69

Function 00459D25 Relevance: 9.2, APIs: 6, Instructions: 250COMMON

Download Yara Rule

APIs

__lseeki64.LIBCMT ref: 00459D68

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __lseeki64
String ID:
API String ID: 1457047535-0
Opcode ID: c3b436a5ed31a2c957ecc9bdbb847634a5603994dfcb4148424a658564f4665c
Instruction ID: 42937746112e8413a9c1ac339922f728f355006fcfe38c55f587a455e63e89f8
Opcode Fuzzy Hash: c3b436a5ed31a2c957ecc9bdbb847634a5603994dfcb4148424a658564f4665c
Instruction Fuzzy Hash: FC91C231A00305CFDB24CFA5C981BAEB7B5EF45306F24852ED95A9B293D7789C49CB09

Function 00427341 Relevance: 9.2, APIs: 6, Instructions: 195networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

select.WS2_32(00000000,?,00000000,00000000,?), ref: 00427413
WSAGetLastError.WS2_32(00000000,00000000,?,?,00000000,?,00000010,00000000,?,00000000,?,00000000,00000000,?,0046BF68), ref: 0042741E
__WSAFDIsSet.WSOCK32(00000000,?,00000000,?,00000000,00000000,?,0046BF68), ref: 00427440
inet_ntoa.WS2_32(?), ref: 00427486
htons.WS2_32(?), ref: 004274C1
_strlen.LIBCMT ref: 004274FD

Part of subcall function 0040DED4: _strlen.LIBCMT ref: 0040DEEB
Part of subcall function 0040DED4: MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,00000000,00000000,?,?,0040B8B1,00000000,?,00000000,?), ref: 0040DF05
Part of subcall function 0040DED4: MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,0040B8B1,00000000,?,00000000,?,00000FFF,00000000,0040B879), ref: 0040DF39

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLastMessagehtonsinet_ntoaselect
String ID:
API String ID: 169474820-0
Opcode ID: 10d9404e8603112583ddc4039bbeb60a2f50699b26ca687b2ac5954019e85098
Instruction ID: 6e0c69cd61be4cc5f269528603ffc3782b608e791363e538b283036aaec128aa
Opcode Fuzzy Hash: 10d9404e8603112583ddc4039bbeb60a2f50699b26ca687b2ac5954019e85098
Instruction Fuzzy Hash: 4351B731A04214BADB14ABF5AC46ADF77A9EF44324F24446FF501E71C2DA7C9D408B6D

Function 004399A1 Relevance: 9.1, APIs: 6, Instructions: 131windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00437A84: IsWindow.USER32(00000000), ref: 00437AB1

GetMenu.USER32(00000000), ref: 004399F5
GetMenuItemCount.USER32(?), ref: 00439A17
GetMenuStringW.USER32(?,00000000,?,00007FFF,00000400), ref: 00439A43
GetMenuItemID.USER32(?,00000000), ref: 00439A9E
GetSubMenu.USER32(?,00000000), ref: 00439AA9
PostMessageW.USER32(00000000,00000111,?,00000000), ref: 00439AF2

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Menu$Item$CountMessagePostStringWindow
String ID:
API String ID: 3481743490-0
Opcode ID: 1691902da14441a05051a724cd4b3b255826e61b5149bfa2e502c573869a565e
Instruction ID: 67941c42c60014dd09f3b9fefb958ce7e9d4e4dedf88b28e4c746eeb01a3303e
Opcode Fuzzy Hash: 1691902da14441a05051a724cd4b3b255826e61b5149bfa2e502c573869a565e
Instruction Fuzzy Hash: FB41D571E04218BBDB10ABA59C45AAEBBB4FF48314F14416BF504F7281D7B89E41CF99

Function 0043B613 Relevance: 9.1, APIs: 6, Instructions: 115keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0043B624
ScreenToClient.USER32(00000000,?), ref: 0043B641
GetAsyncKeyState.USER32(00000001), ref: 0043B681
GetKeyState.USER32(00000001), ref: 0043B68F
GetAsyncKeyState.USER32(00000002), ref: 0043B6A9
GetKeyState.USER32(00000002), ref: 0043B6B2

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: State$Async$ClientCursorScreen
String ID:
API String ID: 1890669589-0
Opcode ID: 632d3824c98a44142a6629b2c69fbb66ce52258f6baecd437a0d8d5fc89c5528
Instruction ID: e68edc413b1988579f9a0f30517d8b9ae4c20ae91bb67c17d214006dc1035c13
Opcode Fuzzy Hash: 632d3824c98a44142a6629b2c69fbb66ce52258f6baecd437a0d8d5fc89c5528
Instruction Fuzzy Hash: 0641B270A04105BFCF159FA4C849BE9BB74FF58368F109257EA24622E1C7786950CFDA

Function 00440DF3 Relevance: 9.1, APIs: 6, Instructions: 93windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000003,00000000,00004160,00000000,?,?,0043C2F6,?), ref: 00440E4A
EnableWindow.USER32(00000000,00000000), ref: 00440E5E
ShowWindow.USER32(00000003,00000000,00004160,00000000,?,?,0043C2F6,?), ref: 00440EAB
ShowWindow.USER32(00000000,00000004,?,?,0043C2F6,?), ref: 00440EB3
EnableWindow.USER32(00000000,00000001), ref: 00440EC7
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00440EEB

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: d442cd6f61d1f2eb60edba35bc5951856968bf1c1bdbe95bfc4ca9bf64b8f612
Instruction ID: 04e1f9be1dd60fe343278cffdea815464e7b55a2bb7467d10093015c31436ddc
Opcode Fuzzy Hash: d442cd6f61d1f2eb60edba35bc5951856968bf1c1bdbe95bfc4ca9bf64b8f612
Instruction Fuzzy Hash: 5F319EB0504340AFFB31DB28D884B967BF0AF05704F240C9AE6519B2A1C379EDB4DB19

Function 00444601 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 004446D9: DeleteObject.GDI32(00000000), ref: 00444712
Part of subcall function 004446D9: ExtCreatePen.GDI32(?,00000001,00000000,00000000,00000000,?,?,00000000,?,?), ref: 0044474D
Part of subcall function 004446D9: SelectObject.GDI32(?,00000000), ref: 0044475C
Part of subcall function 004446D9: BeginPath.GDI32(?), ref: 00444773
Part of subcall function 004446D9: SelectObject.GDI32(?,00000000), ref: 00444796

MoveToEx.GDI32(?,?,?,00000000), ref: 00444627
LineTo.GDI32(?,?,?), ref: 0044462F
MoveToEx.GDI32(?,?,?,00000000), ref: 0044463D
LineTo.GDI32(?,?,?), ref: 00444645
EndPath.GDI32(?), ref: 00444658
StrokePath.GDI32(?), ref: 00444666

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
String ID:
API String ID: 372113273-0
Opcode ID: 994ddddf9d201f7b03338eae7e5c2f3aab0ec1c5256e586afd36d0d25f8ad3e3
Instruction ID: ad4d0355907c7f6f3f9405d28c9002b125f499cf2e31db4bd4b76a32c17b4eaa
Opcode Fuzzy Hash: 994ddddf9d201f7b03338eae7e5c2f3aab0ec1c5256e586afd36d0d25f8ad3e3
Instruction Fuzzy Hash: 0CF0C2B2004248BFE320AB72EC4CF9B3B5CDBC6368F024525F602D6191E678A904CB79

Function 0040BC00 Relevance: 9.0, APIs: 6, Instructions: 41windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0040BC0F
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0040BC27
GetWindowThreadProcessId.USER32(?,?), ref: 0040BC39
OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 0040BC48
TerminateProcess.KERNEL32(00000000,00000000), ref: 0040BC52
CloseHandle.KERNEL32(00000000), ref: 0040BC59

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: a73f713adff4fe7835ce9ca597ba216ac3381ca59818c4e6d44cc076613e6194
Instruction ID: bdf738185f33ef483c2b98843bad14443f55a88d359c573a1cedbd21710165fd
Opcode Fuzzy Hash: a73f713adff4fe7835ce9ca597ba216ac3381ca59818c4e6d44cc076613e6194
Instruction Fuzzy Hash: 7BF06D76205118BBDB201B51DC0DEEF3E6CEF46BA9F004065FA06A40A0E7B15942DBA9

Function 0041D498 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 213comCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

CoInitialize.OLE32(00000000), ref: 0041D514
CoCreateInstance.COMBASE(004677D0,00000000,00000001,004677C0,?), ref: 0041D52B
_wcsncpy.LIBCMT ref: 0041D562
CoUninitialize.COMBASE ref: 0041D6BD

Strings

.lnk, xrefs: 0041D4CA, 0041D4CF, 0041D4DD

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CreateInitializeInstanceMessageUninitialize_wcsncpy
String ID: .lnk
API String ID: 838818076-24824748
Opcode ID: bd5e95774e99e44085864b2f5abfe0a59b2c17ea35c322b81c6ff74b6a01e153
Instruction ID: a872a461cc8d50caaa2b3f8997db518f3534c7efa4dbd710ffcac2bdd0e70920
Opcode Fuzzy Hash: bd5e95774e99e44085864b2f5abfe0a59b2c17ea35c322b81c6ff74b6a01e153
Instruction Fuzzy Hash: 9B619572600204AFDB14ABA1DC4AEDE3779EF85714F10445EF509EB1D1DAB9AE80CB58

Function 00431E3D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 133COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,00431775,?,?), ref: 00431E58

Strings

winapi, xrefs: 00431ED9
cdecl, xrefs: 00431EA7
stdcall, xrefs: 00431EF7
none, xrefs: 00431F77

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: b66d592f4f27b63a0f851651bd71964ec15a8cf0ea215bbb536c6a778a1c2908
Instruction ID: 81781ea8b2f6e403ff59936e65187d67ad1d0bebd1bf28a57343ce1c93d0d1ef
Opcode Fuzzy Hash: b66d592f4f27b63a0f851651bd71964ec15a8cf0ea215bbb536c6a778a1c2908
Instruction Fuzzy Hash: D7410A31900204ABDF01AB6ADC56BDDB771AF08324F10851BF915371E2CB7D9D15CB98

Function 00402165 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403615: GetClassNameW.USER32(?,?,000000FF), ref: 00403638

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 004021F0
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00402201
SendMessageW.USER32(?,00000189,00000000,00000000), ref: 0040222C

Strings

ComboBox, xrefs: 0040216D
ListBox, xrefs: 004021A7

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$ClassName
String ID: ComboBox$ListBox
API String ID: 787153527-1403004172
Opcode ID: 898ac08608374f15b5b16731521431cbb808f51328000e89ad0e24fb265d8cd6
Instruction ID: 9af8fa7d92531f2ec2c56fa7967ba8fa3a3339690c273f768e22c448ddef34d2
Opcode Fuzzy Hash: 898ac08608374f15b5b16731521431cbb808f51328000e89ad0e24fb265d8cd6
Instruction Fuzzy Hash: B2212470A40104BEEB006BA5CD0ABEEBB64DF01328F20416BF510B72E1DBBD5E129B59

Function 00440FE7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,00000000,0000002C), ref: 00441089
IsMenu.USER32(?), ref: 0044109C
InsertMenuItemW.USER32(?,?,00000001,0000002C), ref: 004410E4
DrawMenuBar.USER32(?), ref: 004410F4

Strings

,, xrefs: 00440FF9

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: ,
API String ID: 3076010158-3772416878
Opcode ID: c6d424252407d8f875bef89aa79cfb009d7e2d0d0ffdc2a44d3c02ee0069f7a6
Instruction ID: 94d219916aabe59cf8be8086ff4fa6ae86bf9718367653b9dd1110ae4213215f
Opcode Fuzzy Hash: c6d424252407d8f875bef89aa79cfb009d7e2d0d0ffdc2a44d3c02ee0069f7a6
Instruction Fuzzy Hash: A1318A70A00248EFEB20CF64D884A9ABBB5FB45304F15816AE911AB360D7B5DD85CFA5

Function 00409F5A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00409F7D
DestroyCursor.USER32(00000000), ref: 00409FC7
Shell_NotifyIconW.SHELL32(00000001,?), ref: 0040A040
Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040A049

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 00409F66, 00409F67

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: IconNotifyShell_$CursorDestroy_memset
String ID: C:\Users\user\Desktop\regsvr.exe
API String ID: 2080917435-2994071119
Opcode ID: 2e1054269ffcf066c85cc887bfceafdd98ff9cc22412f061c7e94965030fa91b
Instruction ID: 622c5b33f7b39ef390b4a455ff65f4841c0ac71e9bcdc7e13409dfded8dbb7b1
Opcode Fuzzy Hash: 2e1054269ffcf066c85cc887bfceafdd98ff9cc22412f061c7e94965030fa91b
Instruction Fuzzy Hash: A531FBB1604746AFC714DF24D884696BBE4FB44304F00493EE568E3391E7B5A9688BDA

Function 0041210B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00412164
_memset.LIBCMT ref: 0041216F
_memset.LIBCMT ref: 0041217B
_sprintf.LIBCMT ref: 00412196

Strings

%02X, xrefs: 00412190

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset$_sprintf
String ID: %02X
API String ID: 891462717-436463671
Opcode ID: b5b7a4a62f4357529c1e8bccbba1271ea6ef58b4b549224982d3f89143285198
Instruction ID: 9f2adef8050b744f28e7ad8e2a979b567bcd00562cc96329734852113e79bc63
Opcode Fuzzy Hash: b5b7a4a62f4357529c1e8bccbba1271ea6ef58b4b549224982d3f89143285198
Instruction Fuzzy Hash: 40112B717403083AD700F6659D92FEE736CDB44748F50056FF741E60C2EAE8A94D8769

Function 004526CD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00452708
CreateThread.KERNEL32(?,?,V#,00000000,?,0040C0FE), ref: 0045274C
GetLastError.KERNEL32(?,00000000,?,?,0040C0B8,00000000,00000000,0040C0FE,?,00000000,?), ref: 00452756
__dosmaperr.LIBCMT ref: 0045276E

Strings

V#, xrefs: 00452741

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr
String ID: V#
API String ID: 84609068-3009074967
Opcode ID: 741dece9c410d0b61a250213453242e7faf0902deb50ab961b45b2ea7268e2a6
Instruction ID: 3a42acb9d943d4bc965953ef35302ce43316fec0af8afefa5cd7e4b587975d09
Opcode Fuzzy Hash: 741dece9c410d0b61a250213453242e7faf0902deb50ab961b45b2ea7268e2a6
Instruction Fuzzy Hash: 8E110472505205AFCB10FFA5DD8289F77A4FF0532AB20442FF80092193D7B89D488AA9

Function 00452641 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00454A33: TlsGetValue.KERNEL32(?,0045321E), ref: 00454A3A
Part of subcall function 00454A33: TlsSetValue.KERNEL32(00000000,0045321E), ref: 00454A5B

Part of subcall function 00454A18: TlsGetValue.KERNEL32(?,00453229,00000000), ref: 00454A22

GetLastError.KERNEL32(00000000,?,00000000,?,?), ref: 00452676
RtlExitUserThread.NTDLL(00000000,?,?), ref: 0045267D
GetCurrentThreadId.KERNEL32 ref: 00452683
__freefls@4.LIBCMT ref: 004526A4

Strings

PYE, xrefs: 004526A9, 004526B2, 004526C1

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Value$Thread$CurrentErrorExitLastUser__freefls@4
String ID: PYE
API String ID: 1282264671-4264731808
Opcode ID: 0ed4346b27e7eb263dc075c6e17bc7c2508221cbf64e85cc55695adc212ce19c
Instruction ID: c1cb4acfb2569e177315e6c1e4ffed880b56d8b235b71d2e61a470ac72be7a98
Opcode Fuzzy Hash: 0ed4346b27e7eb263dc075c6e17bc7c2508221cbf64e85cc55695adc212ce19c
Instruction Fuzzy Hash: 34015270504201EFDB04BB62D90595E77A8AF8530EB11845FFD0497223E77CCC498B6E

Function 00443C20 Relevance: 7.8, APIs: 5, Instructions: 258windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,?,004422B8,00000000,00000000,00000000,00000000,00000000,0048A010,?,?), ref: 00443E58
SendMessageW.USER32(?,00000142,00000000,0000FFFF), ref: 00443E72
InvalidateRect.USER32(?,00000000,00000001,0048A010,?,?,?,?,?,?,004422B8,?,?), ref: 00443EA0
SendMessageW.USER32(?,00000469,?,00000000), ref: 00443EBF
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,004422B8,?,?), ref: 00443EDD

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSendWindow$InvalidateMoveRectShow
String ID:
API String ID: 3626129698-0
Opcode ID: e11df4ef5a1721bb908d9c22da332fa96f277a4f81634fc398dace3eada7503f
Instruction ID: 8065920ccdc99479be972d1b7ab0181fe160fcbfeccb06d76261e45fb94ae6e6
Opcode Fuzzy Hash: e11df4ef5a1721bb908d9c22da332fa96f277a4f81634fc398dace3eada7503f
Instruction Fuzzy Hash: B9A1A171D0161ADFEB14CFA9C5856BEBBF1FF08B02F24441AD981A3754D338AA41CB54

Function 004303AA Relevance: 7.7, APIs: 5, Instructions: 234COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(0046BF68), ref: 00430450
OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 0043045D
FreeLibrary.KERNEL32(?,00000000), ref: 004304AA

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 00433DAB: LoadLibraryA.KERNEL32(kernel32.dll,0043048B), ref: 00433DB6
Part of subcall function 00433DAB: GetProcAddress.KERNEL32(00000000,GetProcessIoCounters), ref: 00433DC8

FreeLibrary.KERNEL32(?), ref: 00430649
CloseHandle.KERNEL32(000000FF), ref: 00430653

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$FreeProcess$AddressCloseCurrentHandleLoadMessageOpenProc
String ID:
API String ID: 2997966233-0
Opcode ID: 70eea588e2ad75526fb19e70b55988c2758cf9812754a32b7b6912f8abbd8979
Instruction ID: c93db2572a20b8979618000732488b35826ecb450fb71b078d89515dc1591566
Opcode Fuzzy Hash: 70eea588e2ad75526fb19e70b55988c2758cf9812754a32b7b6912f8abbd8979
Instruction Fuzzy Hash: 1771B131108301AFD711EF25DC86A6FB7E4EF88718F004A2FF954922A1EB79DD458B5A

Function 0045B313 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 0045B3E1
__flsbuf.LIBCMT ref: 0045B40E
_wctomb_s.LIBCMT ref: 0045B471
__flsbuf.LIBCMT ref: 0045B4A6
__flswbuf.LIBCMT ref: 0045B4DB

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __flsbuf$__flswbuf_wctomb_s
String ID:
API String ID: 3257920507-0
Opcode ID: a80780f6d3cfb5cc512f32cf60f2ef12704038b25e247c4d1ee3bd03616c9039
Instruction ID: da33fcb1d9d57e7cea8775d4f7ccc9a3dcbf1a9a78e8e699161e1f5ee87956a7
Opcode Fuzzy Hash: a80780f6d3cfb5cc512f32cf60f2ef12704038b25e247c4d1ee3bd03616c9039
Instruction Fuzzy Hash: 86510B311056519AC7355B389D828AE37A4DF03726334460FFCA19B2D3EB2CD909C79D

Function 0041CF2E Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000), ref: 0041CF6E
GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 0041CFB1

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

GetLastError.KERNEL32(00000000), ref: 0041D03E
DeleteFileW.KERNEL32(00000000), ref: 0041D063
FreeLibrary.KERNEL32(00000000,00000000), ref: 0041D0B9

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: File$AttributesDeleteErrorFreeFullLastLibraryMessageNamePath
String ID:
API String ID: 846739010-0
Opcode ID: dc69a096cdaf24fece12491278bcf43182e2c4d4a507db62aa0edaa6a06d8938
Instruction ID: 164712ab3de28c241740e73496d7fb651e5bfcc4289d1ba345ab905f4edf4b57
Opcode Fuzzy Hash: dc69a096cdaf24fece12491278bcf43182e2c4d4a507db62aa0edaa6a06d8938
Instruction Fuzzy Hash: B541C271E002146ACF11BBB5898A6EF2659AF4431DF04097BE805F32C2DB3C9D868B59

Function 0043190F Relevance: 7.6, APIs: 5, Instructions: 137libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

LoadLibraryW.KERNEL32(00000000,00000000,?,?), ref: 00431956
GetProcAddress.KERNEL32(?,00000000), ref: 004319FA
GetProcAddress.KERNEL32(?,00000000), ref: 00431A1F
GetProcAddress.KERNEL32(?,00000000), ref: 00431A56
FreeLibrary.KERNEL32(?), ref: 00431A6B

Part of subcall function 0040DF43: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,C:\Users\user\Desktop\regsvr.exe,?,00412A47,0046BF68,?), ref: 0040DF75

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressProc$Library$ByteCharFreeLoadMessageMultiWide
String ID:
API String ID: 3850844274-0
Opcode ID: 48ef30966b21c807ec1d84650b051d48fa45bfc2e08552a1b290ee8b5e4d323d
Instruction ID: 8bb15bf6729a8805ceeb025206d24f8ec35f406715209b04519fbfbc095bee2b
Opcode Fuzzy Hash: 48ef30966b21c807ec1d84650b051d48fa45bfc2e08552a1b290ee8b5e4d323d
Instruction Fuzzy Hash: 9F41B3316001145BDB21BB758856B6F77E1EF88328F14493BF801EB2D2DB3CA940CA5E

Function 00426D10 Relevance: 7.6, APIs: 5, Instructions: 133networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 00426D9F
WSAGetLastError.WS2_32(00000000,0046BF68), ref: 00426DAA

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

__WSAFDIsSet.WSOCK32(00000000,00000001,0046BF68), ref: 00426DCE
_strlen.LIBCMT ref: 00426E1A
WSAGetLastError.WS2_32(00000000,00000000,?,?,00000000,00000000,00000001,0046BF68), ref: 00426E5B

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ErrorLast$Message_malloc_strlenselect
String ID:
API String ID: 3938840167-0
Opcode ID: 7720823b9778ee6a11c4fed7c08286b44cc4873c1c6628186332208558d271a9
Instruction ID: 6fc1eb61393fa3f718c4f0ce45286769510ce549e345c0549498f74762c0f3a3
Opcode Fuzzy Hash: 7720823b9778ee6a11c4fed7c08286b44cc4873c1c6628186332208558d271a9
Instruction Fuzzy Hash: 35412D75A00118ABCF10ABB5DC829DF73A8AF44328F26016FF515E31C2DA7C9E408B69

Function 0040CDE8 Relevance: 7.6, APIs: 5, Instructions: 115filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C4DB: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\regsvr.exe,00000104,0048D8B0,C:\Users\user\Desktop\regsvr.exe,?,?,00406C7E,C:\Users\user\Desktop\regsvr.exe,00000104), ref: 0040C4F9

GetFileAttributesW.KERNEL32(?), ref: 0040CE1D
GetFileAttributesW.KERNEL32(?), ref: 0040CE37
lstrcmpiW.KERNEL32(?,?), ref: 0040CE57
MoveFileW.KERNEL32(?,?), ref: 0040CE88

Part of subcall function 0040C5CD: __wcsicmp.LIBCMT ref: 0040C664

SHFileOperationW.SHELL32(?), ref: 0040CF3B

Part of subcall function 0040CC93: lstrcmpiW.KERNEL32(?,?), ref: 0040CCC8
Part of subcall function 0040CC93: MoveFileW.KERNEL32(?,?), ref: 0040CCFE

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: File$AttributesMovelstrcmpi$FullNameOperationPath__wcsicmp
String ID:
API String ID: 4045721832-0
Opcode ID: 3c15e99f8845aa9e856b841371b6aa2ace2df06100451119d47ab2b57504b97b
Instruction ID: 182999012a8ff91de63184428f6aa24cf2cd3b02ddf8037012b936872ac750c8
Opcode Fuzzy Hash: 3c15e99f8845aa9e856b841371b6aa2ace2df06100451119d47ab2b57504b97b
Instruction Fuzzy Hash: 8D4120B2805219AADF10DFA4DC85ADEB3BCEF04314F5046BBE505F3181E73897898B69

Function 0040F19F Relevance: 7.6, APIs: 5, Instructions: 110sleepCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00489FEC), ref: 0040F1C9
InterlockedDecrement.KERNEL32(00489FEC), ref: 0040F1DA
Sleep.KERNEL32(0000000A,?,?), ref: 0040F1E2
InterlockedIncrement.KERNEL32(00489FEC), ref: 0040F1E9
InterlockedDecrement.KERNEL32(00489FEC), ref: 0040F2D9

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$Sleep
String ID:
API String ID: 327565842-0
Opcode ID: 364e6123166360e3e6a27cfc0eb2a4fde04091294220061ce0b48bd2aaef5718
Instruction ID: 205e7469fd3126a39f0d411cda9b039786805852db7af73936670122b79e964a
Opcode Fuzzy Hash: 364e6123166360e3e6a27cfc0eb2a4fde04091294220061ce0b48bd2aaef5718
Instruction Fuzzy Hash: A641BF32D006169BDB15DFA5DC809AE7374EB44324B09043EEE16FB291DB78AD46CBC8

Function 0041EBD6 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000000,?,00007FFF,?), ref: 0041EC56
GetPrivateProfileSectionW.KERNEL32(00000000,?,00000003,?), ref: 0041EC83

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

WritePrivateProfileSectionW.KERNEL32(00000000,?,?), ref: 0041ECC0
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0041ECE7
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0041ECF3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$Message
String ID:
API String ID: 3956282490-0
Opcode ID: 3fcfe188db002073007885cdd1cf061452fdd757f93433429992a2cbc8b3bd9e
Instruction ID: 4b24ec794ad130bcaa36f5c59a76f3c7152512361a8e72139f8cb6cd03e45d30
Opcode Fuzzy Hash: 3fcfe188db002073007885cdd1cf061452fdd757f93433429992a2cbc8b3bd9e
Instruction Fuzzy Hash: 4431A4B2A4011C6BDB10A7B18C86EFF739DEB44308F04447BF905E7181EA7C9D858B55

Function 00459954 Relevance: 7.6, APIs: 5, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00459969

Part of subcall function 00455532: __mtinitlocknum.LIBCMT ref: 00455546
Part of subcall function 00455532: __amsg_exit.LIBCMT ref: 00455552
Part of subcall function 00455532: RtlEnterCriticalSection.NTDLL(?), ref: 0045555A

__mtinitlocknum.LIBCMT ref: 004599A9
__malloc_crt.LIBCMT ref: 004599EA
___crtInitCritSecAndSpinCount.LIBCMT ref: 00459A0F
RtlEnterCriticalSection.NTDLL(02B90EC0), ref: 00459A39

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CriticalEnterSection__mtinitlocknum$CountCritInitSpin___crt__amsg_exit__lock__malloc_crt
String ID:
API String ID: 1486408876-0
Opcode ID: 70d73895f33a07e59e6e48b61447feb230db75e35a3d79a1f294adbc82ec6f41
Instruction ID: e18e4a73ca63e5f6fe15e1bf9427d2d9729874aef1571ea751a629393de9fb38
Opcode Fuzzy Hash: 70d73895f33a07e59e6e48b61447feb230db75e35a3d79a1f294adbc82ec6f41
Instruction Fuzzy Hash: 4631A171500B42DFC721EF99D88192AB3E4BB09316754852FE8559B3A2CB78AD09CF58

Function 00401D82 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00401D97
PostMessageW.USER32(00000203,00000201,?), ref: 00401E58
Sleep.KERNEL32(00000000), ref: 00401E5C
PostMessageW.USER32(00000203,00000202,00000000), ref: 00401E69
Sleep.KERNEL32(00000000), ref: 00401E6D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: dea5e0bc18fe0239a6eace4a88e208afe332178cffb62cb3612a46ab0661e376
Instruction ID: d5d84adb966cee76746330d68d9cf85862d0df582fcdf2a249f85914c926a921
Opcode Fuzzy Hash: dea5e0bc18fe0239a6eace4a88e208afe332178cffb62cb3612a46ab0661e376
Instruction Fuzzy Hash: 14318472900219EFDF10CFA9C849ADEBBB5FB44314F118666E925A72E0D7749900DF94

Function 0043C199 Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0043C204
ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 0043C224
DestroyCursor.USER32(?), ref: 0043C237
SendMessageW.USER32(?,00000080,00000000,?), ref: 0043C24D
InvalidateRect.USER32(?,00000000,00000001), ref: 0043C27D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CursorDestroyExtractIconImageInvalidateLoadMessageRectSend
String ID:
API String ID: 3808587923-0
Opcode ID: 236fa9eee8e03abdb5bd8c55a9b54a2e045e0e2414d752723a7ee338e2e98434
Instruction ID: a8b5e9944a473fd6d0e06277b6ede5159577d967f14fe322b0be1228a56c19ff
Opcode Fuzzy Hash: 236fa9eee8e03abdb5bd8c55a9b54a2e045e0e2414d752723a7ee338e2e98434
Instruction Fuzzy Hash: D2319371900209EFDB109FA4DCC49AF3B68EB09354F10593BF911A6251D774D8A0DFAA

Function 00434A55 Relevance: 7.6, APIs: 5, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32 ref: 00434A8A
RegOpenKeyExW.ADVAPI32(?,?,00000000,00000000,00000000), ref: 00434AB6
RegCloseKey.ADVAPI32(00000000), ref: 00434AD2
RegDeleteKeyW.ADVAPI32(?,?), ref: 00434AE6
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00434B0E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Enum$CloseDeleteOpen
String ID:
API String ID: 2095303065-0
Opcode ID: 4d40888c40cc85b33fcdefe8402ba744115cead9e61554dc255eada5bd1110b2
Instruction ID: 7102d85118676c44d616162e1f5937af1264a8d1d5ce79e9eae3c0c0b2501083
Opcode Fuzzy Hash: 4d40888c40cc85b33fcdefe8402ba744115cead9e61554dc255eada5bd1110b2
Instruction Fuzzy Hash: 9B214472108248BFD7019F94DC80DFBBBACEB88354F04192AF994C2151E264ED4997B6

Function 004446D9 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00444712
ExtCreatePen.GDI32(?,00000001,00000000,00000000,00000000,?,?,00000000,?,?), ref: 0044474D
SelectObject.GDI32(?,00000000), ref: 0044475C
BeginPath.GDI32(?), ref: 00444773
SelectObject.GDI32(?,00000000), ref: 00444796

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Object$Select$BeginCreateDeletePath
String ID:
API String ID: 2338827641-0
Opcode ID: 42866a1c63bcb41b472d755da05abcf1cdbb9a3cd80c07c88b0d3ea84fadfffd
Instruction ID: f47d475fd9645cb6ac642ddefde909b459d69c0fd6f122beb06578fb717ef81d
Opcode Fuzzy Hash: 42866a1c63bcb41b472d755da05abcf1cdbb9a3cd80c07c88b0d3ea84fadfffd
Instruction Fuzzy Hash: 9121A2B1800254AFDB119FA8EC9C99E7B68F7463A4B00463FF955973A0E3745841DBA8

Function 00426EF4 Relevance: 7.6, APIs: 5, Instructions: 60networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 004271B1: inet_addr.WS2_32(00000000), ref: 004271C8

socket.WS2_32(00000002,00000001,00000006), ref: 00426F34
WSAGetLastError.WS2_32(00000000,?,00000000,00000000), ref: 00426F42
connect.WS2_32(00000000,?,00000010), ref: 00426F59

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ErrorLastMessageconnectinet_addrsocket
String ID:
API String ID: 2150481394-0
Opcode ID: 86f3be4f46347fc6956df3d0f3bf58279a4392ea0f4bf341dfe3f1f86f3986f7
Instruction ID: e50f3638c2835ca9518b1549c04268303d8bc3caa17dbeabc4c44a729e06525e
Opcode Fuzzy Hash: 86f3be4f46347fc6956df3d0f3bf58279a4392ea0f4bf341dfe3f1f86f3986f7
Instruction Fuzzy Hash: 4001D63170512426EF10B6766D83BBF22595F81328F46063BB915F72C2DE6C9C41466D

Function 00443A5A Relevance: 7.6, APIs: 5, Instructions: 56windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000000,00000008), ref: 00443A69
SendMessageW.USER32(00000000,00000087,00000000,00000000), ref: 00443A83
SendMessageW.USER32(?,00000087,00000000,00000000), ref: 00443AA5
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00443AB3
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 00443ABF

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$Item
String ID:
API String ID: 3888421826-0
Opcode ID: 504fdbcf548ea68ce52a1b51d364af74e53fdf7f59d053ce5375d339d91b7b18
Instruction ID: e27a2a24e2d8a65d927d03bdb54e24fe7ebb40e86e6863d6e49c5cd3f004b97f
Opcode Fuzzy Hash: 504fdbcf548ea68ce52a1b51d364af74e53fdf7f59d053ce5375d339d91b7b18
Instruction Fuzzy Hash: 5C0152722843487FF730AE648C85F37B699FB44B45F14062EF6C6316E0D6E66D058A68

Function 00409903 Relevance: 7.6, APIs: 5, Instructions: 55fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000,?,0040252D,?,0000102B,?,00000000,?,00000028,00000028), ref: 00409932
UnmapViewOfFile.KERNEL32(?,?,00000000,?,0040252D,?,0000102B,?,00000000,?,00000028,00000028), ref: 0040994E
CloseHandle.KERNEL32(?,?,00000000,?,0040252D,?,0000102B,?,00000000,?,00000028,00000028), ref: 00409957
FreeLibrary.KERNEL32(?,?,00000000,?,0040252D,?,0000102B,?,00000000,?,00000028,00000028), ref: 00409971
FreeLibrary.KERNEL32(?,?,00000000,?,0040252D,?,0000102B,?,00000000,?,00000028,00000028), ref: 0040997A

Part of subcall function 00409AE0: LoadLibraryA.KERNEL32(kernel32.dll,0040992E,?,?,00000000,00008000,?,?,00000000,?,0040252D,?,0000102B,?,00000000,?), ref: 00409AEB
Part of subcall function 00409AE0: GetProcAddress.KERNEL32(00000000,VirtualFreeEx), ref: 00409AFD

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$CloseFreeHandle$AddressFileLoadProcUnmapView
String ID:
API String ID: 554210777-0
Opcode ID: 03924327f8448f849307798e0e89cef0381649f914155a362664e2104094935c
Instruction ID: e9789df8bce7148182a5c14c1a3bf43569d4ae2f63334e8d3ff9a5a601a6442d
Opcode Fuzzy Hash: 03924327f8448f849307798e0e89cef0381649f914155a362664e2104094935c
Instruction Fuzzy Hash: CB01CCB1200200ABDF619F65DC84F67BBA8EF54310B1400BAF944BB392C7B4AC10CA68

Function 004094DB Relevance: 7.6, APIs: 5, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00408BF0), ref: 00409515
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,00408BF0), ref: 00409520
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00408BF0), ref: 00409528
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00408BF0), ref: 00409533
Sleep.KERNEL32(?,?,?,?,?,?,?,00408BF0), ref: 00409569

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 1e62e088f7e9577e17595cf97156b30afab91f5e11f9d0ca082c1a96b98f4280
Instruction ID: d1b350b48f29a5a9f33e23a0a91f801094cf8924d617eed79e0dfcd3da6fa2a4
Opcode Fuzzy Hash: 1e62e088f7e9577e17595cf97156b30afab91f5e11f9d0ca082c1a96b98f4280
Instruction Fuzzy Hash: 2811C272908306ABC700DF76DC45A5E7BE8AB85744F00493BF895D3291EB38D944CB5B

Function 0040D649 Relevance: 7.6, APIs: 5, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,0048BA08,0048BA08,00000001,00000000,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe), ref: 0040D67B
QueryPerformanceFrequency.KERNEL32(?,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe,?,?,?,?,?,0040126A,00000001,C:\Users\user\Desktop\regsvr.exe), ref: 0040D686
Sleep.KERNEL32(00000000,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe,?,?,?,?,?,0040126A,00000001,C:\Users\user\Desktop\regsvr.exe), ref: 0040D68E
QueryPerformanceCounter.KERNEL32(?,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe,?,?,?,?,?,0040126A,00000001,C:\Users\user\Desktop\regsvr.exe), ref: 0040D699
Sleep.KERNEL32(000000FA,0048BA08,0048BA08,00000001,00000000,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe), ref: 0040D6CF

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: ceda8ae0f56a79ead81c7a89738d4a9de0b6aefbd23bd0287460a77efbc50470
Instruction ID: 5739e351fb4f4df6561d1e6fe6e8ff8716d84a44de3829597a49e487bb577c8b
Opcode Fuzzy Hash: ceda8ae0f56a79ead81c7a89738d4a9de0b6aefbd23bd0287460a77efbc50470
Instruction Fuzzy Hash: 6701A57191C3069BC700DFA5DC55A6E77E8AB85714F004D3EF49AD21A0EF39D1888B5B

Function 004439EF Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00443A07
SendMessageW.USER32(00000000,00000087,00000000,00000000), ref: 00443A1B
GetWindow.USER32(00000000,00000002), ref: 00443A28
IsWindow.USER32(00000000), ref: 00443A2D
GetDlgCtrlID.USER32(00000000), ref: 00443A47

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$CtrlMessageSend
String ID:
API String ID: 75316347-0
Opcode ID: 70aca144902aed48a6618e18c97ad7d93436facb27031c0c2483329a36f0c366
Instruction ID: afd5f69ab579939b1e469a86c5b694731c2b0b91770a2a22d8c812f2fca3b148
Opcode Fuzzy Hash: 70aca144902aed48a6618e18c97ad7d93436facb27031c0c2483329a36f0c366
Instruction Fuzzy Hash: 8801DF30244214BFE720CF09CC05F9A7BA8AF11B56F104092F045AA290E7B4AE018F9A

Function 00405294 Relevance: 7.5, APIs: 5, Instructions: 38windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 004052A5
GetWindowTextW.USER32(00000000,?,00000100), ref: 004052BC
MessageBeep.USER32(00000000), ref: 004052D4
KillTimer.USER32(?,0000040A), ref: 004052F0
EndDialog.USER32(?,00000001), ref: 0040530A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 9213ddf0e7adbc55642fac758a18891736e5ab93a75b4067e21e2a58f6152ebc
Instruction ID: 169f5b18fe6e263734091a5834976e977de695e2cf91249a3d5d2a2b82a73339
Opcode Fuzzy Hash: 9213ddf0e7adbc55642fac758a18891736e5ab93a75b4067e21e2a58f6152ebc
Instruction Fuzzy Hash: EBF06D30500705ABEB216B25DC4DB4777B8BF00749F0005B9A282B08E1EBF5A9958F5A

Function 004449FB Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

MoveToEx.GDI32(?,?,00000000,00000000), ref: 00444A08
LineTo.GDI32(?,?,?), ref: 00444A1B
LineTo.GDI32(?,?,?), ref: 00444A24
LineTo.GDI32(?,?,00000000), ref: 00444A2D
LineTo.GDI32(?,?,00000000), ref: 00444A36

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Line$Move
String ID:
API String ID: 3367123170-0
Opcode ID: 5a5300328958fecd317055f87c214d2a98c3dcf4355d41c2312cf02bfd5bf3f0
Instruction ID: ce0ccef848258bcd27f1560e9a3f010d27bc414eade82fd567bda08cb8c18f60
Opcode Fuzzy Hash: 5a5300328958fecd317055f87c214d2a98c3dcf4355d41c2312cf02bfd5bf3f0
Instruction Fuzzy Hash: 9EF02B3640411DBBCF126FA1EC44EAF3F7AEB4A6A0F008419FA1855020D7769521FBA6

Function 0044466F Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00444679
StrokeAndFillPath.GDI32(?), ref: 00444695
StrokePath.GDI32(?), ref: 0044469E
SelectObject.GDI32(?,00000000), ref: 004446AF
DeleteObject.GDI32 ref: 004446C2

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: ef943b0b5c3f742088462ba78c201e82d5662db99151fa69d87b5260d5ee4992
Instruction ID: 9dd2af9711844f5e7680171cb00801f0fab9107dd6b89a414c4e08e2bd610351
Opcode Fuzzy Hash: ef943b0b5c3f742088462ba78c201e82d5662db99151fa69d87b5260d5ee4992
Instruction Fuzzy Hash: 75F01730009601AFE3228B24EC1C75E3A64FB4376AF144629E0A5891F0D7BC0555EFAE

Function 00404874 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 214comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00404A06

Strings

Container, xrefs: 004049B2
C@, xrefs: 0040493B
AutoIt3GUI, xrefs: 004049A6

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$C@
API String ID: 3565006973-3071952359
Opcode ID: 837aa742f019d13201965fe16b6af9b5aebd352aa1fae9942a2be6eae16c45c5
Instruction ID: fbbe80a1f547063a70e4c210cb1a1bbeb7e86a27113ecd92d13e60f33b8069d5
Opcode Fuzzy Hash: 837aa742f019d13201965fe16b6af9b5aebd352aa1fae9942a2be6eae16c45c5
Instruction Fuzzy Hash: 90817BB0600701EFDB10DFA5C88496ABBB4FF88314720896EE6469B7A1D778E941CF48

Function 00402E26 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004098B5: GetVersionExW.KERNEL32(?), ref: 004098DD

Part of subcall function 00409A50: WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,0040250B,?,00000028,00000028), ref: 00409A7C

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00402E6A

Part of subcall function 00409A98: ReadProcessMemory.KERNEL32(?,?,?,?,00000000,0040261D,?,00000800,?,00001073,?,00000000,?,00000028,00000800), ref: 00409AC4

Part of subcall function 00409980: GetWindowThreadProcessId.USER32(?,?), ref: 004099B6
Part of subcall function 00409980: OpenProcess.KERNEL32(00000438,00000000,?,?,?,?,?,?,004024F8,00000028), ref: 004099CC
Part of subcall function 00409980: LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,?,?,004024F8,00000028), ref: 004099E1
Part of subcall function 00409980: GetProcAddress.KERNEL32(00000000,VirtualAllocEx), ref: 004099F3

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00402ED0
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00402F2C

Strings

@, xrefs: 00402F43

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Process$MessageSend$Memory$AddressLibraryLoadOpenProcReadThreadVersionWindowWrite
String ID: @
API String ID: 3927202401-2766056989
Opcode ID: 6eb0afec20c121aee7cf4f96f001a8f26bdb622582b5674e1314b63c4cb0af75
Instruction ID: 7aea2b330923bbc924ee336288dcd8b4d17e5e0122f133b85999acd6d0602b67
Opcode Fuzzy Hash: 6eb0afec20c121aee7cf4f96f001a8f26bdb622582b5674e1314b63c4cb0af75
Instruction Fuzzy Hash: 28414E71A4011DAADB10DF64CD86FDEBBB8BB04344F0401BAE605B72C1D7B8AA44DF64

Function 0040AE17 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,0000002C), ref: 0040AE8B
DeleteMenu.USER32(?,?,00000000,?,000000FF,00000000,0000002C,?,0048C258,00000000), ref: 0040AED6
DeleteMenu.USER32(00000000,000000FF,00000000,?,0048C258,00000000), ref: 0040AF2D

Strings

,, xrefs: 0040AE6E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: ,
API String ID: 135850232-3772416878
Opcode ID: 3de9f621674256f3343683ae04c1e7cfdfa5a888b992a10686ba2fc2e6265331
Instruction ID: 9cbd49a26b58c68f47048b06c05ab0f862f1573f8d9c6ff1d10a6c23aa92260a
Opcode Fuzzy Hash: 3de9f621674256f3343683ae04c1e7cfdfa5a888b992a10686ba2fc2e6265331
Instruction Fuzzy Hash: C741D171600344EFDB10CF68C884B9ABBF1AF45324F1889B9E555BB2D1C378E950CB5A

Function 0043849C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

__wcsicmp.LIBCMT ref: 0043853C

Strings

MIDDLE, xrefs: 00438550
RIGHT, xrefs: 00438525

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsicmp
String ID: MIDDLE$RIGHT
API String ID: 1389419275-498280495
Opcode ID: a4876e56803b382e138b89c679b87fa062f861554c741369661642b5aee36bea
Instruction ID: feba78a76686f9c5e6f5f32c0b2b8bf070870fe83a8c89bc30f2ba2cf74f5038
Opcode Fuzzy Hash: a4876e56803b382e138b89c679b87fa062f861554c741369661642b5aee36bea
Instruction Fuzzy Hash: B821B931A003047AEF147BB6959675EBB65AF44328F20413FF815FB2C1DB7C5A444E59

Function 00453344 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

B, xrefs: 004533A3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: 79a2d95c895d504ba638998a31468950089ab4f78148942f58ac4c5317a871ee
Instruction ID: ab608e9c26b3939ee0380e514144126f237800968641f64c18a52d18837557a3
Opcode Fuzzy Hash: 79a2d95c895d504ba638998a31468950089ab4f78148942f58ac4c5317a871ee
Instruction Fuzzy Hash: DB2179B2904118DBDB116FA58C414FE77B8FB05356F500167FC10E7283D63D99098BB9

Function 00440371 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 004403F1
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004,?,?,?,00000001), ref: 00440405
SendMessageW.USER32(?,00001002,00000000,?), ref: 00440428

Strings

SysMonthCal32, xrefs: 004403BE

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 12d3946a571afb037a9288f710e20fd64ed11f9794151e192262a4d7dd858b46
Instruction ID: e396dd404233108e3d5a8a9871ad62dce728970a85a181b95a0f5c662251c0ec
Opcode Fuzzy Hash: 12d3946a571afb037a9288f710e20fd64ed11f9794151e192262a4d7dd858b46
Instruction Fuzzy Hash: 1D216D32500218ABEF219F95CC46BDF3BA5EF58714F100126FE14A61D0C7B99865DB99

Function 0040B35F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B52A: CloseHandle.KERNEL32(0C458D00,00000000,00406D2B,?,?,C:\Users\user\Desktop\regsvr.exe), ref: 0040B53A

_fseek.LIBCMT ref: 0040B3C7
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,?,00407214,00000000,?,00406D3A,?,?,?), ref: 0040B3EF

Strings

a+b, xrefs: 0040B3AD
w+b, xrefs: 0040B3D5

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CloseCreateFileHandle_fseek
String ID: a+b$w+b
API String ID: 2723389627-2501309014
Opcode ID: cefde1f7094c267ee786d2562a7d6c0bedf249b98274535ff4caef9c4bc4de1f
Instruction ID: a7674d6749f92b38cda2ed3e515cd91be9c1ec853273997140920a9cbd9850ba
Opcode Fuzzy Hash: cefde1f7094c267ee786d2562a7d6c0bedf249b98274535ff4caef9c4bc4de1f
Instruction Fuzzy Hash: 0F11D031544304BAEB201A66AC82B667798DF10398F20443FFC89B62E2D77D9D0296DD

Function 00440AE3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00440B51
LoadLibraryW.KERNEL32(?,?,?,0043ED2D,?,0000000B,?,?,?,?,?,00000000,00000001,0000000B,?,00000000), ref: 00440B5A
SendMessageW.USER32(?,00000467,00000000,?), ref: 00440B6E

Strings

SysAnimate32, xrefs: 00440B2E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$LibraryLoad
String ID: SysAnimate32
API String ID: 3205928328-1011021900
Opcode ID: e936329c633d813fd859bee6ff80c6bc1d3c8f284555c633437254c185f45eea
Instruction ID: f5e7ba30cf92359d55149b8ee9ea2def1697201481dae205e344e33dacceecda
Opcode Fuzzy Hash: e936329c633d813fd859bee6ff80c6bc1d3c8f284555c633437254c185f45eea
Instruction Fuzzy Hash: FF219372400249AFEF205FA1DC44CEB7B69EF59368B10462AFA24972A0D375DC71DB98

Function 00423B5D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__wcsicmp.LIBCMT ref: 00423BC1
__wcsicmp.LIBCMT ref: 00423BD7
mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 00423BEC

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Strings

DOWN, xrefs: 00423BD1

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsicmp$Messagemouse_event
String ID: DOWN
API String ID: 3225411779-711622031
Opcode ID: 1c68911598d31b5a33dbe50accacda76b5e2d0e39cc2d8e12746c70618fe303b
Instruction ID: 935403755a764051b4773729ef43583ed4c917042110a0a6b6437067be982d67
Opcode Fuzzy Hash: 1c68911598d31b5a33dbe50accacda76b5e2d0e39cc2d8e12746c70618fe303b
Instruction Fuzzy Hash: 2D11C3326083106AD710AE27AC4681BB7E4FFC1325F60493FF854E3281EB7CA945CA5E

Function 0041CD28 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0041CD38

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF), ref: 0041CD9A
__swprintf.LIBCMT ref: 0041CDB3

Strings

%lu, xrefs: 0041CDAD

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ErrorInformationMessageModeVolume__swprintf
String ID: %lu
API String ID: 1030839140-685833217
Opcode ID: 7addc1bd04a6c761da8551cdc4e1243eae1c77033e78d7082fbe24b416e8c4f2
Instruction ID: 519edf0266f95f1040b5d6f8bd661fd9f5dba657dcdda10d6dd64ab7fc58c87e
Opcode Fuzzy Hash: 7addc1bd04a6c761da8551cdc4e1243eae1c77033e78d7082fbe24b416e8c4f2
Instruction Fuzzy Hash: 2611C332A401086ADB14ABB1DC86EEE7778EF05308F10457BF501E7191EA78AD858B99

Function 0043AD9E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,0000007F), ref: 0043ADF2
IsDialogMessageW.USER32(?,?), ref: 0043AE31

Strings

AutoIt v3, xrefs: 0043AE19
AutoIt v3 GUI, xrefs: 0043AE02

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ClassDialogMessageName
String ID: AutoIt v3$AutoIt v3 GUI
API String ID: 682379513-3732297864
Opcode ID: 8db88b62852e385237969420964b99bf09304c3aff3ec132643467ca55f49cd7
Instruction ID: 82898b3257c513fadd93b84e6a3c1c07e75559f2299d8d4216c49e18c830bfde
Opcode Fuzzy Hash: 8db88b62852e385237969420964b99bf09304c3aff3ec132643467ca55f49cd7
Instruction Fuzzy Hash: 6421E471680205EFDB24DF64CC85B9673A8FF08308F10006AF985D3280E778ED54CB5A

Function 00440203 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00440287
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00440292
MoveWindow.USER32(?,?,?,?,?,00000000,?,Listbox,00000000,00000000,?,?,?,?,00000001,00000001), ref: 004402B1

Strings

Listbox, xrefs: 0044025A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 7c87dd3917528b926471a9585c783dff56738076cc26e8f01d31b5303280606a
Instruction ID: 235dd332f67e8e7bb9f5e8cca9b667ab73ae0818e4ecdb380dc574b5c59b15b0
Opcode Fuzzy Hash: 7c87dd3917528b926471a9585c783dff56738076cc26e8f01d31b5303280606a
Instruction Fuzzy Hash: BA216071400209BFEF228F90DC49DEB3B69FF08358F004266FA54162A1C7BA8C75DB99

Function 004034C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403679: SendMessageTimeoutW.USER32(0046BF68,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00403696
Part of subcall function 00403679: GetWindowThreadProcessId.USER32(0046BF68,00000000), ref: 004036AB
Part of subcall function 00403679: GetCurrentThreadId.KERNEL32 ref: 004036B2
Part of subcall function 00403679: AttachThreadInput.USER32(00000000,?,004034E9), ref: 004036B9

GetFocus.USER32 ref: 004034E9

Part of subcall function 004035F2: GetParent.USER32(0046BF68), ref: 00403606

GetClassNameW.USER32(?,?,000000FF), ref: 00403520
__swprintf.LIBCMT ref: 00403559

Strings

%s%d, xrefs: 00403553

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Thread$AttachClassCurrentFocusInputMessageNameParentProcessSendTimeoutWindow__swprintf
String ID: %s%d
API String ID: 603989968-1110647743
Opcode ID: 41a02ccd1dc8662a3634fc48a5704a7047bd3ebc77357dd69716362c774484e8
Instruction ID: 7ee8add41c5e5001ea92f26fe6e9421db2068212b0925ad514e048e2275b69b7
Opcode Fuzzy Hash: 41a02ccd1dc8662a3634fc48a5704a7047bd3ebc77357dd69716362c774484e8
Instruction Fuzzy Hash: 84116371600304BBDB20AF759C86F6A7BECAF04345F50187AB506B2592E6B8E6418B69

Function 0040D44F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 0040D4F7: __wcsicmp.LIBCMT ref: 0040D507
Part of subcall function 0040D4F7: __wcsicmp.LIBCMT ref: 0040D51C

Part of subcall function 0040BBB0: RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,00000000,?,?,?,0042E784,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 0040BBCF
Part of subcall function 0040BBB0: RegQueryValueExW.ADVAPI32(00000000,?,00000000,00000000,00000000,?,?,?,0042E784,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?), ref: 0040BBE6
Part of subcall function 0040BBB0: RegCloseKey.ADVAPI32(00000000,?,?,0042E784,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,ProgramFilesDir,00000104,%.3d,?,?,?,?,?,?,00000000), ref: 0040BBF7

mouse_event.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0040D4C8

Strings

SwapMouseButtons, xrefs: 0040D462
Control Panel\Mouse, xrefs: 0040D467
1, xrefs: 0040D4B0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsicmp$CloseOpenQueryValuemouse_event
String ID: 1$Control Panel\Mouse$SwapMouseButtons
API String ID: 3324267174-1333076132
Opcode ID: fcbe54baa2ed6d60be1b2886f93cd982ca19cc3972aebce884271c6a35e28f4e
Instruction ID: b9e75c5a868c681ae09db2d0b8fe6d446da5b8c60acb4b2b9ac9a6694a8797f4
Opcode Fuzzy Hash: fcbe54baa2ed6d60be1b2886f93cd982ca19cc3972aebce884271c6a35e28f4e
Instruction Fuzzy Hash: 5E01A7A3E542147AF30056F59C47B7F71A8D7047A8F254437EA02F61C0F1FDAD85516A

Function 00440A4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00440AAA
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00440ABF
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00440ACB

Strings

msctls_trackbar32, xrefs: 00440A85

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 2cbf69472335561da9f79780eb13cf4e1fc7ff55ee71abb4a734962abdc14c46
Instruction ID: b2e0d56bd2742d09350328b005db9e205b6f4aec964e4f51790b4fbdaf42cbe9
Opcode Fuzzy Hash: 2cbf69472335561da9f79780eb13cf4e1fc7ff55ee71abb4a734962abdc14c46
Instruction Fuzzy Hash: 2F118EB150030DBEEF119F608C81EEB3BA9EF1835CF114226FA14761A1D3799C619BA8

Function 0046143D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__msize.LIBCMT ref: 00461482
_realloc.LIBCMT ref: 0046148E
_memset.LIBCMT ref: 004614A7

Strings

9B, xrefs: 0046143D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __msize_memset_realloc
String ID: 9B
API String ID: 414201948-3820238304
Opcode ID: 304580f89e8a006fa01e8789d75b90b7926f9e3520f4868e305f7a1fe849fb9a
Instruction ID: 0503715bdfdeb782f35a997816f5d86ec743805b485debea830cc4a69dff853a
Opcode Fuzzy Hash: 304580f89e8a006fa01e8789d75b90b7926f9e3520f4868e305f7a1fe849fb9a
Instruction Fuzzy Hash: 830126766042146BDB246D76AC81D6F3B59EF80365F18413FF909832A2FD758C0481AA

Function 004057BB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 004057E3
GetProcAddress.KERNEL32(00000000,AU3_GetPluginDetails), ref: 00405800
FreeLibrary.KERNEL32 ref: 0040580C

Strings

AU3_GetPluginDetails, xrefs: 004057FA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: AU3_GetPluginDetails
API String ID: 145871493-4132174516
Opcode ID: ddd309e7eca97281ce91d34f0eacb1689b24acbd29671085e02b99ab12bfb742
Instruction ID: d6be76e39068f4cc87866903120fb9e7b95e1e6f409fabf9c54b2125fb8f5d81
Opcode Fuzzy Hash: ddd309e7eca97281ce91d34f0eacb1689b24acbd29671085e02b99ab12bfb742
Instruction Fuzzy Hash: 0711A0B2100600EBDB248F24CC44B9B7BE8EB55361F20443EE846E32D0E6748980EB19

Function 0046592F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00465950
__amsg_exit.LIBCMT ref: 00465962

Strings

9B, xrefs: 0046592F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __amsg_exit__calloc_crt
String ID: 9B
API String ID: 4074973159-3820238304
Opcode ID: 69354efe9def2decdddc32163f9ec8632fd81df85a7c1e23acfcdd1b09562a2b
Instruction ID: 49239f1283900d5af0c73e256226e4c143a982a057579cc64b6d6ddfa7af10d1
Opcode Fuzzy Hash: 69354efe9def2decdddc32163f9ec8632fd81df85a7c1e23acfcdd1b09562a2b
Instruction Fuzzy Hash: 11F0C2F2A04B12DBEB159A68984172673E8EB253B9F24042BF546F7381FA78DC048749

Function 0043E196 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

GetMenuItemInfoW.USER32 ref: 0043E1DD
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0043E20A
DrawMenuBar.USER32 ref: 0043E216

Strings

,, xrefs: 0043E1B9

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Menu$InfoItem$Draw_malloc
String ID: ,
API String ID: 772068139-3772416878
Opcode ID: 586b6f0b87ed1859614256785061ca654babc90f4898b0eb941dacc6fd494129
Instruction ID: 14e73252d990092f0deb0f719bb6e20f23b0f6581c9d453d3aa7e4494cc708b1
Opcode Fuzzy Hash: 586b6f0b87ed1859614256785061ca654babc90f4898b0eb941dacc6fd494129
Instruction Fuzzy Hash: EA0180711083819FE7609F16D804B9BBBE9FF84355F10892EF9C8811A1DF759814DB56

Function 00407424 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0040742F
__wcsnicmp.LIBCMT ref: 0040744B

Strings

#notrayicon, xrefs: 00407426
#requireadmin, xrefs: 00407442

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __wcsnicmp
String ID: #notrayicon$#requireadmin
API String ID: 1038674560-627007125
Opcode ID: 36f2bb7718e39f5edead508affdf672497c6ff4cc658342ab0605053afc6932b
Instruction ID: 0debd8558679882e57ae2912c6de22387b45f61ec8d7045d3b8f7729d95fc824
Opcode Fuzzy Hash: 36f2bb7718e39f5edead508affdf672497c6ff4cc658342ab0605053afc6932b
Instruction Fuzzy Hash: A0E08C61A88340A4E321A6219C02B177A804B20308F10C83BAA94A01D2F3BAA414920F

Function 004278F3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wininet.dll,0042243C,0048BD28,C:\Users\user\Desktop\regsvr.exe,00000000), ref: 004278FE
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 00427910

Strings

Wininet.dll, xrefs: 004278F9
InternetCloseHandle, xrefs: 0042790A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InternetCloseHandle$Wininet.dll
API String ID: 2574300362-2671934185
Opcode ID: 08f3149d8d36fd44fb1864513348ab5e65787f78489d18da61c39225afc60a84
Instruction ID: e57f70343dd4c56c6334594ce8c190453b758616a0c766aedd2bb5c70442515f
Opcode Fuzzy Hash: 08f3149d8d36fd44fb1864513348ab5e65787f78489d18da61c39225afc60a84
Instruction Fuzzy Hash: 53D012747047228FD7208F36E848703B7E4AB10749B90C82EE899D3361E7B8D4C0C718

Function 004279F2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wininet.dll,?,?,?,?,?,?,00422654,00000000,?,80000000,?,00000000), ref: 004279FD
GetProcAddress.KERNEL32(00000000,FtpOpenFileW), ref: 00427A0F

Strings

Wininet.dll, xrefs: 004279F8
FtpOpenFileW, xrefs: 00427A09

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: FtpOpenFileW$Wininet.dll
API String ID: 2574300362-1343039947
Opcode ID: 53a407b36a657ad3230ca38998e8dc96aa674ca352c94186afa8b4afea526ce1
Instruction ID: 1c6b2d396cc8cf313c3881dd2b680bb96f39c62c27d3dcf14593c4f52cea01f5
Opcode Fuzzy Hash: 53a407b36a657ad3230ca38998e8dc96aa674ca352c94186afa8b4afea526ce1
Instruction Fuzzy Hash: 77D012707447029FD720CF25E84571677E4EB54765B90C82AE859D2351E778D980CB19

Function 00427A25 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wininet.dll,004228D4,?,20000013,?,?,00000000,00000000), ref: 00427A30
GetProcAddress.KERNEL32(00000000,HttpQueryInfoW), ref: 00427A42

Strings

Wininet.dll, xrefs: 00427A2B
HttpQueryInfoW, xrefs: 00427A3C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: HttpQueryInfoW$Wininet.dll
API String ID: 2574300362-1827896123
Opcode ID: 9f53bba96c1c1be1c18992919cd2949dca735729293c952a43a545a568b5ed63
Instruction ID: 60ab00e3550b917424601f743db06bbfc21b9fc7212208a0ea230d151ad99b41
Opcode Fuzzy Hash: 9f53bba96c1c1be1c18992919cd2949dca735729293c952a43a545a568b5ed63
Instruction Fuzzy Hash: E2D0C730744702CFC730CF21E808B067BE0AB00318B90C82AE899D2B60E3BCD880CB18

Function 00409AE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,0040992E,?,?,00000000,00008000,?,?,00000000,?,0040252D,?,0000102B,?,00000000,?), ref: 00409AEB
GetProcAddress.KERNEL32(00000000,VirtualFreeEx), ref: 00409AFD

Strings

kernel32.dll, xrefs: 00409AE6
VirtualFreeEx, xrefs: 00409AF7

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: VirtualFreeEx$kernel32.dll
API String ID: 2574300362-1049216354
Opcode ID: 5f085c3b596ea7af617f30540299be4fa1aa7f445357cc35fc203afc14edded3
Instruction ID: b0843d2a3e91bbadeba752a2b0fa07e5d8402a4f88517d0cb1a798b0c6c03347
Opcode Fuzzy Hash: 5f085c3b596ea7af617f30540299be4fa1aa7f445357cc35fc203afc14edded3
Instruction Fuzzy Hash: ADD01230B007019BD720CF66D848B1277F4FB40B54B50883EE896E2791E778E880DB19

Function 00427AB6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wininet.dll,00422E65,00000000,00000032,?,00000008), ref: 00427AC1
GetProcAddress.KERNEL32(00000000,InternetSetOptionW), ref: 00427AD3

Strings

Wininet.dll, xrefs: 00427ABC
InternetSetOptionW, xrefs: 00427ACD

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InternetSetOptionW$Wininet.dll
API String ID: 2574300362-1330685833
Opcode ID: 50e255ccd9ed52bd2b2a0b879efe487445a8dee2ad3e0532395467fc13b3f382
Instruction ID: 5b090d589b15056aa88f841f34ee83b4c958b36ee86c144ad9820f128b68dc83
Opcode Fuzzy Hash: 50e255ccd9ed52bd2b2a0b879efe487445a8dee2ad3e0532395467fc13b3f382
Instruction Fuzzy Hash: E9D0E2307057129FCB20DF25D84875B7AE4EB10715B90C82AA899D2751E6B8D580CB18

Function 0040576F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,004056E6), ref: 0040577A
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0040578C

Strings

GetNativeSystemInfo, xrefs: 00405786
kernel32.dll, xrefs: 00405775

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: c037bd46081226ec5a6f6ed1ec0dab98988bc471210bb2df0f891432a5e7d1cd
Instruction ID: 420fe3a500a39e7420e5a52ea2d8945ebf08d7ee9e20d915519dfb2d051aeb6e
Opcode Fuzzy Hash: c037bd46081226ec5a6f6ed1ec0dab98988bc471210bb2df0f891432a5e7d1cd
Instruction Fuzzy Hash: BCD01770600702CBC7209F31C8887077BE4EF00341F24C83EA89AD26A0F67880C0DA2A

Function 0043A8CD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,0043A31C), ref: 0043A8D8
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 0043A8EA

Strings

MonitorFromPoint, xrefs: 0043A8E4
user32.dll, xrefs: 0043A8D3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: MonitorFromPoint$user32.dll
API String ID: 2574300362-355800951
Opcode ID: 2b40685677c30f5f1ba40346f155b817c8fa63ab2c1a2f9a178e0a2192c71bde
Instruction ID: f5758fe716f7764f35791310c7bbb598c1b730625ed9026ef912be339ee3ac71
Opcode Fuzzy Hash: 2b40685677c30f5f1ba40346f155b817c8fa63ab2c1a2f9a178e0a2192c71bde
Instruction Fuzzy Hash: 01D01730540303CBC720AF71E80930676E4FF04381F20C83EA8AAD2260EAB890D0CA2A

Function 0043A8FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,0043A329), ref: 0043A907
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 0043A919

Strings

GetMonitorInfoW, xrefs: 0043A913
user32.dll, xrefs: 0043A902

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetMonitorInfoW$user32.dll
API String ID: 2574300362-3787768890
Opcode ID: 2fae2545fb0f0f17803c80b19f853822b0c64d9ae8309f722d68541239426dc6
Instruction ID: f8ab3e933bdad9017723fd56e0b7b8b2c73ab20a92962e0d90ef9e7f405feff4
Opcode Fuzzy Hash: 2fae2545fb0f0f17803c80b19f853822b0c64d9ae8309f722d68541239426dc6
Instruction Fuzzy Hash: F8D05E7054130ACFC7208F31C80930677E8EF08345F21CC3EE89AE2260E6B898D0CA1A

Function 00427926 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,00421D79), ref: 00427931
GetProcAddress.KERNEL32(00000000,BlockInput), ref: 00427943

Strings

BlockInput, xrefs: 0042793D
user32.dll, xrefs: 0042792C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: BlockInput$user32.dll
API String ID: 2574300362-2937418566
Opcode ID: b76bede5acc9c59ba84e0cf6f11f735df99599eea85705da7afe36b04919c3bc
Instruction ID: 44b60320ad8f2b1a110e3cdea58c9796acdb707607bf84f5158fc73b52388c45
Opcode Fuzzy Hash: b76bede5acc9c59ba84e0cf6f11f735df99599eea85705da7afe36b04919c3bc
Instruction Fuzzy Hash: 7BD05E70645312CFD720AF31DC083077BE4AB00351B60CC3EE89AC2260E67880C0CA29

Function 0043A92B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,004404F2), ref: 0043A936
GetProcAddress.KERNEL32(00000000,SetLayeredWindowAttributes), ref: 0043A948

Strings

SetLayeredWindowAttributes, xrefs: 0043A942
user32.dll, xrefs: 0043A931

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SetLayeredWindowAttributes$user32.dll
API String ID: 2574300362-3673630139
Opcode ID: 0d756947f098a8d7ca462c92a294368173d765b65dd87a08536f26fcf6a8470d
Instruction ID: 2797e706a136f24d43ae82701378b70d6c8e9a85002718e55fac452cd95b25a7
Opcode Fuzzy Hash: 0d756947f098a8d7ca462c92a294368173d765b65dd87a08536f26fcf6a8470d
Instruction Fuzzy Hash: E0D05E70544307CFCB209F31C8497067BE4AF04345F21CC3EEAAAD2260EAB8C0D0DA2A

Function 004279C3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wininet.dll,004225AF,?,00000000,?,?,?,?,?), ref: 004279CE
GetProcAddress.KERNEL32(00000000,InternetConnectW), ref: 004279E0

Strings

Wininet.dll, xrefs: 004279C9
InternetConnectW, xrefs: 004279DA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InternetConnectW$Wininet.dll
API String ID: 2574300362-1624158369
Opcode ID: f6e454fb2c572af5dc8a16c9929043ed5b295633bfcaaa9e9827188f536c43eb
Instruction ID: ae7894eb1d2c0d0b708a08299db14a306c5462dd327225007823b004d8705b2f
Opcode Fuzzy Hash: f6e454fb2c572af5dc8a16c9929043ed5b295633bfcaaa9e9827188f536c43eb
Instruction Fuzzy Hash: 3ED05E70A04703DFD7209F31D80930776E4AB00351F20CC3FE89AD2660E6B884C0CA1A

Function 0040D9E9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,0040BCD1,75920F00,0048BA08), ref: 0040D9F4
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0040DA06

Strings

CreateToolhelp32Snapshot, xrefs: 0040DA00
kernel32.dll, xrefs: 0040D9EF

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: CreateToolhelp32Snapshot$kernel32.dll
API String ID: 2574300362-2184173117
Opcode ID: 7484c8877aeab85a346e2eb731da51ad3ca1b1819ee2fe32edf44ac43bf59c76
Instruction ID: 28bd778d8b3b8fc72457058bb7913f95cc2dcda0f6b3158bf651c55d9db58da5
Opcode Fuzzy Hash: 7484c8877aeab85a346e2eb731da51ad3ca1b1819ee2fe32edf44ac43bf59c76
Instruction Fuzzy Hash: 5CD05E30A04302CFC720CF71C8487067AE4AF00741B20CC3EE896E26E0F77894C0CA1A

Function 0040DA47 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,0040BCF1,75920F00,0048BA08), ref: 0040DA52
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0040DA64

Strings

Process32NextW, xrefs: 0040DA5E
kernel32.dll, xrefs: 0040DA4D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Process32NextW$kernel32.dll
API String ID: 2574300362-1444338893
Opcode ID: 57b3287ed15c8ca71970d673d093b5f861b8d81cf0ae60c7e5c339caa40d7b06
Instruction ID: 9c608c4ddff85697b457ec27740170979cf90a3826af323554e570c5851ea382
Opcode Fuzzy Hash: 57b3287ed15c8ca71970d673d093b5f861b8d81cf0ae60c7e5c339caa40d7b06
Instruction Fuzzy Hash: 35D05E30B04302DFCB20CF71CC48B067AE4AB00385B20CC3EE896D26A0F77880C0CA1A

Function 00427A58 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wininet.dll,00422B8A), ref: 00427A63
GetProcAddress.KERNEL32(00000000,FtpGetFileSize), ref: 00427A75

Strings

Wininet.dll, xrefs: 00427A5E
FtpGetFileSize, xrefs: 00427A6F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: FtpGetFileSize$Wininet.dll
API String ID: 2574300362-2899565566
Opcode ID: aa19d241f5507953495670fe32c84c8265dfa4f59de8b289c8bf3ea2712e5869
Instruction ID: be39eaff734a1b21d138eed37c54e3d0039641f98ad1bfcf6a37c152186c2aa0
Opcode Fuzzy Hash: aa19d241f5507953495670fe32c84c8265dfa4f59de8b289c8bf3ea2712e5869
Instruction Fuzzy Hash: C0D05E30608702CFC720DF71D90831A77E5AB00351F20CC3EE89AD2260E6B8C0C0CA19

Function 0040DA76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Psapi.dll,0040BE7D,00000000,75920F00,0048BA08,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040DA81
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0040DA93

Strings

Psapi.dll, xrefs: 0040DA7C
EnumProcesses, xrefs: 0040DA8D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: EnumProcesses$Psapi.dll
API String ID: 2574300362-2142768860
Opcode ID: ed4f09d33d931c46da0aacd8068d9963166d8f57de016f21d98bea1b3b700ceb
Instruction ID: f5b7eddae680a6db0b9bdb5067001b91e79b18a25f5340ddcbe06836c19eae42
Opcode Fuzzy Hash: ed4f09d33d931c46da0aacd8068d9963166d8f57de016f21d98bea1b3b700ceb
Instruction Fuzzy Hash: 6FD06270644702DBC720DFB1C849717B6F5AB04755B11CC3BA895D1691E6789484DA15

Function 0040DA18 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,0040BCE1,75920F00,0048BA08), ref: 0040DA23
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0040DA35

Strings

kernel32.dll, xrefs: 0040DA1E
Process32FirstW, xrefs: 0040DA2F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Process32FirstW$kernel32.dll
API String ID: 2574300362-3009187892
Opcode ID: 9ce6d271d76ba9c6968771be08bc24a65401811c7ddece85b2c3ed222ced13df
Instruction ID: 5ded4323199b64dce0b2e52442a0e625a99a92c272301f46ed1039b54e14b8de
Opcode Fuzzy Hash: 9ce6d271d76ba9c6968771be08bc24a65401811c7ddece85b2c3ed222ced13df
Instruction Fuzzy Hash: 51D05E30A04302CFC720CFB1C9487067AE6EB14345B20CC3EF8A6D26A0F7B880C0CA1A

Function 0040DAD4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Psapi.dll,0040BEA3,00000000,75920F00,0048BA08,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040DADF
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040DAF1

Strings

GetModuleBaseNameW, xrefs: 0040DAEB
Psapi.dll, xrefs: 0040DADA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleBaseNameW$Psapi.dll
API String ID: 2574300362-3411073148
Opcode ID: 66c654cf5cdad88c490a24c94ff5cd6865fab69cdabf375be4bd7da69510d967
Instruction ID: c7a7049720f05cde5cad85652193c26f7b00980f625459dad3dc74f02b97c0dc
Opcode Fuzzy Hash: 66c654cf5cdad88c490a24c94ff5cd6865fab69cdabf375be4bd7da69510d967
Instruction Fuzzy Hash: 66D012706043028FC720CF71C84831676E5AB10345B10CC7AA897E1290E6B89080DA15

Function 00427AE9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00425D80), ref: 00427AF4
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 00427B06

Strings

GlobalMemoryStatusEx, xrefs: 00427B00
kernel32.dll, xrefs: 00427AEF

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GlobalMemoryStatusEx$kernel32.dll
API String ID: 2574300362-2840702992
Opcode ID: d0aefe17078ca4d64b212f5a88d9be9b6a24afedf4d771f8acfadd1d2418f758
Instruction ID: 6d1ae85a1f97f58671789afb50c503cc590da1a6aad909c8c334f9fb6de4b0bc
Opcode Fuzzy Hash: d0aefe17078ca4d64b212f5a88d9be9b6a24afedf4d771f8acfadd1d2418f758
Instruction Fuzzy Hash: 10D05E30704302CFC720CF35D80CB067AE4AB00349F20DC3EE896C2660E7B890C0CA19

Function 00427A87 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wininet.dll,00422C85,00000000,?), ref: 00427A92
GetProcAddress.KERNEL32(00000000,InternetCrackUrlW), ref: 00427AA4

Strings

Wininet.dll, xrefs: 00427A8D
InternetCrackUrlW, xrefs: 00427A9E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InternetCrackUrlW$Wininet.dll
API String ID: 2574300362-347599637
Opcode ID: ea6788a40bef9bf8d335b074dab1fbce2954471e87f924479586483723d6aa49
Instruction ID: 86bf53b7e51623ac5082525813fab7f1c3c4550fe7371d9ff3988e40de5e1115
Opcode Fuzzy Hash: ea6788a40bef9bf8d335b074dab1fbce2954471e87f924479586483723d6aa49
Instruction Fuzzy Hash: 57D05E30B04702DFC720CF32D80870A76E4AB00355F20CC3EE89AC2260EBB880C0DB19

Function 0040DAA5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Psapi.dll,0040BE93,00000000,75920F00,0048BA08,?,0040BCA4,?,00000104,00000000,0048BA08,?,00430153,02B91720,?), ref: 0040DAB0
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0040DAC2

Strings

EnumProcessModules, xrefs: 0040DABC
Psapi.dll, xrefs: 0040DAAB

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: EnumProcessModules$Psapi.dll
API String ID: 2574300362-751739868
Opcode ID: 62d1bd7b565e081a1fc4fdd261c73a2f42b1f1968a47bd22e9e630354963f29b
Instruction ID: 4d941873899e4c24b4f1f1ffa7c0f3f1776ab5745f5d98f4ae1e82fd9420afa3
Opcode Fuzzy Hash: 62d1bd7b565e081a1fc4fdd261c73a2f42b1f1968a47bd22e9e630354963f29b
Instruction Fuzzy Hash: ABD05E70A14302DFC720CF71C94931776E4AB40355B24DC3FE8A6E26A0F77994C0CA2A

Function 00427B47 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ICMP.DLL,00426A36,00000000,00000101,?), ref: 00427B52
GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 00427B64

Strings

IcmpCloseHandle, xrefs: 00427B5E
ICMP.DLL, xrefs: 00427B4D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ICMP.DLL$IcmpCloseHandle
API String ID: 2574300362-3530519716
Opcode ID: 8f28ac2006ffe70631a1253a18dc1e211e4663e54d05d9189045e5868cddcfc5
Instruction ID: 8672c0e0ef4863b76ebeeb2db669afa689ae5eba9539b3d2b3e0a889971e594a
Opcode Fuzzy Hash: 8f28ac2006ffe70631a1253a18dc1e211e4663e54d05d9189045e5868cddcfc5
Instruction Fuzzy Hash: DBD05E70A04302CFCB309F32D848B067AE4AF00346F20CC3EE99AC23A0E67890C0CA19

Function 00427B76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ICMP.DLL,00426A43,00000000,00000101,?), ref: 00427B81
GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 00427B93

Strings

IcmpSendEcho, xrefs: 00427B8D
ICMP.DLL, xrefs: 00427B7C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ICMP.DLL$IcmpSendEcho
API String ID: 2574300362-58917771
Opcode ID: 84bed99754387deee0e680a7c2f3272997de1789183039d9230deaba62afea0d
Instruction ID: 1d4d99d6db18da3650d726b166d65afd412cb1229f349dbb20e9186e86b4f61f
Opcode Fuzzy Hash: 84bed99754387deee0e680a7c2f3272997de1789183039d9230deaba62afea0d
Instruction Fuzzy Hash: D2D05E30605702CFD720AF31DC087077AE4AB00346B20CC3EE8AAC22A2E678A0C0CA19

Function 00427B18 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ICMP.DLL,004269A5), ref: 00427B23
GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 00427B35

Strings

IcmpCreateFile, xrefs: 00427B2F
ICMP.DLL, xrefs: 00427B1E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ICMP.DLL$IcmpCreateFile
API String ID: 2574300362-275556492
Opcode ID: b4ad487a783e1d7bfb1656269052bf99816fe8d5d499e873bae820f25298bd5b
Instruction ID: 57ba0db0c0d9935087a62fbc16d5e5fb205244368b1ae8c3228f67b5f4ce217b
Opcode Fuzzy Hash: b4ad487a783e1d7bfb1656269052bf99816fe8d5d499e873bae820f25298bd5b
Instruction Fuzzy Hash: 5AD05E70604302DFC7209F31D908706BAE5EB10345B20CC3FE8AAC22A0E67890C0CB19

Function 0041ED66 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(shell32.dll,0041DA63), ref: 0041ED71
GetProcAddress.KERNEL32(00000000,SHEmptyRecycleBinW), ref: 0041ED83

Strings

SHEmptyRecycleBinW, xrefs: 0041ED7D
shell32.dll, xrefs: 0041ED6C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHEmptyRecycleBinW$shell32.dll
API String ID: 2574300362-2648762502
Opcode ID: 1194797544239af703dbc6869210b20b5af27adae2b74ff9f78b483b034ae112
Instruction ID: 1b9d0de806687f87f538c486bf067965bab02528b0a7e7b19d20469b5d123dcc
Opcode Fuzzy Hash: 1194797544239af703dbc6869210b20b5af27adae2b74ff9f78b483b034ae112
Instruction Fuzzy Hash: A2D05E30540302CFC7209F32E808B07BAE4BF00345B20CC3EEC96C22A0F67890C0CA1A

Function 00433D7C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Psapi.dll,004305B9), ref: 00433D87
GetProcAddress.KERNEL32(00000000,GetProcessMemoryInfo), ref: 00433D99

Strings

Psapi.dll, xrefs: 00433D82
GetProcessMemoryInfo, xrefs: 00433D93

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessMemoryInfo$Psapi.dll
API String ID: 2574300362-1709866170
Opcode ID: 6a74eff8254b013d3a5c1ba8e89bd335f6a75ad96a0e3801fa0a854c6f297c07
Instruction ID: 43160a7b4c6c75c0376d90d86c873bb56eda1254c813ee9b55ecc445635d0d7f
Opcode Fuzzy Hash: 6a74eff8254b013d3a5c1ba8e89bd335f6a75ad96a0e3801fa0a854c6f297c07
Instruction Fuzzy Hash: 6AD05E70540302CFC7208F32C94970677E4AB54352F20DC3FE896D2260F77894D0CA1A

Function 0041ED08 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,0041C9E4,00000000), ref: 0041ED13
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExW), ref: 0041ED25

Strings

kernel32.dll, xrefs: 0041ED0E
GetDiskFreeSpaceExW, xrefs: 0041ED1F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 2574300362-1127948838
Opcode ID: f782902c30e3ae857e0f025aa73a9f6c815e808367de765f87b4b3c3da234145
Instruction ID: c82ea21f10f30a4f7c59a10dd8345c001258c3e4705128159ccbf0c67bc6cc17
Opcode Fuzzy Hash: f782902c30e3ae857e0f025aa73a9f6c815e808367de765f87b4b3c3da234145
Instruction Fuzzy Hash: A7D0173450030B8BD7208F32D90870677E5EB04345B21C83EAC96C2660E67890C0DA1A

Function 0041ED37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,0041CFEA), ref: 0041ED42
GetProcAddress.KERNEL32(00000000,CreateHardLinkW), ref: 0041ED54

Strings

kernel32.dll, xrefs: 0041ED3D
CreateHardLinkW, xrefs: 0041ED4E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: CreateHardLinkW$kernel32.dll
API String ID: 2574300362-294928789
Opcode ID: 6b20ecf0885143366b6c71dba4e8d0c9d16a3201abb07122433001394a88abd7
Instruction ID: 085399678d84b1d6def0fa271d9c99049f470565a0e7db38c4bdfa974ff0378f
Opcode Fuzzy Hash: 6b20ecf0885143366b6c71dba4e8d0c9d16a3201abb07122433001394a88abd7
Instruction Fuzzy Hash: 89D017305403028BC7208F32D808B0777E5AF00381B20C83EAC96C26A0E67880C0CA2A

Function 00433DDA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Advapi32.dll), ref: 00433DE5
GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 00433DF7

Strings

CreateProcessWithLogonW, xrefs: 00433DF1
Advapi32.dll, xrefs: 00433DE0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Advapi32.dll$CreateProcessWithLogonW
API String ID: 2574300362-755999451
Opcode ID: 611f8aec9c8c5d8bb75f4fcc9120e60d7c1ce9bf5a36164a453839588168c94a
Instruction ID: 37d9f696a655c4c479ff660416ab556ffa549eb04b7ad0110d5eb857d8c0101d
Opcode Fuzzy Hash: 611f8aec9c8c5d8bb75f4fcc9120e60d7c1ce9bf5a36164a453839588168c94a
Instruction Fuzzy Hash: 86D01730900302CBC7208F76CC0A7177AE5AB14342F20C82AA89AC2660E678A580CA19

Function 00433DAB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,0043048B), ref: 00433DB6
GetProcAddress.KERNEL32(00000000,GetProcessIoCounters), ref: 00433DC8

Strings

kernel32.dll, xrefs: 00433DB1
GetProcessIoCounters, xrefs: 00433DC2

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessIoCounters$kernel32.dll
API String ID: 2574300362-999795910
Opcode ID: 339b3c5f490e09a691900cc8c828b822bdf1fe214bf33dd18b5a22b8d67d0cb5
Instruction ID: 8b407ad04e4463e96094e744a46e4a5cab361105b8cf8a3ef54501a4b6c9d52c
Opcode Fuzzy Hash: 339b3c5f490e09a691900cc8c828b822bdf1fe214bf33dd18b5a22b8d67d0cb5
Instruction Fuzzy Hash: CED067706007029BDB609F75C84970677E4EF04786F21D82EE896D2AA0F678A5C0DA19

Function 0045FB41 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00453EB1), ref: 0045FB46
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0045FB56

Strings

IsProcessorFeaturePresent, xrefs: 0045FB50
KERNEL32, xrefs: 0045FB41

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: a49159cfade4896ca8724ffbfadfc9e740a769a311552b960f07c313dbd1b2d4
Instruction ID: d4c83df978edc4f065066c0197f2b1cc833cf3d5380d2a43b66dc6ebbdcb50df
Opcode Fuzzy Hash: a49159cfade4896ca8724ffbfadfc9e740a769a311552b960f07c313dbd1b2d4
Instruction Fuzzy Hash: DFC01220B88202E6EA115BB18C2DF1622482B00B03F180033AC01E0282FA9CE228E92F

Function 0040E2B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,004010C0,?), ref: 0040E2BA
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0040E2CA

Strings

IsDebuggerPresent, xrefs: 0040E2C4
kernel32.dll, xrefs: 0040E2B5

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$kernel32.dll
API String ID: 1646373207-2078679533
Opcode ID: 49cf6bddfaafe507273fb610119f6577bf241112a089293395c58fc312205660
Instruction ID: da9fff722c5815cfe112fee6522940994cee320bcfdf9fc481dd776cbae943e8
Opcode Fuzzy Hash: 49cf6bddfaafe507273fb610119f6577bf241112a089293395c58fc312205660
Instruction Fuzzy Hash: 9CC04C6074C30157EB246FB25C49B573A9D7940B45358487BA941E16D1FFB8C450952F

Function 0042799C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wininet.dll,?,?,004224A7), ref: 004279A7
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 004279B9

Strings

Wininet.dll, xrefs: 004279A2
InternetReadFile, xrefs: 004279B3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: InternetReadFile$Wininet.dll
API String ID: 2574300362-924813344
Opcode ID: ec1d8329e6142224069133f776555a6525cbb6d559760011276ece81c92f1949
Instruction ID: 4dfd4e6fa34d17f2a4052412c2b5b122fcf7795a42c1a7ba1782321997c02822
Opcode Fuzzy Hash: ec1d8329e6142224069133f776555a6525cbb6d559760011276ece81c92f1949
Instruction Fuzzy Hash: 30D0C9F0706702DEDB204F21D8087437AE4AF44B09F60C82EF899D1251E7B884C0DA19

Function 00431A91 Relevance: 6.2, APIs: 4, Instructions: 187COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00431AFB
_strcat.LIBCMT ref: 00431B27
_malloc.LIBCMT ref: 00431B6C
_wcscpy.LIBCMT ref: 00431B8B

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _malloc$_strcat_wcscpy
String ID:
API String ID: 3340056812-0
Opcode ID: 82e27eac208524e84b849519619e38b2b28ffcd29e890681b842ab6b32e0aef4
Instruction ID: 545718dd6d3eb59869aef27a5fd983a10283a723f38f0facfefcd2d3d8c06f9e
Opcode Fuzzy Hash: 82e27eac208524e84b849519619e38b2b28ffcd29e890681b842ab6b32e0aef4
Instruction Fuzzy Hash: D4514074B142449BCB04EF7594819AAB3A1EF48329B10553FF816EB792DB3CE944CF49

Function 00402BE7 Relevance: 6.1, APIs: 4, Instructions: 136windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,?), ref: 00402C30
__itoa.LIBCMT ref: 00402C62

Part of subcall function 00402A8A: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00402AF8

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00402CD3
__itoa.LIBCMT ref: 00402D2C

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$__itoa
String ID:
API String ID: 1034417225-0
Opcode ID: 6479adf1d464423e06f06b4b2c1064078296a0e095f77806e5d8418aa2d08842
Instruction ID: f21ff541d15882a80bdd26e4922d95dc45ac5a5ef2a736d9e174221dac97fa04
Opcode Fuzzy Hash: 6479adf1d464423e06f06b4b2c1064078296a0e095f77806e5d8418aa2d08842
Instruction Fuzzy Hash: 89418D31A00219ABEF10AF56CC45BDE7B74EF04308F00442AF904B72D1DBB8AE548B99

Function 004284B9 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0046BF68,00000000,?,?,?,?,?,0042990A,00000000,00000001,NULL Pointer assignment,00000001,?,0046BF68,00000000), ref: 004284FA
VariantCopy.OLEAUT32(?,0042990A), ref: 00428545
VariantCopy.OLEAUT32(?,00000008), ref: 0042855A
VariantCopy.OLEAUT32(?,00000008), ref: 0042856F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CopyVariant$ErrorLast
String ID:
API String ID: 2286883814-0
Opcode ID: c095161b3c3eca1da13a5db254ed57251c27e5cd8a724a4257930d794c638cfe
Instruction ID: 8cf9b7f0eae6392f00d0b55afd495f1606c12864f6b5e59e74c38ae41be95c8a
Opcode Fuzzy Hash: c095161b3c3eca1da13a5db254ed57251c27e5cd8a724a4257930d794c638cfe
Instruction Fuzzy Hash: F3416071601219AFCB00DF69D885AEEB7B4FF48304F54416FE40597321DB78A990CB99

Function 0043D761 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0043D7D3
InvalidateRect.USER32(?,00000000,00000000), ref: 0043D83A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Rect$InvalidateWindow
String ID:
API String ID: 2377233956-0
Opcode ID: 0b84d6a4fdc5eddc79ad7f804bf8f833126f0093fdb90673e781d4869b4b077e
Instruction ID: e273a0cc10c76d77dfc785e0b16cc78f071781885517d2caa0eb69e1639e6bd8
Opcode Fuzzy Hash: 0b84d6a4fdc5eddc79ad7f804bf8f833126f0093fdb90673e781d4869b4b077e
Instruction Fuzzy Hash: A3418271E00605EFDF28EF64E880AAEB7B1BF48314F10566AE961A7250D374BD60CB59

Function 0043C049 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 0043C0E2
DestroyCursor.USER32(?), ref: 0043C0F3
DeleteObject.GDI32(?), ref: 0043C104
DestroyCursor.USER32(?), ref: 0043C13A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CursorDeleteDestroyObject
String ID:
API String ID: 1476932828-0
Opcode ID: d827a9a6a5ef61c03da4cd5de3216072c1900717e694b6c871e29928bc81ee2a
Instruction ID: f8350339b93945bbf5ca816c8f63d24256579e2598d33d114b21afe132fca540
Opcode Fuzzy Hash: d827a9a6a5ef61c03da4cd5de3216072c1900717e694b6c871e29928bc81ee2a
Instruction Fuzzy Hash: 2D418F35600345DBDB249F69DCC8A2A73B8EB0E314F18642BE905E7352D778E840DF6A

Function 00460FDA Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0046100A
__isleadbyte_l.LIBCMT ref: 0046103E
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,?,?,?,0045A20C,?,?,00000002), ref: 0046106F
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,0045A20C,?,?,00000002), ref: 004610DD

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e28c209b323841a4df19f396737b8bd8f1a375e92dc0d940a87a02ad87e6c617
Instruction ID: e90498c06a421d08c173bb6830835a9890051fd003bfad16de7ce8be1aabad97
Opcode Fuzzy Hash: e28c209b323841a4df19f396737b8bd8f1a375e92dc0d940a87a02ad87e6c617
Instruction Fuzzy Hash: 69319331A04285EFDF20DF64C840AAE7BB4BF01355F1885ABE4508B6A5F735D980DB5A

Function 00443EEE Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?,0048A010,?,?), ref: 00443F11
SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00443F71
Rectangle.GDI32(?,00000000,00000000,?,?), ref: 00443FBC
EndPaint.USER32(?,?,?,?,00000000,00000000,?,?,?,?,00000000,?,?), ref: 0044400F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Paint$BeginRectangleViewport
String ID:
API String ID: 1204901048-0
Opcode ID: 161c840d6323463e4be95f6d8e2924c974c8fc9d42331a84e691006ef1c6bfff
Instruction ID: bea841b065eb83fee81ec24a1a64a5fce1f1c64dce503faa51bae763fb5dbe24
Opcode Fuzzy Hash: 161c840d6323463e4be95f6d8e2924c974c8fc9d42331a84e691006ef1c6bfff
Instruction Fuzzy Hash: 3431FA30D00214AFEB119F14DC85BAEBBB4EF00725F10466AF9519B2A1D3789D45DB58

Function 0043B51A Relevance: 6.1, APIs: 4, Instructions: 88windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0043B539
GetWindowRect.USER32(00000003,?), ref: 0043B586
PtInRect.USER32(?,0048A060,000000FF), ref: 0043B596
MessageBeep.USER32(00000000), ref: 0043B604

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: df27d74fd1adc3461149a3bb43d0c56fa8171d90bdffc4a29afb3a98d7d18a64
Instruction ID: 12492d7e1148cac61e3e525d5cf99d49772068cf899de8fc26f14cdbc9f9d409
Opcode Fuzzy Hash: df27d74fd1adc3461149a3bb43d0c56fa8171d90bdffc4a29afb3a98d7d18a64
Instruction Fuzzy Hash: 12313E31900209EFDB20CF59C445B9EBBF4EF09318F14559AD521E6290D778DE44CF96

Function 00408E35 Relevance: 6.1, APIs: 4, Instructions: 88keyboardwindowCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(00000011,00000000), ref: 00408E45
GetKeyboardState.USER32(?), ref: 00408E82
SetKeyboardState.USER32(00000080), ref: 00408E97
PostMessageW.USER32(?,00000100,00000011,00000000), ref: 00408F00

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: KeyboardState$MessagePostVirtual
String ID:
API String ID: 863366817-0
Opcode ID: 2efead515a75791721b07f3c0dd1f57b2857987c3408928a358ee1463599cf4b
Instruction ID: 846ba6a3f039adf3d8e89b73ddfd1cffcf3a589b14685dac6fc388346d85dbcd
Opcode Fuzzy Hash: 2efead515a75791721b07f3c0dd1f57b2857987c3408928a358ee1463599cf4b
Instruction Fuzzy Hash: F721F9716002116ADB305629CE88BBB3A1A9BD1350F45413FE9C5B72C6CE7C4C8697AE

Function 00408F3F Relevance: 6.1, APIs: 4, Instructions: 84keyboardwindowCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(00000011,00000000), ref: 00408F4F
GetKeyboardState.USER32(?), ref: 00408F8C
PostMessageW.USER32(?,00000101,00000011,00000000), ref: 00408FF6
SetKeyboardState.USER32(?), ref: 0040900D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: KeyboardState$MessagePostVirtual
String ID:
API String ID: 863366817-0
Opcode ID: a87427e843264fe2b0c4c711e1774dbe50c5a869ebea08ce98c37f31ca4bd9c9
Instruction ID: e4fa19226f6e752cab38e5f3bae3713b1f58b2b6ccc06d6c61f689ad8759ce09
Opcode Fuzzy Hash: a87427e843264fe2b0c4c711e1774dbe50c5a869ebea08ce98c37f31ca4bd9c9
Instruction Fuzzy Hash: 6321047050021666EB305A398DCCBE77B1DDB91394F15003BF995762D2CBBD9CC2866E

Function 0043DBDD Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 0043DBF6
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000002,000000FF,000000FF,000000FF,00000001,00000004,00000000,00000002,00000000,?), ref: 0043DC4F
SendMessageW.USER32(00000001,00000030,00000000,00000001), ref: 0043DC5F
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0043DC87

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CreateDeleteFontMessageMoveObjectSendWindow
String ID:
API String ID: 2991177864-0
Opcode ID: b5c01f5b47ffe5de0817ca0eeae40f95bcbab405e62c41bbfbe0495c62b4bd7f
Instruction ID: 07e63a0842e90d72c6378ef92484882758498f76492fe4b417677636f71defd8
Opcode Fuzzy Hash: b5c01f5b47ffe5de0817ca0eeae40f95bcbab405e62c41bbfbe0495c62b4bd7f
Instruction Fuzzy Hash: B62160B2900615BFE7109FA4DD85EAB7BACFB08759F005061FA01E6251D3B4AD50CBA4

Function 00404290 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404296
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 004042C0
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 004042F1
CharUpperBuffW.USER32(00000000,00000000,?,?,0040428D,?,?), ref: 0040431F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow
String ID:
API String ID: 2796087071-0
Opcode ID: 0484ec8d16b13a90b4ffddea9f75362cb7d762c0d69b827cde1be4c97e2fceae
Instruction ID: 3c7eb31f239e9aa073aa41912094c3fd81cfa18c72bffc806f03ab11c83ef897
Opcode Fuzzy Hash: 0484ec8d16b13a90b4ffddea9f75362cb7d762c0d69b827cde1be4c97e2fceae
Instruction Fuzzy Hash: FA110C732082006BF321562A9C46F3BBBD8EBC5724F00457EFA45A61C0EBBDEC018269

Function 0040263F Relevance: 6.1, APIs: 4, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040258A: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00402595

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00402677
__itoa.LIBCMT ref: 00402690
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 004026B4
__itoa.LIBCMT ref: 004026C5

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend$__itoa
String ID:
API String ID: 1034417225-0
Opcode ID: 6a40701b820029ecc14d76a7a248d3be8f9a622ee1221965fe71c1ff7d743af8
Instruction ID: 9d3434ac819a1789471cb966a4969bcd22a4ac27912ccf311385d9082d1b4278
Opcode Fuzzy Hash: 6a40701b820029ecc14d76a7a248d3be8f9a622ee1221965fe71c1ff7d743af8
Instruction Fuzzy Hash: 16119A71740204F6EB10AF658D4AF9E76A8AB44704F10483FF401F51C2E6FD99419B5E

Function 00427054 Relevance: 6.1, APIs: 4, Instructions: 65networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 004270AB
__WSAFDIsSet.WSOCK32(00000000,00000001,00000000,00000001,00000000,00000000,?), ref: 004270C5
accept.WS2_32(00000000,00000000,00000000), ref: 004270D5
WSAGetLastError.WS2_32(00000000,00000000,00000001,00000000,00000000,?), ref: 004270DE

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ErrorLastMessageacceptselect
String ID:
API String ID: 927852018-0
Opcode ID: 15611bfc40393262dce4c6815501722a3b919f04e4572bde013085f841e8f58c
Instruction ID: 4a93a70d94b3a64b85d847650a267a25dbaed4962d4b96a3fbd1506a1dcc8b61
Opcode Fuzzy Hash: 15611bfc40393262dce4c6815501722a3b919f04e4572bde013085f841e8f58c
Instruction Fuzzy Hash: DB11A5717011287BDB10AB7A9CC1AEFB7ECEB45314F14467FB406E3281DA789D848AA4

Function 004447A1 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

MoveToEx.GDI32(?,00000000,?,00000000), ref: 004447DB
PolyBezierTo.GDI32(?,?,00000003), ref: 004447E9
LineTo.GDI32(?,?,?), ref: 004447FE
LineTo.GDI32(?,00000000,FFFFFFFE), ref: 00444814

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Line$BezierMovePoly
String ID:
API String ID: 2412604778-0
Opcode ID: 8180a25d0f59ff2bf34a29dcdb8acd7184fe83524d7c551337ba7c685310def3
Instruction ID: 26e671d2fb9994fe77682ce7daed9aa180b1dbddb93ceb7be767603ea44d3bb3
Opcode Fuzzy Hash: 8180a25d0f59ff2bf34a29dcdb8acd7184fe83524d7c551337ba7c685310def3
Instruction Fuzzy Hash: E1110234900248FFEB219F58CC45BAB7BA9FF86718F014027FC8692211D3719D92CA78

Function 00444946 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

MoveToEx.GDI32(?,FFFFFFFE,00000000,00000000), ref: 00444984
_logf.LIBCPMT ref: 00444997
_logf.LIBCPMT ref: 004449B5
LineTo.GDI32(?,?,00000000), ref: 004449D1

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _logf$LineMove
String ID:
API String ID: 2044247434-0
Opcode ID: 7fca5595933b04d3a60d265ffe6383e849402ff69cd5472964a68a6aa2686c9c
Instruction ID: c5a76681743adf7b999c69aec59ad5da20a20ac75821f7948237001747c6a2e2
Opcode Fuzzy Hash: 7fca5595933b04d3a60d265ffe6383e849402ff69cd5472964a68a6aa2686c9c
Instruction Fuzzy Hash: 7921477290010AEFCB00AFA1EE099EE7B78FF04340F118569F845721A5DB348A70DB69

Function 0040C077 Relevance: 6.1, APIs: 4, Instructions: 51synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040C097
MessageBoxW.USER32(00000000,?,?,?), ref: 0040C0C7
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040C0DC
CloseHandle.KERNEL32(00000000), ref: 0040C0E3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3a461b0a7849f15d0c7a53f1f1889f95dc2c4b60ad5dc55d7191b71920de2b1c
Instruction ID: 68dee4e087d7114d11a20b65234cd4f7eaa897139ced1b4c656305c233959341
Opcode Fuzzy Hash: 3a461b0a7849f15d0c7a53f1f1889f95dc2c4b60ad5dc55d7191b71920de2b1c
Instruction Fuzzy Hash: F601F572804114FFC7015BE99D848EE7FADA705324B1442B7F510F2291E6754D4597AA

Function 0040C25D Relevance: 6.0, APIs: 4, Instructions: 50filetimeCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 0040C264
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0040C295
SetFileTime.KERNEL32(00000000,00000000,?,00000000), ref: 0040C2C3
CloseHandle.KERNEL32(00000000), ref: 0040C2CA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: File$AttributesCloseCreateHandleTime
String ID:
API String ID: 1550419386-0
Opcode ID: 3a47ade6f643f18aeff63981d1103ae7d47e3b78f763486892427656c65242d1
Instruction ID: e8b550afd85c3f92e44463ecb0f1c11cf1d601401178d23c8b88205d791c1f0e
Opcode Fuzzy Hash: 3a47ade6f643f18aeff63981d1103ae7d47e3b78f763486892427656c65242d1
Instruction Fuzzy Hash: AD017175805208FEEF101FA09CD4DAB3B1DDB16368F0043BAFE25356E093754D56A65A

Function 0045FA35 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0045FA59

Part of subcall function 0045F884: __fltout2.LIBCMT ref: 0045F8AE

__cftog_l.LIBCMT ref: 0045FA7F
__cftoe_l.LIBCMT ref: 0045FAB1

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: e69f371f74b045fbb5152984c990a52b04f961167a31e77fc91c2833b4590bea
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: 9D01433244014EBBCF125E84DC41CEE3F22BB5C355B548426FE2854632C73AC9BAAB87

Function 00454109 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454BF1: __amsg_exit.LIBCMT ref: 00454BFF

__amsg_exit.LIBCMT ref: 00454135
__lock.LIBCMT ref: 00454145
InterlockedDecrement.KERNEL32(?), ref: 00454162
InterlockedIncrement.KERNEL32(02B92BF0), ref: 0045418D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 96ddec8bdd3c8fdb330c801833a2aeb365393931cc23dce57864f3d017f1591d
Instruction ID: 7a10f278f3360717a59da4e6f89b8b30e491ddfa78837879bdc38dcac40a551e
Opcode Fuzzy Hash: 96ddec8bdd3c8fdb330c801833a2aeb365393931cc23dce57864f3d017f1591d
Instruction Fuzzy Hash: E601A131901E11A7C721AF66950979E77A4AF5471EF15401BEC086B283C72CA9CDCBDE

Function 0043F415 Relevance: 6.0, APIs: 4, Instructions: 46windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00080000,00000001,00000000,50000000,?,?,?,?,00000001,?,00000000,?), ref: 0043F457
GetStockObject.GDI32(00000011), ref: 0043F46B
SendMessageW.USER32(00000000,00000030,00000000), ref: 0043F475
ShowWindow.USER32(00000000,00000000,?,004401C0,?,Combobox,00000000,00000000,?,?,?,?,00000001,00000001,00000001,?), ref: 0043F48D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Window$CreateMessageObjectSendShowStock
String ID:
API String ID: 1358664141-0
Opcode ID: 87f90f506f80229ffa487107e05a684201f86a3185b7b634859c0de397f7ab3e
Instruction ID: 3a465f91b8be0505d5efdc3511d5f644b8a29406f0e90bc2eb619e2c7ab6860b
Opcode Fuzzy Hash: 87f90f506f80229ffa487107e05a684201f86a3185b7b634859c0de397f7ab3e
Instruction Fuzzy Hash: 07018C72100248BFDF128FA0DC44AEB3F6AFB69358F04403AFA1550220D77688A9EF65

Function 0040D921 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 0040D93A

Part of subcall function 0040DF43: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,C:\Users\user\Desktop\regsvr.exe,?,00412A47,0046BF68,?), ref: 0040DF75

_fprintf.LIBCMT ref: 0040D956

Part of subcall function 00452D03: _flsall.LIBCMT ref: 00452D17

__setmode.LIBCMT ref: 0040D982
OutputDebugStringW.KERNEL32(?), ref: 0040D992

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: __setmode$ByteCharDebugMultiOutputStringWide_flsall_fprintf
String ID:
API String ID: 3988768035-0
Opcode ID: 5e48517a55ca6455bfa4997ce195b5a66a69f7560ea1ee26a8a09b58379adce5
Instruction ID: 05e0aeb41481562ac6117dfac6535399c9c862da8d9b7532ddae16f5081f6c67
Opcode Fuzzy Hash: 5e48517a55ca6455bfa4997ce195b5a66a69f7560ea1ee26a8a09b58379adce5
Instruction Fuzzy Hash: 45F072B28012007ADB2177F2AD07DAF37689F03738B20021FF810312D2EABD0E49522E

Function 00454B7A Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00455081,0044EB47,00000001,004548D9,?,00000000,?,?,?,?,004549EB,?,0045321E), ref: 00454B7C

Part of subcall function 00454A33: TlsGetValue.KERNEL32(?,0045321E), ref: 00454A3A
Part of subcall function 00454A33: TlsSetValue.KERNEL32(00000000,0045321E), ref: 00454A5B

__calloc_crt.LIBCMT ref: 00454B9E

Part of subcall function 00456F77: __calloc_impl.LIBCMT ref: 00456F85
Part of subcall function 00456F77: Sleep.KERNEL32(00000000), ref: 00456F9C

Part of subcall function 004549A1: TlsGetValue.KERNEL32(00000000,00454A51,?,0045321E), ref: 004549AE
Part of subcall function 004549A1: TlsGetValue.KERNEL32(00000006,?,0045321E), ref: 004549C5

Part of subcall function 00454ABB: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00472810,0000000C,00454BCC,00000000,00000000,?,00000000,00455081,0044EB47,00000001,004548D9,?,00000000), ref: 00454ACC
Part of subcall function 00454ABB: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00454B00
Part of subcall function 00454ABB: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00454B10
Part of subcall function 00454ABB: InterlockedIncrement.KERNEL32(004763A0), ref: 00454B32
Part of subcall function 00454ABB: __lock.LIBCMT ref: 00454B3A
Part of subcall function 00454ABB: ___addlocaleref.LIBCMT ref: 00454B59

GetCurrentThreadId.KERNEL32 ref: 00454BCE
SetLastError.KERNEL32(00000000,?,00000000,00455081,0044EB47,00000001,004548D9,?,00000000,?,?,?,?,004549EB,?,0045321E), ref: 00454BE6

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 76f2c9e9e10b3fd07110aad584e70e93fe066cd141669d6c9e81ab780a7224e1
Instruction ID: f90536dda774121e1838ea8d487922f48e0d3b9865d9ec0748d05121e01be638
Opcode Fuzzy Hash: 76f2c9e9e10b3fd07110aad584e70e93fe066cd141669d6c9e81ab780a7224e1
Instruction Fuzzy Hash: ABF02D325496115BC23237B56C09B5B3A649F8077A711012FFC049D1D2DF28D9C5829D

Function 0043AC55 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0043AC65
ScreenToClient.USER32(000000FF,?), ref: 0043AC83
ScreenToClient.USER32(000000FF,?), ref: 0043ACA3
InvalidateRect.USER32(000000FF,?,?), ref: 0043ACBA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: d797fe73337c4e2eb4fb2508b6ab0c4692f88574a12d919575ba23120630ac45
Instruction ID: 5ed0657147c8b73632140d3e9f5542a85353bd31bade063e00ae9922314fe9ca
Opcode Fuzzy Hash: d797fe73337c4e2eb4fb2508b6ab0c4692f88574a12d919575ba23120630ac45
Instruction Fuzzy Hash: 3E112BB9900109EFDB41DF98D9818DEBBF8FB08200F1041A6E945E3224E771AA549F91

Function 0043B00D Relevance: 6.0, APIs: 4, Instructions: 39processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043B01B
_memset.LIBCMT ref: 0043B029
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,0048DD20,0048DD10,00443025,?,?), ref: 0043B057
CloseHandle.KERNEL32 ref: 0043B06A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: a6a737845531d6415e177d8ab5a263c556b87d5c66bacd9f875ea3db2e3258fc
Instruction ID: f05de88fa9fc8f89f99b52edb0cce847e479071ba9285b60eea432d3825957bb
Opcode Fuzzy Hash: a6a737845531d6415e177d8ab5a263c556b87d5c66bacd9f875ea3db2e3258fc
Instruction Fuzzy Hash: 4CF05EF1A01248BEE6106B666C89F3F6BECFB89799F40087AB608911E1D7655C00C77D

Function 00403679 Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(0046BF68,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00403696
GetWindowThreadProcessId.USER32(0046BF68,00000000), ref: 004036AB
GetCurrentThreadId.KERNEL32 ref: 004036B2
AttachThreadInput.USER32(00000000,?,004034E9), ref: 004036B9

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 14bced3cef2af0c18d05c0a4240383f2fb7404795cf1e6ee7dae2738d382b1a9
Instruction ID: 7a87a1a375b3f198989fef204350efb3a0edaf969496c3c1576df2c4d5fc1547
Opcode Fuzzy Hash: 14bced3cef2af0c18d05c0a4240383f2fb7404795cf1e6ee7dae2738d382b1a9
Instruction Fuzzy Hash: 56E06D30688304BAEB205F60DC0AF953B5CAB10B41F108062F605A86E0D7FAA6918B1D

Function 004445AF Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 004446D9: DeleteObject.GDI32(00000000), ref: 00444712
Part of subcall function 004446D9: ExtCreatePen.GDI32(?,00000001,00000000,00000000,00000000,?,?,00000000,?,?), ref: 0044474D
Part of subcall function 004446D9: SelectObject.GDI32(?,00000000), ref: 0044475C
Part of subcall function 004446D9: BeginPath.GDI32(?), ref: 00444773
Part of subcall function 004446D9: SelectObject.GDI32(?,00000000), ref: 00444796

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 004445CA
LineTo.GDI32(?,?,?), ref: 004445D9
EndPath.GDI32(?), ref: 004445EA
StrokePath.GDI32(?), ref: 004445F8

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
String ID:
API String ID: 2783949968-0
Opcode ID: 34bda51a6fda84f81e069ee4d95fba6d5c090bd243ab8ffb62592d88b66157db
Instruction ID: 3758118343d4750d727ef0665c3930370f84d9d42ffac5ba78f435059b60c814
Opcode Fuzzy Hash: 34bda51a6fda84f81e069ee4d95fba6d5c090bd243ab8ffb62592d88b66157db
Instruction Fuzzy Hash: 75E06D31009651BFE7129F61AC0CF0F3E65AFC7724F104A18F291500A1D7A94519EBBF

Function 0041C1FB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 0040D6DA: _wcscpy.LIBCMT ref: 0040D700

__wcsnicmp.LIBCMT ref: 0041C27F
WNetUseConnectionW.MPR(00000000,?,00000000,00000000,00000000,?,00000004,?), ref: 0041C329

Strings

LPT, xrefs: 0041C276

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ConnectionMessage__wcsnicmp_wcscpy
String ID: LPT
API String ID: 741712790-1350329615
Opcode ID: 943025b21c6f4397b1981241d76277aa5414bf04574fe122b627a9eb212d70f8
Instruction ID: 8667c697530d131c363aaadc024dfa89098963c5104d1e4848e8a36f292a9413
Opcode Fuzzy Hash: 943025b21c6f4397b1981241d76277aa5414bf04574fe122b627a9eb212d70f8
Instruction Fuzzy Hash: B2511572A48304ABD710EAA5CCC1AAF73D9EB84318F04493FF895D7281D73C9D858B5A

Function 004195B3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

AQueue: Out of bounds., xrefs: 004195E0
Fatal Error, xrefs: 004195DB

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID:
String ID: AQueue: Out of bounds.$Fatal Error
API String ID: 0-3755660557
Opcode ID: 7b9fbae8f974d508a6615eac6d78bebdc9c09c6896f2bada180f96db47bbd0f0
Instruction ID: 31452302858de2e1f40f9cc3a71bd2f619b239ab51cc958fb1c2789d6ac65b8d
Opcode Fuzzy Hash: 7b9fbae8f974d508a6615eac6d78bebdc9c09c6896f2bada180f96db47bbd0f0
Instruction Fuzzy Hash: 76318D31604200AFD724EF94C9E1EAA73A6BB46308F10041FE1566B261CB796D95DF2E

Function 00441224 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00441306
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044131E

Strings

', xrefs: 0044127A

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: a0d2f925d729f907ef45bc474485d4387b4524f69e1ab6263f791a8fca5e2ede
Instruction ID: cce89c3997a82bac678b099204088c67ca3a35aed10d1e3a3287d23153ea8b7d
Opcode Fuzzy Hash: a0d2f925d729f907ef45bc474485d4387b4524f69e1ab6263f791a8fca5e2ede
Instruction Fuzzy Hash: 1C313DB1A003099FEF10CF99D884ADEB7F5BB58300F1545AAE909EB364D374A981CB58

Function 0044015C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,00000000), ref: 004401E0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004401EB

Strings

Combobox, xrefs: 004401B3

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 48bf9e587ac2c39c261cb739e15c01063281518ce4f7939adfe67f9debe29d4b
Instruction ID: 9c155060b71f3215b163242da019c4fa4bf2b6a0451184aad5d0883039c8939f
Opcode Fuzzy Hash: 48bf9e587ac2c39c261cb739e15c01063281518ce4f7939adfe67f9debe29d4b
Instruction Fuzzy Hash: 9A115171540219AFFF228F50CC81AEB3B69FB18398F000126FA6416290C37A8D65DB99

Function 0040DF43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,C:\Users\user\Desktop\regsvr.exe,?,00412A47,0046BF68,?), ref: 0040DF75
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,C:\Users\user\Desktop\regsvr.exe,?,00412A47,0046BF68,?,C:\Users\user\Desktop\regsvr.exe), ref: 0040DFA1

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 0040DF44

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: C:\Users\user\Desktop\regsvr.exe
API String ID: 626452242-2994071119
Opcode ID: a1f105ecd290a61d96f4836c3c9fc0c68ea3bfab3549afaa23a615e40b99d456
Instruction ID: 0d8ae40ea4ab6592c4c239bd722ee984cdff41b5b99d73c06b14422670dea1d2
Opcode Fuzzy Hash: a1f105ecd290a61d96f4836c3c9fc0c68ea3bfab3549afaa23a615e40b99d456
Instruction Fuzzy Hash: 6F0126325083417E9620AA679C88C6BBFFCDACBBA8B10463FF85192180D6359C05C675

Function 00406697 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00406CB1,00000104,?,00406CB1,C:\Users\user\Desktop\regsvr.exe), ref: 004066B4
__wcsicmp.LIBCMT ref: 004066CD

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 004066A0

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: FullNamePath__wcsicmp
String ID: C:\Users\user\Desktop\regsvr.exe
API String ID: 1754126083-2994071119
Opcode ID: 6bc2b952cab003426f66052b122e33565d95482f85180817a27548c5a0f68373
Instruction ID: 9386017fc6f31d761f6bfba7f54a4404e4ec1ba09a855274c59845c6a2c5e9d7
Opcode Fuzzy Hash: 6bc2b952cab003426f66052b122e33565d95482f85180817a27548c5a0f68373
Instruction Fuzzy Hash: 15119E76804019AFDB00EF95D8818D9B7B8FF08304F01016BE906AB580DB74FAA58BD9

Function 0043FEB1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 0043FF2B
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0043FF3A

Strings

edit, xrefs: 0043FF12

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: efdaa1d49bcdd1ffca41c84ccc30374b6fa79a66c5b4ce5fded06fa1306ae62e
Instruction ID: 8bceae4a67a453d3a4a1470837663389651b214a43d7e0d54645d6ba3a2ef7ed
Opcode Fuzzy Hash: efdaa1d49bcdd1ffca41c84ccc30374b6fa79a66c5b4ce5fded06fa1306ae62e
Instruction Fuzzy Hash: D1117C35800209EFEF229F50CC05AEA3B65FB19354F105237FD54962A1C7BE88A9DF99

Function 0040200D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403615: GetClassNameW.USER32(?,?,000000FF), ref: 00403638

SendMessageW.USER32(?,000001A2,00000001,?), ref: 00402075

Strings

ComboBox, xrefs: 00402015
ListBox, xrefs: 00402041

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 1e32ba23a944a4c74cb13862e0eca1481e26d3b8811df36141399f041e507439
Instruction ID: 082e513ad840fd57b487dd6fefb5a92c6f375689f3249c3e4a927c56088628e0
Opcode Fuzzy Hash: 1e32ba23a944a4c74cb13862e0eca1481e26d3b8811df36141399f041e507439
Instruction Fuzzy Hash: F8014E306412007BDB003B269C169EEBF69DF42358B10456BFD51B72D2CB7D4D46C749

Function 00401F15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403615: GetClassNameW.USER32(?,?,000000FF), ref: 00403638

SendMessageW.USER32(?,00000180,00000000,?), ref: 00401F7D

Strings

ComboBox, xrefs: 00401F1D
ListBox, xrefs: 00401F49

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 6c5c36766434982d51c13ab68aaebe08b78210da1b5605266c4a6036b1243d63
Instruction ID: 62773ee196ef24d911481136b4e2257d4f09606f4393c0547db9bce723c0d376
Opcode Fuzzy Hash: 6c5c36766434982d51c13ab68aaebe08b78210da1b5605266c4a6036b1243d63
Instruction Fuzzy Hash: 14F0D130B411017BDB102A62AC16AEEBB6CDF42358F10406BFD01B32E2CB3D9E16969D

Function 00401F92 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403615: GetClassNameW.USER32(?,?,000000FF), ref: 00403638

SendMessageW.USER32(?,00000182,?,00000000), ref: 00401FF8

Strings

ComboBox, xrefs: 00401F9A
ListBox, xrefs: 00401FC6

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 0bf9d83c2ed57e2538216df7ef16982298e3a98edb5a05628fd7e9a2c1ca66ae
Instruction ID: 37a606164421c250c264fa9ac2c6fe4bae94559fd78a80be4199356ec28cee51
Opcode Fuzzy Hash: 0bf9d83c2ed57e2538216df7ef16982298e3a98edb5a05628fd7e9a2c1ca66ae
Instruction Fuzzy Hash: 48F0F430A411017ADB0026229C06BEEBF6CDF02358F104427F901B32E2DB7D9D16965D

Function 0042DC99 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,AStack: top(): Out of bounds.,Fatal Error,00000010), ref: 0042DCB1

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

AStack: top(): Out of bounds., xrefs: 0042DCA9
Fatal Error, xrefs: 0042DCA4

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: AStack: top(): Out of bounds.$Fatal Error
API String ID: 1566194552-807804664
Opcode ID: 112dfac08ce511ab15f37b6f14f0784d4a1e30fe69f5be75550ab7f24c86e631
Instruction ID: 8f46c36b54fa985028e42da948dda6bdf386e3d3f9aeab837cb5edead3e4afc4
Opcode Fuzzy Hash: 112dfac08ce511ab15f37b6f14f0784d4a1e30fe69f5be75550ab7f24c86e631
Instruction Fuzzy Hash: A8F09AB1B44220AFD3549F1BA800E12BBA4EF89B10B1640DBE102CB1B2D3F48482CB98

Function 00422413 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004278F3: LoadLibraryA.KERNEL32(Wininet.dll,0042243C,0048BD28,C:\Users\user\Desktop\regsvr.exe,00000000), ref: 004278FE
Part of subcall function 004278F3: GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 00427910

Sleep.KERNEL32(0000000A), ref: 00422447
FreeLibrary.KERNEL32(00000000), ref: 0042245F

Strings

C:\Users\user\Desktop\regsvr.exe, xrefs: 0042242B

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Library$AddressFreeLoadProcSleep
String ID: C:\Users\user\Desktop\regsvr.exe
API String ID: 938261879-2994071119
Opcode ID: c972a11a0518f64ede0ca227bc108b98dd2626021e8007c77fa4f101f0fd5fc5
Instruction ID: 5bbf96498581ada9825b25a95f9942dd18efb57540f7c2ac3a6986345d88b901
Opcode Fuzzy Hash: c972a11a0518f64ede0ca227bc108b98dd2626021e8007c77fa4f101f0fd5fc5
Instruction Fuzzy Hash: E7F0E931E00219BFDF156BA0F8087E9B7B4BB0531DF404191E420A109183FC1B88DF87

Function 0042EC0A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0042EC16

Strings

3, 2, 10, 0, xrefs: 0042EC10
., xrefs: 0042EC46

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: _wcscpy
String ID: .$3, 2, 10, 0
API String ID: 3048848545-502951267
Opcode ID: 9936b947a28a14f0059a2c4fe20ed655449cce3aa3cc3419f9ee7212f98e10b1
Instruction ID: 12577fe4d17f71e05d665a75b856234b759e9e4a80a78019ec3df315f3f0daf2
Opcode Fuzzy Hash: 9936b947a28a14f0059a2c4fe20ed655449cce3aa3cc3419f9ee7212f98e10b1
Instruction Fuzzy Hash: 80F096F295412896EB60ABF3E888BD922689B40304F90407FDD8D93052DB7C898987AD

Function 004355BA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 004355CA

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

AVector: []: Out of bounds., xrefs: 004355C2
Fatal Error, xrefs: 004355BD

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: AVector: []: Out of bounds.$Fatal Error
API String ID: 1566194552-1727892082
Opcode ID: 79aca7342f3d133859bad9c8f31f64123d1fbc8bdf191b58cf552273821d522f
Instruction ID: 1def06a373dfeeca12979ddebabbf19776c06a63c7d669952d0f83b3389c869a
Opcode Fuzzy Hash: 79aca7342f3d133859bad9c8f31f64123d1fbc8bdf191b58cf552273821d522f
Instruction Fuzzy Hash: 64F074B1A652309FD6549F59A905A427FA8EB0CF6071681DBF508CB2B2D3F4C540CFD9

Function 0040EBA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,ExpressionStack: topnext(): Out of bounds.,Fatal Error,00000010), ref: 0040EBB6

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

ExpressionStack: topnext(): Out of bounds., xrefs: 0040EBAF
Fatal Error, xrefs: 0040EBAA

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: ExpressionStack: topnext(): Out of bounds.$Fatal Error
API String ID: 1566194552-576543216
Opcode ID: cd28ebb46fa2cd2b70bfcfdd34091d1433204def7822cbc6bf433e2b603cec38
Instruction ID: f15db652e2225a880293a33d4a06a8872c4c9b22a8427d7f750f35afd3ae1a3b
Opcode Fuzzy Hash: cd28ebb46fa2cd2b70bfcfdd34091d1433204def7822cbc6bf433e2b603cec38
Instruction Fuzzy Hash: E9F01C70248200AFEF14CB11C85AF2277E1AF14716F1988E6E1469F6E2E7B8E840CB08

Function 0040EB54 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,ExpressionStack: top(): Out of bounds.,Fatal Error,00000010), ref: 0040EB6A

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

ExpressionStack: top(): Out of bounds., xrefs: 0040EB63
Fatal Error, xrefs: 0040EB5E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: ExpressionStack: top(): Out of bounds.$Fatal Error
API String ID: 1566194552-3530518669
Opcode ID: 30d159229255455a692d9c080a65e3267e4635338d57db6af387dcef0b199423
Instruction ID: bf36d1335f76fc3780bd81d2a71791540fb1b87bac62fe6916850275b60fa39e
Opcode Fuzzy Hash: 30d159229255455a692d9c080a65e3267e4635338d57db6af387dcef0b199423
Instruction Fuzzy Hash: C4F030702042046FEF04CB11C959F6177E1AB00726F1988E6E5469F1E2D7F8E840CB09

Function 0040E27C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,AStack: top(): Out of bounds.,Fatal Error,00000010), ref: 0040E28F

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

AStack: top(): Out of bounds., xrefs: 0040E288
Fatal Error, xrefs: 0040E283

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: AStack: top(): Out of bounds.$Fatal Error
API String ID: 1566194552-807804664
Opcode ID: cb5cc5adc687c0cf4c5769d267381c0dca7a86e4d8f6a726063a0638e60e0f00
Instruction ID: 7c805db96070ec24acc295fa498f3c7831d804f25fddef3c29a7a91fbe1324f0
Opcode Fuzzy Hash: cb5cc5adc687c0cf4c5769d267381c0dca7a86e4d8f6a726063a0638e60e0f00
Instruction Fuzzy Hash: 8DE08C703842006FFB04A762CD0AB123BD4AB05706F0984EAF209AE1E2E7FCD810DA1D

Function 00405AA7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

AVector: []: Out of bounds., xrefs: 00405AB3
Fatal Error, xrefs: 00405AAE

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: AVector: []: Out of bounds.$Fatal Error
API String ID: 1566194552-1727892082
Opcode ID: cf4b73d056ed4ac200e0d4d02a1ed789f256c7dd48da4f701c139408e79d2593
Instruction ID: 9be9e6c4b0dd68ecdc0de2fa95b8379ea32650773cf42c8335e76bba7f595ae2
Opcode Fuzzy Hash: cf4b73d056ed4ac200e0d4d02a1ed789f256c7dd48da4f701c139408e79d2593
Instruction Fuzzy Hash: 26E04F70344204AFEB04DB21CC46B123390EB0071AF6985D9E509DA5E2D7FA9841DE59

Function 0041A21D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 0041A230

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

AVector: []: Out of bounds., xrefs: 0041A229
Fatal Error, xrefs: 0041A224

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: AVector: []: Out of bounds.$Fatal Error
API String ID: 1566194552-1727892082
Opcode ID: c4c3bf66395a0f333f3a71cf1f43215ea06ea6c1263c87fb6ccd6da15509056c
Instruction ID: 8a47efb699ee55220b8c5a985843356ec17489106a0e7530593c48f8e3f43de0
Opcode Fuzzy Hash: c4c3bf66395a0f333f3a71cf1f43215ea06ea6c1263c87fb6ccd6da15509056c
Instruction Fuzzy Hash: 80E086302442006FEE14DB21CC46B513790BB00725F6882D9E509DA1E2D7BA9491DE09

Function 0043A453 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0043A46A
PostMessageW.USER32(00000000), ref: 0043A471

Part of subcall function 0040D649: Sleep.KERNEL32(000000FA,0048BA08,0048BA08,00000001,00000000,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe), ref: 0040D6CF

Strings

Shell_TrayWnd, xrefs: 0043A463

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 749246beacb5a8c5c301b55e4101993041db8e08e3df96aed0048648b3e80e9f
Instruction ID: 48fb15618dc0ba4576a11cf80406edc10fd560e4b88deb97e0e1af43a8436fe8
Opcode Fuzzy Hash: 749246beacb5a8c5c301b55e4101993041db8e08e3df96aed0048648b3e80e9f
Instruction Fuzzy Hash: 5DD0C7327883107AE3306771BC0FF876F549785B24F51492BB649FA1D0D5F574058A5D

Function 0043A41D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0043A434
PostMessageW.USER32(00000000), ref: 0043A43B

Part of subcall function 0040D649: Sleep.KERNEL32(000000FA,0048BA08,0048BA08,00000001,00000000,?,?,00418DD9,00000104,C:\Users\user\Desktop\regsvr.exe,C:\Users\user\Desktop\regsvr.exe), ref: 0040D6CF

Strings

Shell_TrayWnd, xrefs: 0043A42D

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 1c0342ed96611791d8fe8dfe6e25ace9b0089e4835a6732b96a504d3157d86ca
Instruction ID: 3bf58ce236cca17576f640e849b018dfa1374f4d60a94a1dc5dfdd6b74bee6fa
Opcode Fuzzy Hash: 1c0342ed96611791d8fe8dfe6e25ace9b0089e4835a6732b96a504d3157d86ca
Instruction Fuzzy Hash: B1D0A7327883003AE3302771BC0FF876F149785B20F10492BB649BA0C0D5F464018A59

Function 0042DC0D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,AVector: back(): Out of bounds.,Fatal Error,00000010), ref: 0042DC1B

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

AVector: back(): Out of bounds., xrefs: 0042DC14
Fatal Error, xrefs: 0042DC0F

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: AVector: back(): Out of bounds.$Fatal Error
API String ID: 1566194552-3587719520
Opcode ID: 8a0f79b2a42af4f99ca72a2b768e2454e16de3eb9af4235599c58767b5cba9c6
Instruction ID: ca5af5f184b4b2cd7ac8e361517251aa5293cd53dae6816757278c8a4ff66cb2
Opcode Fuzzy Hash: 8a0f79b2a42af4f99ca72a2b768e2454e16de3eb9af4235599c58767b5cba9c6
Instruction Fuzzy Hash: E1D0A7713543006FF7802B61CC0AF427690AB04B2BF55C496F209890F2D7FC4880DE09

Function 0042DD54 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,AStack: top(): Out of bounds.,Fatal Error,00000010), ref: 0042DD67

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

AStack: top(): Out of bounds., xrefs: 0042DD60
Fatal Error, xrefs: 0042DD5B

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: AStack: top(): Out of bounds.$Fatal Error
API String ID: 1566194552-807804664
Opcode ID: 6478511c035588b9fc1475754a647044a89ab5dd99d75c660199ee88fffc1370
Instruction ID: 048a037f31bc114b1f104447ea4b43be77bb0b56ba3431b4f9bb2503e5b5d6f6
Opcode Fuzzy Hash: 6478511c035588b9fc1475754a647044a89ab5dd99d75c660199ee88fffc1370
Instruction Fuzzy Hash: 3BD05EB07846407FEB04A7219D0AF013F916B05705F19C0C6F24A9E0E2E7E8A8408B5D

Function 004525D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00454B7A: GetLastError.KERNEL32(?,00000000,00455081,0044EB47,00000001,004548D9,?,00000000,?,?,?,?,004549EB,?,0045321E), ref: 00454B7C
Part of subcall function 00454B7A: __calloc_crt.LIBCMT ref: 00454B9E
Part of subcall function 00454B7A: GetCurrentThreadId.KERNEL32 ref: 00454BCE
Part of subcall function 00454B7A: SetLastError.KERNEL32(00000000,?,00000000,00455081,0044EB47,00000001,004548D9,?,00000000,?,?,?,?,004549EB,?,0045321E), ref: 00454BE6

__freeptd.LIBCMT ref: 004525FB

Part of subcall function 00454D2A: TlsGetValue.KERNEL32(00000000,?,004531CE,00000000), ref: 00454D49
Part of subcall function 00454D2A: TlsGetValue.KERNEL32(?,004531CE,00000000), ref: 00454D5B
Part of subcall function 00454D2A: __freefls@4.LIBCMT ref: 00454D79
Part of subcall function 00454D2A: TlsSetValue.KERNEL32(00000017,00000000,004531CE,00000000), ref: 00454D8C

RtlExitUserThread.NTDLL(?), ref: 00452605

Strings

PYE, xrefs: 004525D4, 004525EB

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Value$ErrorLastThread$CurrentExitUser__calloc_crt__freefls@4__freeptd
String ID: PYE
API String ID: 702801150-4264731808
Opcode ID: e0895a322ad5112cd0a9cd7ff21f55b5f86948114a42f3f92697bc67b668b196
Instruction ID: 1ebd5f279c9765c2aabde2c06cce9c6f6d12981ffae7ec9c05643d697544348c
Opcode Fuzzy Hash: e0895a322ad5112cd0a9cd7ff21f55b5f86948114a42f3f92697bc67b668b196
Instruction Fuzzy Hash: 63D0127041D2845EDB126B709D9910D3F38AD4221DB1408ABE885C8063EBAD8C58D75A

Function 00401D3C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00401D4A

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

AVector: []: Out of bounds., xrefs: 00401D43
Fatal Error, xrefs: 00401D3E

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: AVector: []: Out of bounds.$Fatal Error
API String ID: 1566194552-1727892082
Opcode ID: 5d55dbec4248a7d93650ea0504143ce4b8e184e246d413738a50bb1a2f2ec49a
Instruction ID: 9cb18a6e4975aade5f716731f5f5dc766da51984c7689f4ee0b27d4d4a33823c
Opcode Fuzzy Hash: 5d55dbec4248a7d93650ea0504143ce4b8e184e246d413738a50bb1a2f2ec49a
Instruction Fuzzy Hash: 26C012203CC200BAFA5822B21C03B2611409B08B06F2009BBFA07E84E1FBE89040195E

Function 00407480 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 0040748E

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

AVector: []: Out of bounds., xrefs: 00407487
Fatal Error, xrefs: 00407482

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: AVector: []: Out of bounds.$Fatal Error
API String ID: 1566194552-1727892082
Opcode ID: c87722ba72bdb56b61a83ae86292a05d8f06d142c7027ee5047f2329f405efae
Instruction ID: e16e7b034e27123991999e027b16225be71e0695c72ddd45102c60239b516ce7
Opcode Fuzzy Hash: c87722ba72bdb56b61a83ae86292a05d8f06d142c7027ee5047f2329f405efae
Instruction Fuzzy Hash: F2B092B13C83407AF84823A22C07F0515009708F06F204197F747E84E22BD810905D9F

Function 00441FB5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,AQueue: Out of bounds.,Fatal Error,00000010), ref: 00441FC3

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

Strings

AQueue: Out of bounds., xrefs: 00441FBC
Fatal Error, xrefs: 00441FB7

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: Message_malloc
String ID: AQueue: Out of bounds.$Fatal Error
API String ID: 1566194552-3755660557
Opcode ID: 20cc1d628e019335fcc729881ed71db304ab6cc554e5a748984584389abab565
Instruction ID: 2f39cb63c6df9d17e9d0a8e4c0235f2bff0937ecf820d1867478f07b68a750a8
Opcode Fuzzy Hash: 20cc1d628e019335fcc729881ed71db304ab6cc554e5a748984584389abab565
Instruction Fuzzy Hash: C7B092B13C83413AF44423A12D07F0515005708F0AF204047F3A7A84E22FD810905D5F

Function 0040F437 Relevance: 5.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 0040F45B
CloseHandle.KERNEL32(?), ref: 0040F469
CloseHandle.KERNEL32(?), ref: 0040F477
CloseHandle.KERNEL32(?), ref: 0040F489

Memory Dump Source

Source File: 00000000.00000002.4594440767.0000000000401000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594419976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.0000000000476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594440767.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4594551723.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_regsvr.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 88269e377f4778dc7346e6cafbf600b6a89ad6f317a505b67e4d9d58882e8fad
Instruction ID: 91a0d2b3c63a57faf83c8bb310241df96875585c511dd917fba52827537c91db
Opcode Fuzzy Hash: 88269e377f4778dc7346e6cafbf600b6a89ad6f317a505b67e4d9d58882e8fad
Instruction Fuzzy Hash: 1EF08631100B019BC7319B5ACC81A57B3E49F68374B10463DD885A2AB0C379FC49CE04

Analysis Process: regsvr.exePID: 3168, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	49

Executed Functions

Function 004060C8 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 165
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0044E9ED: _malloc.LIBCMT ref: 0044EA05

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00406166
_wcsncat.LIBCMT ref: 00406195
__makepath.LIBCMT ref: 004061B1

Part of subcall function 0045156F: __wmakepath_s.LIBCMT ref: 00451583

Part of subcall function 0044E9ED: std::exception::exception.LIBCMT ref: 0044EA3C
Part of subcall function 0044E9ED: __CxxThrowException@8.LIBCMT ref: 0044EA51

_wcscpy.LIBCMT ref: 004061EC
RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00406208
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?), ref: 00406232
_wcscat.LIBCMT ref: 0040628C
_wcscat.LIBCMT ref: 004062CD
_wcsncpy.LIBCMT ref: 00406306
RegCloseKey.ADVAPI32(?), ref: 00406329

Strings

Include, xrefs: 0040618F, 00406223
Software\AutoIt v3\AutoIt, xrefs: 004061FE
<v@, xrefs: 00406109, 00406125
\, xrefs: 004062B5

Memory Dump Source

Source File: 00000009.00000002.4593984874.0000000000401000.00000004.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.4593911440.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.0000000000476000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.00000000004A2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4594417156.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_regsvr.jbxd

Similarity

API ID: _wcscat$CloseException@8FileModuleNameOpenQueryThrowValue__makepath__wmakepath_s_malloc_wcscpy_wcsncat_wcsncpystd::exception::exception
String ID: <v@$Include$Software\AutoIt v3\AutoIt$\
API String ID: 3663597669-4126755141
Opcode ID: 5bf4ab24d776dbe09a2511fb973cb2f09b7e361b1c47bcd7bff25fbae2677942
Instruction ID: 7a0ec9e26652ebfc38452f8fd7d191dc43944444fa956801943b60db48f99f1d
Opcode Fuzzy Hash: 5bf4ab24d776dbe09a2511fb973cb2f09b7e361b1c47bcd7bff25fbae2677942
Instruction Fuzzy Hash: 846149B1D41208ABDB10EF99EC8599E77F8FB48304B5044BFE919E3291E7349A44CF58

Function 0040108C Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 004010AD

Part of subcall function 004013FE: GetModuleFileNameW.KERNEL32(00000000,C:\Windows\regsvr.exe,00000104,?,00000104), ref: 0040143E
Part of subcall function 004013FE: __wcsicmp.LIBCMT ref: 00401546

Part of subcall function 0040E2B5: GetModuleHandleA.KERNEL32(kernel32.dll,004010C0,?), ref: 0040E2BA
Part of subcall function 0040E2B5: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0040E2CA

MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,0046BD8E,00000010), ref: 004010D2
SetCurrentDirectoryW.KERNEL32(?,C:\Windows\regsvr.exe), ref: 0040117A

Strings

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support., xrefs: 004010CB
C:\Windows\regsvr.exe, xrefs: 004010E4, 00401152, 0040115F, 004011D7, 00401287
runas, xrefs: 004011FA, 0040122D

Memory Dump Source

Source File: 00000009.00000002.4593984874.0000000000401000.00000004.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.4593911440.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.0000000000476000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.00000000004A2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4594417156.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_regsvr.jbxd

Similarity

API ID: CurrentDirectoryModule$AddressFileHandleMessageNameProc__wcsicmp
String ID: C:\Windows\regsvr.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
API String ID: 100587416-296733443
Opcode ID: bd84402bb592f3a432bd1753500ff229df93fbfa6d6369dd2acfe7eddafc8f2d
Instruction ID: a517a9db5f85c4c96bb8fc9c2871e4bd747f39243f1e7ce5074cf97865ffdd83
Opcode Fuzzy Hash: bd84402bb592f3a432bd1753500ff229df93fbfa6d6369dd2acfe7eddafc8f2d
Instruction Fuzzy Hash: 83510471904254AAEB10BBA59C05FAE7B78EB45308F0404BFF501B61E2D7BC89858B6E

Function 004130CE Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 004130E7
__fread_nolock.LIBCMT ref: 00413125
__fread_nolock.LIBCMT ref: 00413142
_wcscpy.LIBCMT ref: 00413175
__fread_nolock.LIBCMT ref: 00413184
__fread_nolock.LIBCMT ref: 004131A1
_wcscpy.LIBCMT ref: 004131D0
_fseek.LIBCMT ref: 004131F2
__fread_nolock.LIBCMT ref: 00413203
_fseek.LIBCMT ref: 00413219

Part of subcall function 00451D73: __fseek_nolock.LIBCMT ref: 00451DCE

Strings

FILE, xrefs: 00413102
C:\Windows\regsvr.exe, xrefs: 004130D7, 00413138, 00413151, 00413197, 004131B0

Memory Dump Source

Source File: 00000009.00000002.4593984874.0000000000401000.00000004.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.4593911440.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.0000000000476000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.00000000004A2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4594417156.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_regsvr.jbxd

Similarity

API ID: __fread_nolock$_fseek_wcscpy$__fseek_nolock
String ID: C:\Windows\regsvr.exe$FILE
API String ID: 1218644068-2691689167
Opcode ID: 719be1a034cf794bb3122aadce67e97502735f283ec2ee710fd14ffaf499a311
Instruction ID: 16955c187f1d51c9af23cef21f966cda246683522ea37d69e2bde0f0683897d4
Opcode Fuzzy Hash: 719be1a034cf794bb3122aadce67e97502735f283ec2ee710fd14ffaf499a311
Instruction Fuzzy Hash: 9A4186B2D40208BAEF21EBE1DC45FDE777DAF44304F1004ABBA44B2091E6B997988775

Function 004012BA Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 004012C5
LoadCursorW.USER32(00000000,00007F00), ref: 004012D5
LoadIconW.USER32(000000A1), ref: 004012EF
LoadIconW.USER32(000000A4), ref: 00401301
RegisterClassExW.USER32(?), ref: 00401371

Strings

#, xrefs: 0040134D
0, xrefs: 00401346
AutoIt v3, xrefs: 00401360
C:\Windows\regsvr.exe, xrefs: 004012C0, 004012C1

Memory Dump Source

Source File: 00000009.00000002.4593984874.0000000000401000.00000004.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.4593911440.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.0000000000476000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.00000000004A2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4594417156.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_regsvr.jbxd

Similarity

API ID: Load$Icon$BrushClassColorCursorRegister
String ID: #$0$AutoIt v3$C:\Windows\regsvr.exe
API String ID: 1664269819-3841162646
Opcode ID: 79ae604c2ece932835a0c4772eb2b5c11f83d1a8ec0ef193ecd32122831a9563
Instruction ID: a4ae1f2f7a30b14d8864461e08ebee6a3adfffe902ce092d78f3296afce67af2
Opcode Fuzzy Hash: 79ae604c2ece932835a0c4772eb2b5c11f83d1a8ec0ef193ecd32122831a9563
Instruction Fuzzy Hash: 9F2136B1D04308AFDB009FA9EC88A9DBFB4FB88394F54053EE515A36A0D7B40944CF99

Function 004342B8 Relevance: 15.3, APIs: 10, Instructions: 298registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 00433F9A: CharUpperBuffW.USER32(?,?,?,?,00000000), ref: 00433FAD

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00434373
RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,HKCR\), ref: 004343A2
RegCloseKey.ADVAPI32(?), ref: 004343B6
RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000), ref: 004343E7
RegQueryValueExW.ADVAPI32(?,00000000), ref: 0043446B
RegCloseKey.KERNELBASE(?,00000000), ref: 0043460E
RegCloseKey.ADVAPI32(?), ref: 0043461A

Memory Dump Source

Source File: 00000009.00000002.4593984874.0000000000401000.00000004.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.4593911440.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.0000000000476000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.00000000004A2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4594417156.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_regsvr.jbxd

Similarity

API ID: Close$QueryValue$BuffCharConnectMessageOpenRegistryUpper
String ID:
API String ID: 4045058077-0
Opcode ID: 0d2fe836b71679359a26bf2ad7204aac9896725846f5c17a646dd5b41d0db2ee
Instruction ID: f6a981f66e00b1d264ff148d2bdbeb4e7af21c5c7377ee539f2df3d1dd7ffcb6
Opcode Fuzzy Hash: 0d2fe836b71679359a26bf2ad7204aac9896725846f5c17a646dd5b41d0db2ee
Instruction Fuzzy Hash: C7A19D72508205AFC710EF65C8819AFB3ECEF88318F00492EF995D7191DB38ED458B6A

Function 00452132 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00452192
_memcpy_s.LIBCMT ref: 00452205
__filbuf.LIBCMT ref: 00452290
_memset.LIBCMT ref: 004522D6
_memset.LIBCMT ref: 00452301

Memory Dump Source

Source File: 00000009.00000002.4593984874.0000000000401000.00000004.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.4593911440.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.0000000000476000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.00000000004A2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4594417156.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_regsvr.jbxd

Similarity

API ID: _memset$__filbuf_memcpy_s
String ID:
API String ID: 2885843685-0
Opcode ID: 6d6925a77775332182466e43a48f3aa918a8684e8f45aebb4570ceddabfd8d45
Instruction ID: 8d222a48d55b4acc09949d8f2fd565fbcdcb2311850145653533022fb81319fc
Opcode Fuzzy Hash: 6d6925a77775332182466e43a48f3aa918a8684e8f45aebb4570ceddabfd8d45
Instruction Fuzzy Hash: 32513B35900605EBCB208F698E4499F77B4FF42322F14825BFC25922D3D7B89E49CB59

Function 00452044 Relevance: 4.5, APIs: 3, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__flush.LIBCMT ref: 00452077
__freebuf.LIBCMT ref: 0045207F
__close.LIBCMT ref: 0045208B

Memory Dump Source

Source File: 00000009.00000002.4593984874.0000000000401000.00000004.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.4593911440.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.0000000000476000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.00000000004A2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4594417156.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_regsvr.jbxd

Similarity

API ID: __close__flush__freebuf
String ID:
API String ID: 3722736141-0
Opcode ID: 67a782b1f4283915900da6078be2fd31c3b5e47ca8a9d68ce3e979e1bd770940
Instruction ID: 9d03d284387e27f83df6200fdd7217aede530b946880ce88e7cf6cdacfabfba9
Opcode Fuzzy Hash: 67a782b1f4283915900da6078be2fd31c3b5e47ca8a9d68ce3e979e1bd770940
Instruction Fuzzy Hash: B0F0C862901B005E86307A7B4D4185BB3DC5E8773AB144B1FFE65D21D3E6AC980E866A

Function 0041A2F7 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00405AA7: MessageBoxA.USER32(00000000,AVector: []: Out of bounds.,Fatal Error,00000010), ref: 00405ABA

Part of subcall function 0040C4DB: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Windows\regsvr.exe,00000104,0048D8B0,C:\Windows\regsvr.exe,?,?,00406C7E,C:\Windows\regsvr.exe,00000104), ref: 0040C4F9

GetPrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?,0000FFFF,?), ref: 0041A36F

Memory Dump Source

Source File: 00000009.00000002.4593984874.0000000000401000.00000004.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.4593911440.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.0000000000476000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.000000000048F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4593984874.00000000004A2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.4594417156.00000000004A5000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_regsvr.jbxd

Similarity

API ID: FullMessageNamePathPrivateProfileString
String ID:
API String ID: 2293904819-0
Opcode ID: 7ac7ce0f5b8ca6039468c3ba847e0187ea7638d5644e6a267e4d956b3743f0b8
Instruction ID: afdfd4a222a38ee004319feb394522888084550f90ab02918900143d29eaee06
Opcode Fuzzy Hash: 7ac7ce0f5b8ca6039468c3ba847e0187ea7638d5644e6a267e4d956b3743f0b8
Instruction Fuzzy Hash: 4D01B1B26002186ADB21B7754C8A9AF239EDB84329B14457BF805F7582DA3CED498A54

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report regsvr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut3295.tmp

C:\Users\user\AppData\Local\Temp\autA573.tmp

C:\Users\user\AppData\Roaming\regsvr.exe

C:\Users\user\AppData\Roaming\regsvr.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\setup.ini

C:\Windows\SysWOW64\regsvr.exe

C:\Windows\SysWOW64\regsvr.exe:Zone.Identifier

C:\Windows\SysWOW64\setting.ini

C:\Windows\SysWOW64\setup.ini

C:\Windows\SysWOW64\svchost .exe

C:\Windows\SysWOW64\svchost .exe:Zone.Identifier

C:\Windows\regsvr.exe

C:\Windows\regsvr.exe:Zone.Identifier

Static File Info

General

Windows Analysis Report
regsvr.exe

Function 00422477 Relevance: 37.1, APIs: 19, Strings: 2, Instructions: 304
COMMON

Function 0040C78E Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 178
filestringCOMMON

Function 0040108C Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 151
windowCOMMON

Function 0041DE3C Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 121
fileCOMMON

Function 004053EF Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 215
libraryloaderCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre