Analysis Report DOC000YUT600.scr

Overview

General Information

Joe Sandbox Version:	23.0.0
Analysis ID:	648369
Start date:	29.08.2018
Start time:	09:58:45
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 11m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DOC000YUT600.scr (renamed file extension from scr to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@10/5@0/1
EGA Information:	Successful, ratio: 33.3%
HDC Information:	Successful, ratio: 99.9% (good quality ratio 90.9%) Quality average: 76.9% Quality standard deviation: 31.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe Execution Graph export aborted for target DOC000YUT600.exe, PID 3420 because it is empty Execution Graph export aborted for target Regdriver.exe, PID 3484 because it is empty Execution Graph export aborted for target regdrv.exe, PID 3452 because it is empty Execution Graph export aborted for target regdrv.exe, PID 3532 because it is empty Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Contains functionality to modify the execution of threads in other processes

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\Videos\Regdriver.exe	Avira: Label: HEUR/AGEN.1032427
Source: C:\Users\user\Music\regdrv.exe	Avira: Label: HEUR/AGEN.1032427

Antivirus detection for submitted file

Show sources

Source: DOC000YUT60.exe

Avira: Label: HEUR/AGEN.1032427

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\Music\regdrv.exe	virustotal: Detection: 60%			Perma Link
Source: C:\Users\user\Videos\Regdriver.exe	virustotal: Detection: 60%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: DOC000YUT60.exe

virustotal: Detection: 60%

Perma Link

Antivirus detection for unpacked file

Show sources

Source: 5.2.regdrv.exe.2580000.3.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 6.0.regdrv.exe.400000.4.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 6.2.regdrv.exe.400000.3.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 3.0.regdrv.exe.400000.4.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 2.2.regdrv.exe.25d0000.3.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 6.1.regdrv.exe.400000.0.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 6.0.regdrv.exe.400000.5.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 3.2.regdrv.exe.400000.3.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 3.0.regdrv.exe.400000.5.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 3.1.regdrv.exe.400000.0.unpack	Avira: Label: BDS/DarkKomet.GS

Yara signature match

Show sources

Source: 00000006.00000000.479399059.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000006.00000001.481410763.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000006.00000001.481410763.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000006.00000000.479399059.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000002.00000003.450764221.7F370000.00000004.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000005.00000002.491857687.02580000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000005.00000002.491857687.02580000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000002.00000002.462554403.025D0000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000002.00000002.462554403.025D0000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000003.00000001.447610474.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000003.00000001.447610474.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000003.00000002.699224479.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000003.00000002.699224479.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000006.00000000.479959577.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000006.00000000.479959577.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000006.00000002.482534154.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000006.00000002.482534154.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000003.00000000.446776706.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000003.00000000.446776706.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000005.00000003.485657484.7F370000.00000004.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000003.00000000.446217367.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000003.00000000.446217367.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.1.regdrv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.1.regdrv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 5.2.regdrv.exe.2580000.3.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 5.2.regdrv.exe.2580000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.2.regdrv.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.2.regdrv.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.0.regdrv.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.0.regdrv.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 2.2.regdrv.exe.25d0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 2.2.regdrv.exe.25d0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 5.2.regdrv.exe.2580000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 5.2.regdrv.exe.2580000.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 2.2.regdrv.exe.25d0000.3.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 2.2.regdrv.exe.25d0000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.0.regdrv.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.0.regdrv.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.1.regdrv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.1.regdrv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.2.regdrv.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.2.regdrv.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.0.regdrv.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.0.regdrv.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.2.regdrv.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.2.regdrv.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.0.regdrv.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.0.regdrv.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.2.regdrv.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.2.regdrv.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.0.regdrv.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.0.regdrv.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.0.regdrv.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.0.regdrv.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.0.regdrv.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.0.regdrv.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.0.regdrv.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.0.regdrv.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.1.regdrv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.1.regdrv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.1.regdrv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.1.regdrv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00342EA8 FindFirstFileA,GetLastError,	1_3_00342EA8
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0040A488 FindFirstFileA,GetLastError,	3_2_0040A488
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00406A68 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	3_2_00406A68
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00480FEC FindFirstFileA,	3_2_00480FEC
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002A66A8 FindFirstFileA,GetLastError,	4_3_002A66A8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0040A488 FindFirstFileA,GetLastError,	6_2_0040A488
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00406A68 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	6_2_00406A68
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00480FEC FindFirstFileA,	6_2_00480FEC

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.1.82:49188 -> 95.140.125.42:1908

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42

Contains functionality to upload files via FTP

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00473560 FtpPutFileA,		3_2_00473560
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00473560 FtpPutFileA,		6_2_00473560

Internet Provider seen in connection with other malware

Show sources

Source: Joe Sandbox View

ASN Name: ORIONTELEKOM-ASRS ORIONTELEKOM-ASRS

Contains functionality to download additional files from the internet

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004865E0 Sleep,TranslateMessage,DispatchMessageA,PeekMessageA,socket,ntohs,inet_addr,gethostbyname,connect,recv,shutdown,closesocket,

3_2_004865E0

Urls found in memory or binary data

Show sources

Source: regdrv.exe, 00000002.00000002.451751956.013B0000.00000004.sdmp

String found in binary or memory: http://SAC.home-page.org

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to capture and log keystrokes

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: [ESC]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [F1]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [F2]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DEL]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DEL]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [INS]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [SNAPSHOT]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [LEFT]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [RIGHT]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DOWN]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [UP]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [ESC]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [F1]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [F2]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DEL]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DEL]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [INS]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [SNAPSHOT]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [LEFT]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [RIGHT]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DOWN]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [UP]	6_2_004818F8

Contains functionality to log keystrokes

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004818F8 CallNextHookEx,CallNextHookEx,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyA,ToAscii,CallNextHookEx,

3_2_004818F8

Contains functionality to log keystrokes

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004818F8 CallNextHookEx,CallNextHookEx,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyA,ToAscii,CallNextHookEx,		3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004818F8 CallNextHookEx,CallNextHookEx,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyA,ToAscii,CallNextHookEx,		6_2_004818F8

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00481ED8 SetWindowsHookExA 0000000D,004818F8,00000000,00000000

3_2_00481ED8

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Music\regdrv.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Music\regdrv.exe

Jump to behavior

Contains functionality for read data from the clipboard

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0040838E OpenClipboard,

3_2_0040838E

Contains functionality to read the clipboard data

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00428418 GetClipboardData,CopyEnhMetaFileA,GetEnhMetaFileHeader,

3_2_00428418

Contains functionality to record screenshots

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00428B08 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

3_2_00428B08

Contains functionality to retrieve information about pressed keystrokes

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004818F8 CallNextHookEx,CallNextHookEx,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyA,ToAscii,CallNextHookEx,

3_2_004818F8

Spam, unwanted Advertisements and Ransom Demands:

Contains functionalty to change the wallpaper

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048BB34 SystemParametersInfoA,		6_2_0048BB34
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00489E9C SystemParametersInfoA,		6_2_00489E9C

System Summary:

PE file contains more sections than normal

Show sources

Source: Regdriver.exe.1.dr	Static PE information: Number of sections : 11 > 10
Source: DOC000YUT60.exe	Static PE information: Number of sections : 11 > 10
Source: regdrv.exe.1.dr	Static PE information: Number of sections : 11 > 10

PE file has a writeable .text section

Show sources

Source: DOC000YUT60.exe	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Source: regdrv.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Source: Regdriver.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Contains functionality to call native functions

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004865E0 Sleep,TranslateMessage,DispatchMessageA,PeekMessageA,socket,ntohs,inet_addr,gethostbyname,connect,recv,shutdown,closesocket,	3_2_004865E0
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004801FC socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,recv,send,recv,recv,recv,shutdown,closesocket,	3_2_004801FC
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004821A0 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,sendto,Sleep,closesocket,ExitThread,	3_2_004821A0
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048851C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,mouse_event,shutdown,closesocket,	3_2_0048851C
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00460628 inet_addr,ntohs,	3_2_00460628
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00482630 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,connect,ExitThread,recv,Sleep,closesocket,ExitThread,	3_2_00482630
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004607A4 getservbyname,ntohs,	3_2_004607A4
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00480880 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,shutdown,closesocket,shutdown,closesocket,	3_2_00480880
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00486918 recv,recv,send,send,recv,send,send,send,send,send,recv,recv,recv,gethostbyname,ntohs,socket,connect,getsockname,send,select,recv,send,recv,send,Sleep,closesocket,closesocket,	3_2_00486918
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048298C socket,ExitThread,ntohs,inet_addr,gethostbyname,ExitThread,connect,closesocket,ExitThread,closesocket,ExitThread,	3_2_0048298C
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00486E2C socket,ntohs,bind,listen,accept,LocalAlloc,CreateThread,CloseHandle,Sleep,ExitThread,	3_2_00486E2C
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048317C socket,ExitThread,ntohs,inet_addr,gethostbyname,ExitThread,connect,recv,recv,send,recv,shutdown,closesocket,ExitThread,	3_2_0048317C
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00489244 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,send,recv,shutdown,closesocket,ExitThread,	3_2_00489244
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0047F4E0 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,recv,recv,shutdown,closesocket,	3_2_0047F4E0
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004836D8 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,connect,ExitThread,recv,Sleep,closesocket,ExitThread,	3_2_004836D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0047FA8C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,GetDeviceCaps,BitBlt,send,recv,SelectObject,DeleteObject,DeleteObject,ReleaseDC,shutdown,closesocket,	3_2_0047FA8C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004801FC socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,recv,send,recv,recv,recv,shutdown,closesocket,	6_2_004801FC
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004821A0 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,sendto,Sleep,closesocket,ExitThread,	6_2_004821A0
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048851C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,mouse_event,shutdown,closesocket,	6_2_0048851C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004865E0 Sleep,TranslateMessage,DispatchMessageA,PeekMessageA,socket,ntohs,inet_addr,gethostbyname,connect,recv,shutdown,closesocket,	6_2_004865E0
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00460628 inet_addr,ntohs,	6_2_00460628
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00482630 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,connect,ExitThread,recv,Sleep,closesocket,ExitThread,	6_2_00482630
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004607A4 getservbyname,ntohs,	6_2_004607A4
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00480880 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,shutdown,closesocket,shutdown,closesocket,	6_2_00480880
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00486918 recv,recv,send,send,recv,send,send,send,send,send,recv,recv,recv,gethostbyname,ntohs,socket,connect,getsockname,send,select,recv,send,recv,send,Sleep,closesocket,closesocket,	6_2_00486918
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048298C socket,ExitThread,ntohs,inet_addr,gethostbyname,ExitThread,connect,closesocket,ExitThread,closesocket,ExitThread,	6_2_0048298C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00486E2C socket,ntohs,bind,listen,accept,LocalAlloc,CreateThread,CloseHandle,Sleep,ExitThread,	6_2_00486E2C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048317C socket,ExitThread,ntohs,inet_addr,gethostbyname,ExitThread,connect,recv,recv,send,recv,shutdown,closesocket,ExitThread,	6_2_0048317C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00489244 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,send,recv,shutdown,closesocket,ExitThread,	6_2_00489244
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0047F4E0 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,recv,recv,shutdown,closesocket,	6_2_0047F4E0
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004836D8 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,connect,ExitThread,recv,Sleep,closesocket,ExitThread,	6_2_004836D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0047FA8C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,GetDeviceCaps,BitBlt,send,recv,SelectObject,DeleteObject,DeleteObject,ReleaseDC,shutdown,closesocket,	6_2_0047FA8C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00487B54 CoInitialize,socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,send,recv,shutdown,closesocket,	6_2_00487B54
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0047FE20 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,send,shutdown,closesocket,	6_2_0047FE20
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00485F40 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,	6_2_00485F40
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00487F2C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,Sleep,send,recv,shutdown,closesocket,	6_2_00487F2C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00473F34 CreateProcessA,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,TerminateProcess,	6_2_00473F34

Contains functionality to delete services

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004715B0 OpenSCManagerA,OpenServiceA,DeleteService,CloseServiceHandle,CloseServiceHandle,

3_2_004715B0

Contains functionality to shutdown / reboot the system

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048A070 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		3_2_0048A070
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048A070 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		6_2_0048A070

Creates mutexes

Show sources

Source: C:\Users\user\Music\regdrv.exe

Mutant created: \Sessions\1\BaseNamedObjects\DCMIN_MUTEX-JY7PNMH

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D07E	1_3_0034D07E
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D9FC	1_3_0034D9FC
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00347200	1_3_00347200
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D29E	1_3_0034D29E
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00351331	1_3_00351331
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034DBD8	1_3_0034DBD8
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D4BC	1_3_0034D4BC
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034CCD1	1_3_0034CCD1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D566	1_3_0034D566
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D568	1_3_0034D568
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034CDD6	1_3_0034CDD6
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00347DCA	1_3_00347DCA
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034AFC9	1_3_0034AFC9
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_004021D8	1_2_004021D8
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034AFD4	1_3_0034AFD4
Source: C:\Users\user\Music\regdrv.exe	Code function: 2_2_004021D8	2_2_004021D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00402370	3_2_00402370
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004064C0	3_2_004064C0
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0043E644	3_2_0043E644
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004389B4	3_2_004389B4
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0045EC78	3_2_0045EC78
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0046ADBC	3_2_0046ADBC
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0046797C	3_2_0046797C
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B087E	4_3_002B087E
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B11FC	4_3_002B11FC
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002AAA00	4_3_002AAA00
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B0A9E	4_3_002B0A9E
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B4B31	4_3_002B4B31
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B13D8	4_3_002B13D8
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B0CBC	4_3_002B0CBC
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B04D1	4_3_002B04D1
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B0D68	4_3_002B0D68
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B0D66	4_3_002B0D66
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002AB5CA	4_3_002AB5CA
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B05D6	4_3_002B05D6
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002AE7C9	4_3_002AE7C9
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_2_004021D8	4_2_004021D8
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002AE7D4	4_3_002AE7D4
Source: C:\Users\user\Music\regdrv.exe	Code function: 5_2_004021D8	5_2_004021D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00402370	6_2_00402370
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004064C0	6_2_004064C0
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0043E644	6_2_0043E644
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004389B4	6_2_004389B4
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0045EC78	6_2_0045EC78
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0046ADBC	6_2_0046ADBC
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0046797C	6_2_0046797C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00469B90	6_2_00469B90

Enables driver privileges

Show sources

Source: C:\Users\user\Music\regdrv.exe

Process token adjusted: Load Driver

Jump to behavior

Enables security privileges

Show sources

Source: C:\Users\user\Music\regdrv.exe

Process token adjusted: Security

Jump to behavior

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00407B10 appears 276 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004735E8 appears 75 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00407688 appears 36 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00407B08 appears 65 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004100C4 appears 40 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405584 appears 117 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00406F68 appears 32 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00474D58 appears 46 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 0040EF4C appears 42 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004055C8 appears 72 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004043B0 appears 46 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 0041163C appears 38 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405974 appears 32 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00404F34 appears 36 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405818 appears 40 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00404F10 appears 162 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004218E4 appears 149 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00404A1C appears 32 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405554 appears 31 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405530 appears 130 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004104C4 appears 42 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405864 appears 57 times
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: String function: 00404F10 appears 81 times
Source: C:\Users\user\Videos\Regdriver.exe	Code function: String function: 00404F10 appears 81 times

PE file contains strange resources

Show sources

Source: DOC000YUT60.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: DOC000YUT60.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOC000YUT60.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOC000YUT60.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOC000YUT60.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: regdrv.exe.1.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: regdrv.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: regdrv.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: regdrv.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: regdrv.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Regdriver.exe.1.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Regdriver.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Regdriver.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Regdriver.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Regdriver.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Show sources

Source: DOC000YUT60.exe

Binary or memory string: OriginalFilenamePeaZip. vs DOC000YUT60.exe

PE file has a writable .reloc section

Show sources

Source: DOC000YUT60.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Source: regdrv.exe.1.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Source: Regdriver.exe.1.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

PE file contains an invalid data directory

Show sources

Source: DOC000YUT60.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: regdrv.exe.1.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: Regdriver.exe.1.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Classification label

Show sources

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@10/5@0/1

Contains functionality for error logging

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00425A70 GetLastError,FormatMessageA,

3_2_00425A70

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048AEA8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,	3_2_0048AEA8
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048A070 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,	3_2_0048A070
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048AEA8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,	6_2_0048AEA8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048A070 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,	6_2_0048A070

Contains functionality to check free disk space

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0040A746 GetDiskFreeSpaceA,

3_2_0040A746

Contains functionality to create services

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: OpenSCManagerA,CreateServiceA,CloseServiceHandle,CloseServiceHandle,		3_2_00471850
Source: C:\Users\user\Music\regdrv.exe	Code function: OpenSCManagerA,CreateServiceA,CloseServiceHandle,CloseServiceHandle,		6_2_00471850

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_2_00407D92 CoCreateInstance,

1_2_00407D92

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0048DDE0 FindResourceA,LoadResource,SizeofResource,LockResource,FreeResource,

3_2_0048DDE0

Contains functionality to modify services (start/stop/modify)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004714B8 OpenSCManagerA,OpenServiceA,StartServiceA,ControlService,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,

3_2_004714B8

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

File created: C:\Users\user\Music\regdrv.exe

Jump to behavior

Parts of this applications are using Borland Delphi (Probably coded in Delphi)

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Videos\Regdriver.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior

Reads ini files

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Show sources

Source: DOC000YUT60.exe

virustotal: Detection: 60%

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\DOC000YUT600.exe 'C:\Users\user\Desktop\DOC000YUT600.exe'
Source: unknown	Process created: C:\Users\user\Music\regdrv.exe 'C:\Users\user\Music\regdrv.exe'
Source: unknown	Process created: C:\Users\user\Music\regdrv.exe C:\Users\user\Music\regdrv.exe
Source: unknown	Process created: C:\Users\user\Videos\Regdriver.exe 'C:\Users\user\Videos\Regdriver.exe'
Source: unknown	Process created: C:\Users\user\Music\regdrv.exe 'C:\Users\user\Music\regdrv.exe'
Source: unknown	Process created: C:\Users\user\Music\regdrv.exe C:\Users\user\Music\regdrv.exe
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Process created: C:\Users\user\Music\regdrv.exe 'C:\Users\user\Music\regdrv.exe'	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Process created: C:\Users\user\Music\regdrv.exe C:\Users\user\Music\regdrv.exe	Jump to behavior
Source: C:\Users\user\Videos\Regdriver.exe	Process created: C:\Users\user\Music\regdrv.exe 'C:\Users\user\Music\regdrv.exe'	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Process created: C:\Users\user\Music\regdrv.exe C:\Users\user\Music\regdrv.exe	Jump to behavior

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Submission file is bigger than most known malware samples

Show sources

Source: DOC000YUT60.exe

Static file information: File size 1816064 > 1048576

PE file has a big raw section

Show sources

Source: DOC000YUT60.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x16f800

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_3_0034FD78 LoadLibraryA,GetProcAddress,GetModuleHandleA,

1_3_0034FD78

Entry point lies outside standard sections

Show sources

Source: initial sample

Static PE information: section where entry point is pointing to: .data

PE file contains an invalid checksum

Show sources

Source: Regdriver.exe.1.dr	Static PE information: real checksum: 0xf110a should be: 0x1bf325
Source: DOC000YUT60.exe	Static PE information: real checksum: 0xf110a should be: 0x1bf325
Source: regdrv.exe.1.dr	Static PE information: real checksum: 0xf110a should be: 0x1bf325

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00344D14 push 00344D51h; ret	1_3_00344D49
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_003421DD push eax; ret	1_3_00342219
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034C1D9 push esp; retn 0034h	1_3_0034C1E9
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034E24C push ecx; mov dword ptr [esp], edx	1_3_0034E251
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_003422AD push 003424B9h; ret	1_3_003424B1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034FB3C push ebx; ret	1_3_0034FB5D
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034FB3C push eax; ret	1_3_0034FB81
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034232E push 003424B9h; ret	1_3_003424B1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_003423AB push 003424B9h; ret	1_3_003424B1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00342410 push 003424B9h; ret	1_3_003424B1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0035049E push eax; ret	1_3_003504CB
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034CCD1 push ecx; mov dword ptr [esp], edx	1_3_0034CCF1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034CDD6 push ecx; mov dword ptr [esp], edx	1_3_0034CDDD
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00347DCA push ecx; mov dword ptr [esp], eax	1_3_00347DE1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0040E17C push ecx; mov dword ptr [esp], edx	1_2_0040E181
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0041F100 push ecx; mov dword ptr [esp], edx	1_2_0041F105
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0041B238 push ecx; mov dword ptr [esp], edx	1_2_0041B23A
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_004172A8 push ecx; mov dword ptr [esp], edx	1_2_004172AD
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_004194A4 push ecx; mov dword ptr [esp], edx	1_2_004194A5
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00417504 push ecx; mov dword ptr [esp], edx	1_2_00417509
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00417668 push ecx; mov dword ptr [esp], edx	1_2_0041766D
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00417624 push ecx; mov dword ptr [esp], edx	1_2_00417629
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0041E6B0 push ecx; mov dword ptr [esp], edx	1_2_0041E6B2
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0041577C push 004157C9h; ret	1_2_004157C1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0040E816 push 0040EAC2h; ret	1_2_0040EABA
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00403B70 push eax; ret	1_2_00403BAC
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00414D6E push 00414DE6h; ret	1_2_00414DDE
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0041FE36 push 0041FEE3h; ret	1_2_0041FEDB
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00406E8E push 00406EEBh; ret	1_2_00406EE3
Source: C:\Users\user\Music\regdrv.exe	Code function: 2_2_0040E17C push ecx; mov dword ptr [esp], edx	2_2_0040E181
Source: C:\Users\user\Music\regdrv.exe	Code function: 2_2_0041F100 push ecx; mov dword ptr [esp], edx	2_2_0041F105

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	File created: C:\Users\user\Music\regdrv.exe			Jump to dropped file
Source: C:\Users\user\Desktop\DOC000YUT600.exe	File created: C:\Users\user\Videos\Regdriver.exe			Jump to dropped file

Boot Survival:

Contains functionality to start windows services

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004714B8 OpenSCManagerA,OpenServiceA,StartServiceA,ControlService,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,

3_2_004714B8

Creates an autostart registry key

Show sources

Source: C:\Users\user\Music\regdrv.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run Registry Driver			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run Registry Driver			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0042E370 IsIconic,GetWindowPlacement,GetWindowRect,	3_2_0042E370
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00458910 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	3_2_00458910
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004576CC IsIconic,GetCapture,	3_2_004576CC
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0043B75C IsIconic,	3_2_0043B75C
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0043B7D8 GetWindowLongA,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongA,SetWindowLongA,ShowWindow,ShowWindow,	3_2_0043B7D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0042E370 IsIconic,GetWindowPlacement,GetWindowRect,	6_2_0042E370
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00458910 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	6_2_00458910
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004576CC IsIconic,GetCapture,	6_2_004576CC
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0043B75C IsIconic,	6_2_0043B75C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0043B7D8 GetWindowLongA,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongA,SetWindowLongA,ShowWindow,ShowWindow,	6_2_0043B7D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00457FD4 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	6_2_00457FD4

Extensive use of GetProcAddress (often used to hide API calls)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00460AC0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00460AC0

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Videos\Regdriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_3-39469

Contains functionality to enumerate running services

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: OpenSCManagerA,EnumServicesStatusA,CloseServiceHandle,		3_2_00471640
Source: C:\Users\user\Music\regdrv.exe	Code function: OpenSCManagerA,EnumServicesStatusA,CloseServiceHandle,		6_2_00471640

Found evasive API chain (date check)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Found evasive API chain checking for process token information

Show sources

Source: C:\Users\user\Music\regdrv.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-38102

Found large amount of non-executed APIs

Show sources

Source: C:\Users\user\Music\regdrv.exe	API coverage: 6.5 %
Source: C:\Users\user\Music\regdrv.exe	API coverage: 4.0 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Music\regdrv.exe TID: 3516	Thread sleep count: 92 > 30			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe TID: 3516	Thread sleep time: -92000s >= -60000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00342EA8 FindFirstFileA,GetLastError,	1_3_00342EA8
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0040A488 FindFirstFileA,GetLastError,	3_2_0040A488
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00406A68 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	3_2_00406A68
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00480FEC FindFirstFileA,	3_2_00480FEC
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002A66A8 FindFirstFileA,GetLastError,	4_3_002A66A8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0040A488 FindFirstFileA,GetLastError,	6_2_0040A488
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00406A68 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	6_2_00406A68
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00480FEC FindFirstFileA,	6_2_00480FEC

Program exit points

Show sources

Source: C:\Users\user\Music\regdrv.exe	API call chain: ExitProcess graph end node	graph_3-39280
Source: C:\Users\user\Music\regdrv.exe	API call chain: ExitProcess graph end node	graph_3-39338
Source: C:\Users\user\Music\regdrv.exe	API call chain: ExitProcess graph end node

Anti Debugging:

Checks for debuggers (devices)

Show sources

Source: C:\Users\user\Music\regdrv.exe	File opened: SIWDEBUG
Source: C:\Users\user\Music\regdrv.exe	File opened: NTICE
Source: C:\Users\user\Music\regdrv.exe	File opened: SICE

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_3_0034FD78 LoadLibraryA,GetProcAddress,GetModuleHandleA,

1_3_0034FD78

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00466038 FreeLibrary,VirtualFree,GetProcessHeap,HeapFree,

3_2_00466038

Enables debug privileges

Show sources

Source: C:\Users\user\Music\regdrv.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 6_2_00473F34 CreateProcessA,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,TerminateProcess,

6_2_00473F34

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Music\regdrv.exe	Memory written: C:\Users\user\Music\regdrv.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Memory written: C:\Users\user\Music\regdrv.exe base: 400000 value starts with: 4D5A			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Music\regdrv.exe	Thread register set: target process: 3468			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Thread register set: target process: 3540			Jump to behavior

Contains functionality to launch a program with higher privileges

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0048A218 ShellExecuteExA,

3_2_0048A218

Contains functionality to simulate keystroke presses

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0048B42C keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,

3_2_0048B42C

Contains functionality to simulate mouse events

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0048851C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,mouse_event,shutdown,closesocket,

3_2_0048851C

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_traywndTrayNotifyWndTrayClockWClassjh<
Source: regdrv.exe	Binary or memory string: Shell_TrayWnd
Source: regdrv.exe	Binary or memory string: Progman
Source: 2018-08-29-4.dc.3.dr	Binary or memory string: :: Program Manager (10:00:23 AM)
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_TrayWndjjh
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Progmanjhh
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_traywndTrayNotifyWndjh
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: ProgmanU
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_traywndTrayNotifyWndTrayClockWClassjh
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: ButtonShell_TrayWndj
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_traywndReBarWindow32jh
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_traywndReBarWindow32jhD
Source: regdrv.exe	Binary or memory string: Shell_traywnd
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_TrayWndPjjh

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: GetLocaleInfoA,	1_3_00343A28
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: GetLocaleInfoA,	1_3_00343A74
Source: C:\Users\user\Music\regdrv.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	3_2_00406C2C
Source: C:\Users\user\Music\regdrv.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	3_2_00406D38
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	3_2_0048CEEC
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	3_2_0040D334
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	3_2_0040D380
Source: C:\Users\user\Videos\Regdriver.exe	Code function: GetLocaleInfoA,	4_3_002A7228
Source: C:\Users\user\Videos\Regdriver.exe	Code function: GetLocaleInfoA,	4_3_002A7274
Source: C:\Users\user\Music\regdrv.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	6_2_00406C2C
Source: C:\Users\user\Music\regdrv.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	6_2_00406D38
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	6_2_0048CEEC
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	6_2_0040D334
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	6_2_0040D380

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_3_0034C02C cpuid

1_3_0034C02C

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Users\user\Music\regdrv.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_3_003439A4 GetLocalTime,

1_3_003439A4

Contains functionality to query the account / user name

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0048CE74 GetUserNameA,

3_2_0048CE74

Contains functionality to query windows version

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_3_00344440 GetVersionExA,

1_3_00344440

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00486E2C socket,ntohs,bind,listen,accept,LocalAlloc,CreateThread,CloseHandle,Sleep,ExitThread,		3_2_00486E2C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00486E2C socket,ntohs,bind,listen,accept,LocalAlloc,CreateThread,CloseHandle,Sleep,ExitThread,		6_2_00486E2C

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
09:59:41	API Interceptor	2x Sleep call for process: DOC000YUT600.exe modified
09:59:48	API Interceptor	6x Sleep call for process: regdrv.exe modified
09:59:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry Driver C:\Users\user\Videos\Regdriver.exe
09:59:56	API Interceptor	2x Sleep call for process: Regdriver.exe modified

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DOC000YUT60.exe	61%	virustotal		Browse
DOC000YUT60.exe	9%	metadefender		Browse
DOC000YUT60.exe	100%	Avira	HEUR/AGEN.1032427

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Videos\Regdriver.exe	100%	Avira	HEUR/AGEN.1032427
C:\Users\user\Music\regdrv.exe	100%	Avira	HEUR/AGEN.1032427
C:\Users\user\Music\regdrv.exe	61%	virustotal		Browse
C:\Users\user\Music\regdrv.exe	9%	metadefender		Browse
C:\Users\user\Videos\Regdriver.exe	61%	virustotal		Browse
C:\Users\user\Videos\Regdriver.exe	9%	metadefender		Browse

Unpacked PE Files

Source	Detection	Scanner	Label
5.2.regdrv.exe.2580000.3.unpack	100%	Avira	BDS/DarkKomet.GS
6.0.regdrv.exe.400000.4.unpack	100%	Avira	BDS/DarkKomet.GS
6.2.regdrv.exe.400000.3.unpack	100%	Avira	BDS/DarkKomet.GS
3.0.regdrv.exe.400000.4.unpack	100%	Avira	BDS/DarkKomet.GS
2.2.regdrv.exe.25d0000.3.unpack	100%	Avira	BDS/DarkKomet.GS
6.1.regdrv.exe.400000.0.unpack	100%	Avira	BDS/DarkKomet.GS
6.0.regdrv.exe.400000.5.unpack	100%	Avira	BDS/DarkKomet.GS
3.2.regdrv.exe.400000.3.unpack	100%	Avira	BDS/DarkKomet.GS
3.0.regdrv.exe.400000.5.unpack	100%	Avira	BDS/DarkKomet.GS
3.1.regdrv.exe.400000.0.unpack	100%	Avira	BDS/DarkKomet.GS

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://SAC.home-page.org	0%	virustotal		Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

Source	Rule	Description	Author
00000006.00000000.479399059.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000006.00000001.481410763.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000006.00000001.481410763.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000006.00000000.479399059.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000002.00000003.450764221.7F370000.00000004.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000005.00000002.491857687.02580000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000005.00000002.491857687.02580000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000002.00000002.462554403.025D0000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000002.00000002.462554403.025D0000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000001.447610474.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000003.00000001.447610474.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000002.699224479.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000003.00000002.699224479.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000006.00000000.479959577.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000006.00000000.479959577.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000006.00000002.482534154.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000006.00000002.482534154.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000000.446776706.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000003.00000000.446776706.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000005.00000003.485657484.7F370000.00000004.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000000.446217367.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000003.00000000.446217367.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>

Unpacked PEs

Source	Rule	Description	Author
6.1.regdrv.exe.400000.0.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.1.regdrv.exe.400000.0.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
5.2.regdrv.exe.2580000.3.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
5.2.regdrv.exe.2580000.3.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.2.regdrv.exe.400000.3.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.2.regdrv.exe.400000.3.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.0.regdrv.exe.400000.5.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.0.regdrv.exe.400000.5.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
2.2.regdrv.exe.25d0000.3.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
2.2.regdrv.exe.25d0000.3.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
5.2.regdrv.exe.2580000.3.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
5.2.regdrv.exe.2580000.3.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
2.2.regdrv.exe.25d0000.3.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
2.2.regdrv.exe.25d0000.3.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.0.regdrv.exe.400000.4.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.0.regdrv.exe.400000.4.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.1.regdrv.exe.400000.0.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.1.regdrv.exe.400000.0.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.2.regdrv.exe.400000.3.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.2.regdrv.exe.400000.3.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.0.regdrv.exe.400000.5.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.0.regdrv.exe.400000.5.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.2.regdrv.exe.400000.3.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.2.regdrv.exe.400000.3.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.0.regdrv.exe.400000.4.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.0.regdrv.exe.400000.4.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.2.regdrv.exe.400000.3.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.2.regdrv.exe.400000.3.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.0.regdrv.exe.400000.5.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.0.regdrv.exe.400000.5.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.0.regdrv.exe.400000.4.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.0.regdrv.exe.400000.4.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.0.regdrv.exe.400000.5.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.0.regdrv.exe.400000.5.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.0.regdrv.exe.400000.4.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.0.regdrv.exe.400000.4.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.1.regdrv.exe.400000.0.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.1.regdrv.exe.400000.0.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.1.regdrv.exe.400000.0.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.1.regdrv.exe.400000.0.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ORIONTELEKOM-ASRS	79SWIFT COPY,pdf-INV I086#.exe	f1df846ab638f0356f84a9fe14eaeb1cf98c17fb410ac1308c144c0683c89ed8	malicious	Browse	95.140.125.9
	23RFQ-15-0798101-1296.jar	aca07b5c2399523b768b7cafd3d33975900d50d05073974a93c0b74683aabc32	malicious	Browse	95.140.125.118
	payment advice 20_03 2018.doc	c95780a21ae219e68bc2431a6e98aa1ead481129a293b9aee739a82d80ffc668	malicious	Browse	77.105.36.181
	SWIFT COPY 02.js	23b46da625d2d17af9daf2640f05769eb9e2166b27d82b3f09f09e13d2bfd067	malicious	Browse	95.140.125.117
	Contract Cop.exe	af88f00b02c7fafa486e46001e29f1aae1205fd83ff962b9ff857293640c7332	malicious	Browse	95.140.125.81
	536ffa992-491508d-ca0354e-52f32a3-7a679a53a.doc	d5f72d16015ba479d1200f68515efb1602622b3b1bcab6dbda633e63caca82ee	malicious	Browse	93.93.196.254
	Inv 54869 - PO #4F634410.doc	e39be590fb6dfa04ae6d6720588694aea026cb4d6d68f60b56d3bcea85f13455	malicious	Browse	77.105.36.132
	SCAN_9097765.js	13b5960a44dabd990e8326bf9d675a4c335d9be6b06db81875cc2e4a2c7b9a2c	malicious	Browse	95.140.125.119
	SCAN_9097765.js	13b5960a44dabd990e8326bf9d675a4c335d9be6b06db81875cc2e4a2c7b9a2c	malicious	Browse	95.140.125.119
	atmos_weber.exe	f95938b4343d5a2c7250472f71850aacb6ef3575cdc52de5c9b86e2106a3b3eb	malicious	Browse	95.140.125.108
	04172018HSBCJSZZH_app.doc	496930937ee43a2c13fd371cdadf77dc0a4c9c6b366c0c89b95acb9b8edf63fa	malicious	Browse	79.175.102.12
	66DHL SHIPMENT INF.exe	3e81efc218937fca3b8ca1beb162bf08b12bf19f508140510c771e9e325fc567	malicious	Browse	95.140.125.82
	66DHL SHIPMENT INF.exe	3e81efc218937fca3b8ca1beb162bf08b12bf19f508140510c771e9e325fc567	malicious	Browse	95.140.125.82
	Inv 54869 - PO #4F634410.doc	e39be590fb6dfa04ae6d6720588694aea026cb4d6d68f60b56d3bcea85f13455	malicious	Browse	77.105.36.132
	35PO#ORDER$9880.exe	70c4a701c97b89afa03e1e092cc7e3b11fb4c364ce8f66103228287d24cb3d74	malicious	Browse	95.140.125.50
	SWIFT COPY 02.js	23b46da625d2d17af9daf2640f05769eb9e2166b27d82b3f09f09e13d2bfd067	malicious	Browse	95.140.125.117

Dropped Files

No context

Screenshots

Startup

System is w7_1

DOC000YUT600.exe (PID: 3420 cmdline: 'C:\Users\user\Desktop\DOC000YUT600.exe' MD5: CD1974C09F7171E19634DE0E00D7EFB7)

regdrv.exe (PID: 3452 cmdline: 'C:\Users\user\Music\regdrv.exe' MD5: CD1974C09F7171E19634DE0E00D7EFB7)

regdrv.exe (PID: 3468 cmdline: C:\Users\user\Music\regdrv.exe MD5: CD1974C09F7171E19634DE0E00D7EFB7)

Regdriver.exe (PID: 3484 cmdline: 'C:\Users\user\Videos\Regdriver.exe' MD5: CD1974C09F7171E19634DE0E00D7EFB7)

regdrv.exe (PID: 3532 cmdline: 'C:\Users\user\Music\regdrv.exe' MD5: CD1974C09F7171E19634DE0E00D7EFB7)

regdrv.exe (PID: 3540 cmdline: C:\Users\user\Music\regdrv.exe MD5: CD1974C09F7171E19634DE0E00D7EFB7)

cleanup

Created / dropped Files

C:\Users\user\AppData\Roaming\dclogs\2018-08-29-4.dc
Process:	C:\Users\user\Music\regdrv.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	71
Entropy (8bit):	4.396993993112084
Encrypted:	false
MD5:	1BF13C6F0627F41E42511316B964E49A
SHA1:	2054EAC296FE8621F815BCD07A482946B87B5B4A
SHA-256:	5E19DEDE267E426E80B174CF8D6001189F88949CC375515F74FE454CAB39532E
SHA-512:	69C8487A23B5AE88AC2B472A007505E0FDA59161D69621604A8B1D06D3A8D35CC07F4CA1B6DCE87755C157C01798659752B25C501D99EB33AD73369BC24FC814
Malicious:	false
Reputation:	low

C:\Users\user\Music\regdrv.exe
Process:	C:\Users\user\Desktop\DOC000YUT600.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	1816064
Entropy (8bit):	6.7932256230048225
Encrypted:	false
MD5:	CD1974C09F7171E19634DE0E00D7EFB7
SHA1:	41F02346C16FB2585EDB2585EF67766E42E69528
SHA-256:	CCF07ED87CE33179BA77B74372818958A04236860738CE96993976493488E7B4
SHA-512:	485C46E035CA077065645DBA67D1F40E0787ED04175A6A11E5FBE9E5D1289B98376F3B845B97871DD0CB6629061A3A12ED537FB11FE1DB7001849288FAA5E717
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%, Browse Antivirus: virustotal, Detection: 61%, Browse Antivirus: metadefender, Detection: 9%, Browse
Reputation:	low

C:\Users\user\Music\regdrv.exe:Zone.Identifier
Process:	C:\Users\user\Desktop\DOC000YUT600.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	26
Entropy (8bit):	3.9500637564362093
Encrypted:	false
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file

C:\Users\user\Videos\Regdriver.exe
Process:	C:\Users\user\Desktop\DOC000YUT600.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	1816064
Entropy (8bit):	6.7932256230048225
Encrypted:	false
MD5:	CD1974C09F7171E19634DE0E00D7EFB7
SHA1:	41F02346C16FB2585EDB2585EF67766E42E69528
SHA-256:	CCF07ED87CE33179BA77B74372818958A04236860738CE96993976493488E7B4
SHA-512:	485C46E035CA077065645DBA67D1F40E0787ED04175A6A11E5FBE9E5D1289B98376F3B845B97871DD0CB6629061A3A12ED537FB11FE1DB7001849288FAA5E717
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%, Browse Antivirus: virustotal, Detection: 61%, Browse Antivirus: metadefender, Detection: 9%, Browse
Reputation:	low

C:\Users\user\Videos\Regdriver.exe:Zone.Identifier
Process:	C:\Users\user\Desktop\DOC000YUT600.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	26
Entropy (8bit):	3.9500637564362093
Encrypted:	false
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://SAC.home-page.org	regdrv.exe, 00000002.00000002.451751956.013B0000.00000004.sdmp	false	0%, virustotal, Browse	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	Flag	ASN	ASN Name	Malicious
95.140.125.42	Serbia		9125	ORIONTELEKOM-ASRS	true

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.7932256230048225
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DOC000YUT60.exe
File size:	1816064
MD5:	cd1974c09f7171e19634de0e00d7efb7
SHA1:	41f02346c16fb2585edb2585ef67766e42e69528
SHA256:	ccf07ed87ce33179ba77b74372818958a04236860738ce96993976493488e7b4
SHA512:	485c46e035ca077065645dba67d1f40e0787ed04175a6a11e5fbe9e5d1289b98376f3b845b97871dd0cb6629061a3a12ed537fb11fe1db7001849288faa5e717
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon

Static PE Info

General
Entrypoint:	0x614001
Entrypoint Section:	.data
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	6d53ec3a4000e578abfe26f2247d34a4

Entrypoint Preview

Instruction
pushad
call 00007F7474FB1A76h
nop
pop ebp
sub ebp, 0045AFBFh
mov ebx, 0045AFB8h
add ebx, ebp
sub ebx, dword ptr [ebp+0045C391h]
cmp dword ptr [ebp+0045C28Ch], 00000000h
mov dword ptr [ebp+0045BFF5h], ebx
jne 00007F7474FB2B44h
lea eax, dword ptr [ebp+0045C294h]
push eax
call dword ptr [ebp+0045C3D0h]
mov dword ptr [ebp+0045C290h], eax
mov edi, eax
lea ebx, dword ptr [ebp+0045C2A1h]
push ebx
push eax
call dword ptr [ebp+0045C3CCh]
mov dword ptr [ebp+0045C399h], eax
lea ebx, dword ptr [ebp+0045C2ACh]
push ebx
push edi
call dword ptr [ebp+0045C3CCh]
mov dword ptr [ebp+0045C39Dh], eax
mov eax, dword ptr [ebp+0045BFF5h]
mov dword ptr [ebp+0045C28Ch], eax
jmp 00007F7474FB1ABDh
push 00000004h
push 00001000h
push 000010CEh
push 00000000h
call dword ptr [ebp+0045C399h]
mov dword ptr [ebp+0045C395h], eax
lea ebx, dword ptr [ebp+0045B07Dh]
push eax
push ebx
call 00007F7474FB2B67h
mov ecx, eax
lea edi, dword ptr [ebp+0045B07Dh]
mov esi, dword ptr [ebp+0045C395h]
rep movsb
mov eax, dword ptr [ebp+0045C395h]
push 00008000h
push 00000000h
push eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x215464	0x400	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa4000	0x16f750	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2152cc	0x8	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2153fc	0x18	.data
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x100000

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8c000	0x36200	False	0.99912943851	data	7.99893055838	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.itext	0x8d000	0x1000	0x600	False	0.901692708333	data	7.33978754225	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x8e000	0x3000	0xe00	False	0.897600446429	data	7.48715231717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.bss	0x91000	0x4000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x95000	0x3000	0x400	False	0.8056640625	data	6.6138767395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x98000	0x1000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x99000	0x1000	0x200	False	0.05078125	dBase IV DBT of \254\347H.DBF, blocks size 4816960, next free block index 4816896	0.210826267787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x9a000	0xa000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xa4000	0x170000	0x16f800	False	0.65108551233	data	6.2232248145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x214000	0x14000	0x13e00	False	0.930117433176	data	7.71081914706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x228000	0x1000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0xa53f8	0x134	data	English	United States
RT_CURSOR	0xa552c	0x134	data	English	United States
RT_CURSOR	0xa5660	0x134	data	English	United States
RT_CURSOR	0xa5794	0x134	data	English	United States
RT_CURSOR	0xa58c8	0x134	data	English	United States
RT_CURSOR	0xa59fc	0x134	data	English	United States
RT_CURSOR	0xa5b30	0x134	data	English	United States
RT_BITMAP	0xa5c64	0x1d0	data	English	United States
RT_BITMAP	0xa5e34	0x1e4	data	English	United States
RT_BITMAP	0xa6018	0x1d0	data	English	United States
RT_BITMAP	0xa61e8	0x1d0	data	English	United States
RT_BITMAP	0xa63b8	0x1d0	data	English	United States
RT_BITMAP	0xa6588	0x1d0	data	English	United States
RT_BITMAP	0xa6758	0x1d0	data	English	United States
RT_BITMAP	0xa6928	0x1d0	data	English	United States
RT_BITMAP	0xa6af8	0x1d0	data	English	United States
RT_BITMAP	0xa6cc8	0x1d0	data	English	United States
RT_BITMAP	0xa6e98	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xa6f80	0x128	GLS_BINARY_LSB_FIRST	Russian	Russia
RT_ICON	0xa70a8	0x568	GLS_BINARY_LSB_FIRST	Russian	Russia
RT_ICON	0xa7610	0x2e8	data	Russian	Russia
RT_ICON	0xa78f8	0x8a8	data	Russian	Russia
RT_ICON	0xa81a0	0x468	GLS_BINARY_LSB_FIRST	Russian	Russia
RT_ICON	0xa8608	0x988	data	Russian	Russia
RT_ICON	0xa8f90	0x10a8	data	Russian	Russia
RT_ICON	0xaa038	0x25a8	data	Russian	Russia
RT_ICON	0xac5e0	0x68d3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xb2eb4	0x10828	data
RT_ICON	0xc36dc	0x94a8	data
RT_ICON	0xccb84	0x5488	data
RT_ICON	0xd200c	0x4228	FoxPro FPT, blocks size 0, next free block index 671088640
RT_ICON	0xd6234	0x25a8	dBase IV DBT of `.DBF, blocks size 48, block length 9216, next free block index 40, 1st item "\007\013"
RT_ICON	0xd87dc	0x10a8	data
RT_ICON	0xd9884	0x988	data
RT_ICON	0xda20c	0x468	GLS_BINARY_LSB_FIRST
RT_DIALOG	0xda674	0x52	data
RT_DIALOG	0xda6c8	0x52	data
RT_STRING	0xda71c	0x1cc	data
RT_STRING	0xda8e8	0x46c	data
RT_STRING	0xdad54	0x33c	data
RT_STRING	0xdb090	0xb4	data
RT_STRING	0xdb144	0xf0	data
RT_STRING	0xdb234	0x254	data
RT_STRING	0xdb488	0x3a4	data
RT_STRING	0xdb82c	0x3f4	data
RT_STRING	0xdbc20	0x378	data
RT_STRING	0xdbf98	0x3a0	data
RT_STRING	0xdc338	0x214	data
RT_STRING	0xdc54c	0xcc	data
RT_STRING	0xdc618	0x194	data
RT_STRING	0xdc7ac	0x3c4	data
RT_STRING	0xdcb70	0x338	data
RT_STRING	0xdcea8	0x294	data
RT_RCDATA	0xdd13c	0x1266fa	ASCII text, with very long lines, with no line terminators
RT_RCDATA	0x203838	0x3c6	PC bitmap, Windows 3.x format, 20 x 20 x 8	Russian	Russia
RT_RCDATA	0x203c00	0x786	PC bitmap, Windows 3.x format, 18 x 26 x 32	Russian	Russia
RT_RCDATA	0x204388	0x546	PC bitmap, Windows 3.x format, 23 x 18 x 24	Russian	Russia
RT_RCDATA	0x2048d0	0x4aa	PC bitmap, Windows 3.x format, 19 x 19 x 24	Russian	Russia
RT_RCDATA	0x204d7c	0x4e6	PC bitmap, Windows 3.x format, 20 x 20 x 24	Russian	Russia
RT_RCDATA	0x205264	0xe4e	PC bitmap, Windows 3.x format, 29 x 41 x 24	Russian	Russia
RT_RCDATA	0x2060b4	0x83a	PC bitmap, Windows 3.x format, 25 x 27 x 24	Russian	Russia
RT_RCDATA	0x2068f0	0xc4e	PC bitmap, Windows 3.x format, 57 x 18 x 24	Russian	Russia
RT_RCDATA	0x207540	0x426	PC bitmap, Windows 3.x format, 18 x 18 x 24	Russian	Russia
RT_RCDATA	0x207968	0x75e	PC bitmap, Windows 3.x format, 98 x 34 x 4	Russian	Russia
RT_RCDATA	0x2080c8	0xe6	PC bitmap, Windows 3.x format, 56 x 21 x 1	Russian	Russia
RT_RCDATA	0x2081b0	0x7f6	PC bitmap, Windows 3.x format, 30 x 30 x 8	Russian	Russia
RT_RCDATA	0x2089a8	0x2af6	PC bitmap, Windows 3.x format, 75 x 48 x 24	Russian	Russia
RT_RCDATA	0x20b4a0	0x376	PC bitmap, Windows 3.x format, 17 x 16 x 24	Russian	Russia
RT_RCDATA	0x20b818	0xf6	PC bitmap, Windows 3.x format, 16 x 16 x 4	Russian	Russia
RT_RCDATA	0x20b910	0x87a	PC bitmap, Windows 3.x format, 30 x 23 x 24	Russian	Russia
RT_RCDATA	0x20c18c	0x546	PC bitmap, Windows 3.x format, 18 x 18 x 32	Russian	Russia
RT_RCDATA	0x20c6d4	0x546	PC bitmap, Windows 3.x format, 18 x 18 x 32	Russian	Russia
RT_RCDATA	0x20cc1c	0x4e6	PC bitmap, Windows 3.x format, 20 x 20 x 24	Russian	Russia
RT_RCDATA	0x20d104	0x7ea	PC bitmap, Windows 3.x format, 22 x 29 x 24	Russian	Russia
RT_RCDATA	0x20d8f0	0x4aa	PC bitmap, Windows 3.x format, 19 x 19 x 24	Russian	Russia
RT_RCDATA	0x20dd9c	0x3aa	PC bitmap, Windows 3.x format, 17 x 17 x 24	Russian	Russia
RT_RCDATA	0x20e148	0x4c39	data
RT_GROUP_CURSOR	0x212d84	0x14	Lotus 1-2-3	English	United States
RT_GROUP_CURSOR	0x212d98	0x14	Lotus 1-2-3	English	United States
RT_GROUP_CURSOR	0x212dac	0x14	Lotus 1-2-3	English	United States
RT_GROUP_CURSOR	0x212dc0	0x14	Lotus 1-2-3	English	United States
RT_GROUP_CURSOR	0x212dd4	0x14	Lotus 1-2-3	English	United States
RT_GROUP_CURSOR	0x212de8	0x14	Lotus 1-2-3	English	United States
RT_GROUP_CURSOR	0x212dfc	0x14	Lotus 1-2-3	English	United States
RT_GROUP_ICON	0x212e10	0x84	MS Windows icon resource - 9 icons, 256-colors
RT_GROUP_ICON	0x212e94	0x76	MS Windows icon resource - 8 icons, 16x16, 16-colors	Russian	Russia
RT_VERSION	0x212f0c	0x5fc	data	English	United States
RT_MANIFEST	0x213508	0x245	XML document text	English	United States

Imports

DLL	Import
kernel32.dll	GetProcAddress, GetModuleHandleA, LoadLibraryA
oleaut32.dll	SysFreeString
advapi32.dll	RegQueryValueExA
user32.dll	GetKeyboardType
user32.dll	CreateWindowExA
msimg32.dll	GradientFill
gdi32.dll	UnrealizeObject
version.dll	VerQueryValueA
advapi32.dll	RegSetValueExA
oleaut32.dll	CreateErrorInfo
ole32.dll	CoCreateInstance
oleaut32.dll	SafeArrayPtrOfIndex
comctl32.dll	_TrackMouseEvent
urlmon.dll	URLDownloadToFileA
shell32.dll	ShellExecuteA
winspool.drv	OpenPrinterA
comdlg32.dll	PrintDlgA
shfolder.dll	SHGetFolderPathA

Version Infos

Description	Data
LegalCopyright	Giorgio Tani, LGPLv3
InternalName	PeaZip
FileVersion	5.6.0
CompanyName	Giorgio Tani
LegalTrademarks	none
ProductName	PeaZip
ProductVersion	5.6.0
FileDescription	PeaZip, file and archive manager
OriginalFilename	PeaZip
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2018 10:00:29.419099092 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:00:29.644283056 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:00:29.644598007 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:00:29.857481003 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:00:29.857990026 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:00:30.098074913 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:00:30.126121998 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:00:30.623514891 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:00:39.304467916 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:00:39.314781904 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:00:39.833359957 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:00:49.707680941 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:00:50.206440926 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:01:09.707457066 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:01:10.220314980 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:01:26.459423065 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:01:26.462915897 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:01:26.818218946 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:01:29.725163937 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:01:30.211399078 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:01:49.738543987 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:01:50.209827900 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:02:09.776155949 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:02:10.209705114 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:02:13.582567930 CEST	1908	49188	95.140.125.42	192.168.1.82
Aug 29, 2018 10:02:13.586133957 CEST	49188	1908	192.168.1.82	95.140.125.42
Aug 29, 2018 10:02:14.115024090 CEST	1908	49188	95.140.125.42	192.168.1.82

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: DOC000YUT600.exe PID: 3420 Parent PID: 3076

General

Start time:	09:59:40
Start date:	29/08/2018
Path:	C:\Users\user\Desktop\DOC000YUT600.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\DOC000YUT600.exe'
Imagebase:	0x400000
File size:	1816064 bytes
MD5 hash:	CD1974C09F7171E19634DE0E00D7EFB7
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Chronological Activities

Analysis Process: regdrv.exe PID: 3452 Parent PID: 3420

General

Start time:	09:59:46
Start date:	29/08/2018
Path:	C:\Users\user\Music\regdrv.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Music\regdrv.exe'
Imagebase:	0x400000
File size:	1816064 bytes
MD5 hash:	CD1974C09F7171E19634DE0E00D7EFB7
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000002.00000003.450764221.7F370000.00000004.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000002.00000002.462554403.025D0000.00000040.sdmp, Author: Florian Roth Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000002.00000002.462554403.025D0000.00000040.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Avira, Browse Detection: 61%, virustotal, Browse Detection: 9%, metadefender, Browse
Reputation:	low

Chronological Activities

Analysis Process: regdrv.exe PID: 3468 Parent PID: 3452

General

Start time:	09:59:53
Start date:	29/08/2018
Path:	C:\Users\user\Music\regdrv.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Music\regdrv.exe
Imagebase:	0x400000
File size:	1816064 bytes
MD5 hash:	CD1974C09F7171E19634DE0E00D7EFB7
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000003.00000001.447610474.00400000.00000040.sdmp, Author: Florian Roth Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000003.00000001.447610474.00400000.00000040.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000003.00000002.699224479.00400000.00000040.sdmp, Author: Florian Roth Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000003.00000002.699224479.00400000.00000040.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000003.00000000.446776706.00400000.00000040.sdmp, Author: Florian Roth Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000003.00000000.446776706.00400000.00000040.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000003.00000000.446217367.00400000.00000040.sdmp, Author: Florian Roth Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000003.00000000.446217367.00400000.00000040.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: Regdriver.exe PID: 3484 Parent PID: 1464

General

Start time:	09:59:54
Start date:	29/08/2018
Path:	C:\Users\user\Videos\Regdriver.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Videos\Regdriver.exe'
Imagebase:	0x400000
File size:	1816064 bytes
MD5 hash:	CD1974C09F7171E19634DE0E00D7EFB7
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira, Browse Detection: 61%, virustotal, Browse Detection: 9%, metadefender, Browse
Reputation:	low

Chronological Activities

Analysis Process: regdrv.exe PID: 3532 Parent PID: 3484

General

Start time:	10:00:01
Start date:	29/08/2018
Path:	C:\Users\user\Music\regdrv.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Music\regdrv.exe'
Imagebase:	0x400000
File size:	1816064 bytes
MD5 hash:	CD1974C09F7171E19634DE0E00D7EFB7
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000005.00000002.491857687.02580000.00000040.sdmp, Author: Florian Roth Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000005.00000002.491857687.02580000.00000040.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000005.00000003.485657484.7F370000.00000004.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: regdrv.exe PID: 3540 Parent PID: 3532

General

Start time:	10:00:09
Start date:	29/08/2018
Path:	C:\Users\user\Music\regdrv.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Music\regdrv.exe
Imagebase:	0x400000
File size:	1816064 bytes
MD5 hash:	CD1974C09F7171E19634DE0E00D7EFB7
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000006.00000000.479399059.00400000.00000040.sdmp, Author: Florian Roth Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000006.00000001.481410763.00400000.00000040.sdmp, Author: Florian Roth Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000006.00000001.481410763.00400000.00000040.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000006.00000000.479399059.00400000.00000040.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000006.00000000.479959577.00400000.00000040.sdmp, Author: Florian Roth Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000006.00000000.479959577.00400000.00000040.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000006.00000002.482534154.00400000.00000040.sdmp, Author: Florian Roth Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000006.00000002.482534154.00400000.00000040.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: DOC000YUT600.exe PID: 3420 Parent PID: 3076

Executed Functions

Function 00343A28, Relevance: 1.5, APIs: 1, Instructions: 29

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00343A46

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00350520, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 190

APIs

GetModuleFileNameA.KERNEL32(?,?,000000FF,00000000,0035082F), ref: 00350733

Part of subcall function 003504FC: CreateFileA.KERNEL32(003504EC,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00350512

GetLastError.KERNEL32(00000000,00350664,?,00000000,0035082F), ref: 0035060D
GetLastError.KERNEL32(00000000,00350664,?,00000000,0035082F), ref: 00350625
GetLastError.KERNEL32(00000000,00350664,?,00000000,0035082F), ref: 0035063D

Strings

KHCB, xrefs: 003506B4
}_b, xrefs: 0035055B, 00350570

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0040D9E0, Relevance: 7.7, Strings: 6, Instructions: 201

Strings

AMPM , xrefs: 0040DC39
AMPM, xrefs: 0040DC2A
mmmm d, yyyy, xrefs: 0040DB12
:mm, xrefs: 0040DC49
m/d/yy, xrefs: 0040DAE5
:mm:ss, xrefs: 0040DC66

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00346D80, Relevance: 3.1, APIs: 2, Instructions: 93registry

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,000F003F,?,00000000,00346E88), ref: 00346DFC
RegCreateKeyExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,000F003F,00000000,?,?,00000000,00346E88), ref: 00346E31

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00406554, Relevance: 2.7, Strings: 2, Instructions: 184

Strings

Software\Borland\Delphi\Locales, xrefs: 004065C0
Software\Borland\Locales, xrefs: 00406584, 004065A2

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0035094C, Relevance: 2.6, Strings: 2, Instructions: 99

Strings

}_b, xrefs: 0035097D
Key, xrefs: 00350A05

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034F764, Relevance: 2.5, Strings: 2, Instructions: 42

Strings

.key, xrefs: 0034F7A8
regfile, xrefs: 0034F7B5

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00343A9C, Relevance: 1.6, APIs: 1, Instructions: 99

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00343BD2), ref: 00343ABB

Part of subcall function 00342D3C: LoadStringA.USER32(0033DF78,0000FF86,?,00000400), ref: 00342D59

Part of subcall function 00343A28: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00343A46

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00346D7E, Relevance: 1.6, APIs: 1, Instructions: 75registry

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,000F003F,?,00000000,00346E88), ref: 00346DFC
RegCreateKeyExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,000F003F,00000000,?,?,00000000,00346E88), ref: 00346E31

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00346FC2, Relevance: 1.5, APIs: 1, Instructions: 43registry

APIs

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 00346FF5

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00346FC4, Relevance: 1.5, APIs: 1, Instructions: 42registry

APIs

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 00346FF5

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00346EA4, Relevance: 1.5, APIs: 1, Instructions: 37registry

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,00346F0C,?,?,?,?,?,00346F0C), ref: 00346EDA

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00346EA8, Relevance: 1.5, APIs: 1, Instructions: 36registry

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,00346F0C,?,?,?,?,?,00346F0C), ref: 00346EDA

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00342D74, Relevance: 1.5, APIs: 1, Instructions: 23file

APIs

CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000080,00000000), ref: 00342DAA

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00342DD8, Relevance: 1.5, APIs: 1, Instructions: 23file

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00342DEC

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 003504FC, Relevance: 1.5, APIs: 1, Instructions: 14file

APIs

CreateFileA.KERNEL32(003504EC,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00350512

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00350ADC, Relevance: 1.4, Strings: 1, Instructions: 163

Strings

t%4, xrefs: 00350BDD, 00350BE3, 00350C09

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034E778, Relevance: 1.3, Strings: 1, Instructions: 61

Strings

Software\, xrefs: 0034E7CD

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00418184, Relevance: 1.3, Strings: 1, Instructions: 52

Strings

hmA, xrefs: 004181A6

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0040706A, Relevance: 1.1, Instructions: 1111

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041D6FC, Relevance: .2, Instructions: 190

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041C7F0, Relevance: .2, Instructions: 176

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0035037C, Relevance: .1, Instructions: 89

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0040D1EE, Relevance: .1, Instructions: 78

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041CAA0, Relevance: .1, Instructions: 69

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0040D91C, Relevance: .1, Instructions: 56

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041801C, Relevance: .1, Instructions: 53

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041FCA0, Relevance: .1, Instructions: 52

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041822C, Relevance: .0, Instructions: 46

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00407B64, Relevance: .0, Instructions: 44

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00407BBC, Relevance: .0, Instructions: 43

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00404BCC, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041CA30, Relevance: .0, Instructions: 40

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00415110, Relevance: .0, Instructions: 39

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 004016E0, Relevance: .0, Instructions: 38

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00406E30, Relevance: .0, Instructions: 32

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041AE48, Relevance: .0, Instructions: 29

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0034EA24, Relevance: .0, Instructions: 27

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 004062F0, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00419CD4, Relevance: .0, Instructions: 25

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00344D14, Relevance: .0, Instructions: 21

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00346F20, Relevance: .0, Instructions: 20

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00404C35, Relevance: .0, Instructions: 19

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041FC76, Relevance: .0, Instructions: 15

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00404C34, Relevance: .0, Instructions: 12

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041F058, Relevance: .0, Instructions: 3

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Non-executed Functions

Function 0034FD78, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 112libraryloader

APIs

LoadLibraryA.KERNEL32(?), ref: 0034FD9B
GetProcAddress.KERNEL32(?,?,00000000,0034FEDD), ref: 0034FDAB
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,00000000,0034FEDD), ref: 0034FDCF

Strings

The ordinal , xrefs: 0034FE07
could not be located in the dynamic link library , xrefs: 0034FE2D, 0034FE8A
LOADER ERROR, xrefs: 0034FE58, 0034FEB5
KERNEL32.DLL, xrefs: 0034FDCA
The procedure entry point , xrefs: 0034FE64

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00342EA8, Relevance: 3.0, APIs: 2, Instructions: 33file

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,?,0034F347,00000000,0034F389), ref: 00342EC3
GetLastError.KERNEL32(00000000,?,?,?,?,0034F347,00000000,0034F389), ref: 00342EE6

Part of subcall function 00342E44: FindNextFileA.KERNEL32(?,?), ref: 00342E54
Part of subcall function 00342E44: GetLastError.KERNEL32(?,?), ref: 00342E5D
Part of subcall function 00342E44: FileTimeToLocalFileTime.KERNEL32(?), ref: 00342E71
Part of subcall function 00342E44: FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 00342E80

Part of subcall function 00342EF4: FindClose.KERNEL32(?,00342EE4,00000000,?,?,?,?,0034F347,00000000,0034F389), ref: 00342EFD

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00343A74, Relevance: 1.5, APIs: 1, Instructions: 23

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00343C76,00000000,00343E28,?,?,?,?,00000000), ref: 00343A87

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 003439A4, Relevance: 1.5, APIs: 1, Instructions: 13time

APIs

GetLocalTime.KERNEL32(?), ref: 003439AC

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00344440, Relevance: 1.5, APIs: 1, Instructions: 10

APIs

GetVersionExA.KERNEL32(?,00344D3C,00000000,00344D4A), ref: 0034444E

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034AFC9, Relevance: 1.0, Instructions: 984

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00347DCA, Relevance: .7, Instructions: 706

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00347200, Relevance: .3, Instructions: 253

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034DBD8, Relevance: .2, Instructions: 219

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00351331, Relevance: .2, Instructions: 209

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034D07E, Relevance: .2, Instructions: 162

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034D29E, Relevance: .2, Instructions: 161

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034D9FC, Relevance: .1, Instructions: 143

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034D566, Relevance: .1, Instructions: 125

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034D568, Relevance: .1, Instructions: 124

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 004021D8, Relevance: .1, Instructions: 94

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0034CCD1, Relevance: .1, Instructions: 79

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034CDD6, Relevance: .1, Instructions: 75

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034D4BC, Relevance: .1, Instructions: 66

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034C02C, Relevance: .0, Instructions: 40

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00407D92, Relevance: .0, Instructions: 2

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0040EF78, Relevance: 28.9, Strings: 23, Instructions: 141

Strings

VarDiv, xrefs: 0040F013
VarNot, xrefs: 0040EFBB
VarBstrFromDate, xrefs: 0040F147
VarMod, xrefs: 0040F03F
VarCyFromStr, xrefs: 0040F105
oleaut32.dll, xrefs: 0040EF7C
VarXor, xrefs: 0040F081
VarCmp, xrefs: 0040F097
VarAnd, xrefs: 0040F055
VarR8FromStr, xrefs: 0040F0D9
VarIdiv, xrefs: 0040F029
VarOr, xrefs: 0040F06B
VarMul, xrefs: 0040EFFD
VarDateFromStr, xrefs: 0040F0EF
VarR4FromStr, xrefs: 0040F0C3
VarAdd, xrefs: 0040EFD1
VarNeg, xrefs: 0040EFA5
VarSub, xrefs: 0040EFE7
VarBoolFromStr, xrefs: 0040F11B
VariantChangeTypeEx, xrefs: 0040EF8F
VarI4FromStr, xrefs: 0040F0AD
VarBstrFromCy, xrefs: 0040F131
VarBstrFromBool, xrefs: 0040F15D

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0034ED70, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 71window

APIs

GetWindowTextA.USER32(?,?,00000100), ref: 0034ED8C
GetClassNameA.USER32(?,?,00000100), ref: 0034EDA6
FindWindowExA.USER32(?,00000000,SysListView32,00000000), ref: 0034EDF3
SendMessageA.USER32(?,00001009,00000000,00000000), ref: 0034EE08
SendMessageA.USER32(?,0000000F,00000000,00000000), ref: 0034EE17
SendMessageA.USER32(?,00000002,00000000,00000000), ref: 0034EE23
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 0034EE2F

Strings

T4, xrefs: 0034EDB8
SysListView32, xrefs: 0034EDEB

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00341BBF, Relevance: 15.1, APIs: 10, Instructions: 122file

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00341C46
GetFileSize.KERNEL32(?,00000000), ref: 00341C6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000), ref: 00341C86
ReadFile.KERNEL32(?,?,00000080,?,00000000), ref: 00341CA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00341CD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00341CDA
GetStdHandle.KERNEL32(000000F5), ref: 00341CFA
GetFileType.KERNEL32 ref: 00341D11
CloseHandle.KERNEL32 ref: 00341D2C
GetLastError.KERNEL32(000000F5), ref: 00341D46

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0041016C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00410205
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00410221
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0041025A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004102D7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004102F0
VariantCopy.OLEAUT32(?), ref: 00410325

Strings

, xrefs: 00410186

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0033F94C, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59

APIs

RtlEnterCriticalSection.NTDLL(`0), ref: 0033F979
LocalFree.KERNEL32(00360F80,00000000,0033FA24), ref: 0033F98B
VirtualFree.KERNEL32(013E0000,00000000,00008000,00360F80,00000000,0033FA24), ref: 0033F9AA
LocalFree.KERNEL32(003625D0,013E0000,00000000,00008000,00360F80,00000000,0033FA24), ref: 0033F9E9
RtlLeaveCriticalSection.NTDLL(`0), ref: 0033FA14
RtlDeleteCriticalSection.NTDLL(`0), ref: 0033FA1E

Strings

`0, xrefs: 0033F974, 0033FA0F, 0033FA19

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00402644, Relevance: 11.5, Strings: 9, Instructions: 254

Strings

7, xrefs: 004027B5
Unknown, xrefs: 004028A0
An unexpected memory leak has occurred. , xrefs: 004027A4
The unexpected small block leaks are:, xrefs: 0040281B
bytes: , xrefs: 00402871
String, xrefs: 004028B5
, xrefs: 00402928
Unexpected Memory Leak, xrefs: 004029D4
The sizes of unexpected leaked medium and large blocks are: , xrefs: 0040295D

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00403020, Relevance: 11.4, Strings: 9, Instructions: 110

Strings

", xrefs: 00403078
", xrefs: 004030E0
", xrefs: 0040303D
", xrefs: 00403054
, xrefs: 00403038
, xrefs: 0040310D
", xrefs: 00403042
", xrefs: 004030B3
, xrefs: 0040309C

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00343BE0, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00343E28,?,?,?,?,00000000,00000000,00000000), ref: 00343BFA

Part of subcall function 00343A28: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00343A46

Part of subcall function 00343A74: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00343C76,00000000,00343E28,?,?,?,?,00000000), ref: 00343A87

Strings

:mm:ss, xrefs: 00343DF6
m/d/yy, xrefs: 00343CC9
mmmm d, yyyy, xrefs: 00343CEB
:mm, xrefs: 00343DDC
AMPM, xrefs: 00343DC5

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034112C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66memory

APIs

TlsAlloc.KERNEL32(0000001B,?,003515BF), ref: 003410D0
TlsFree.KERNEL32(0000001B,?,003515BF), ref: 00341124

Part of subcall function 003410F0: TlsGetValue.KERNEL32(0000001B,00341115,?,003515BF), ref: 003410FF
Part of subcall function 003410F0: LocalFree.KERNEL32(00000000,0000001B,00341115,?,003515BF), ref: 00341109

Part of subcall function 00341044: LocalAlloc.KERNEL32(00000040,00000008,?,003410AC,0000001B,0034244B,00000000,003424B2), ref: 0034105F
Part of subcall function 00341044: TlsSetValue.KERNEL32(0000001B,00000000,00000040,00000008,?,003410AC,0000001B,0034244B,00000000,003424B2), ref: 0034107D

Strings

8|0, xrefs: 00341082

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0033F888, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48memory

APIs

RtlInitializeCriticalSection.NTDLL(`0), ref: 0033F89E
RtlEnterCriticalSection.NTDLL(`0), ref: 0033F8B1
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,0033F93E), ref: 0033F8DB
RtlLeaveCriticalSection.NTDLL(`0), ref: 0033F938

Strings

`0, xrefs: 0033F899, 0033F8AC, 0033F933

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0033FF44, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122

APIs

RtlEnterCriticalSection.NTDLL(`0), ref: 0033FF87
RtlLeaveCriticalSection.NTDLL(`0), ref: 003400B2

Part of subcall function 0033F888: RtlInitializeCriticalSection.NTDLL(`0), ref: 0033F89E
Part of subcall function 0033F888: RtlEnterCriticalSection.NTDLL(`0), ref: 0033F8B1
Part of subcall function 0033F888: LocalAlloc.KERNEL32(00000000,00000FF8,00000000,0033F93E), ref: 0033F8DB
Part of subcall function 0033F888: RtlLeaveCriticalSection.NTDLL(`0), ref: 0033F938

Strings

', xrefs: 0033FF6E
`0, xrefs: 0033FF82, 003400AD

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00341E2A, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72window

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00341EC5

Part of subcall function 0033F94C: RtlEnterCriticalSection.NTDLL(`0), ref: 0033F979
Part of subcall function 0033F94C: LocalFree.KERNEL32(00360F80,00000000,0033FA24), ref: 0033F98B
Part of subcall function 0033F94C: VirtualFree.KERNEL32(013E0000,00000000,00008000,00360F80,00000000,0033FA24), ref: 0033F9AA
Part of subcall function 0033F94C: LocalFree.KERNEL32(003625D0,013E0000,00000000,00008000,00360F80,00000000,0033FA24), ref: 0033F9E9
Part of subcall function 0033F94C: RtlLeaveCriticalSection.NTDLL(`0), ref: 0033FA14
Part of subcall function 0033F94C: RtlDeleteCriticalSection.NTDLL(`0), ref: 0033FA1E

ExitProcess.KERNEL32 ref: 00341F0D

Strings

Runtime error at 00000000, xrefs: 00341EBE, 00341ED1
Error, xrefs: 00341EB9

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 004146C0, Relevance: 6.3, Strings: 5, Instructions: 85

Strings

LH, xrefs: 00414798
Any, xrefs: 0041472A
String, xrefs: 00414712
Array , xrefs: 004147B0
ByRef , xrefs: 004147C3

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00407C1D, Relevance: 6.3, Strings: 5, Instructions: 54

Strings

MouseZ, xrefs: 00407C27
MSH_WHEELSUPPORT_MSG, xrefs: 00407C42
MSH_SCROLL_LINES_MSG, xrefs: 00407C4E
MSWHEEL_ROLLMSG, xrefs: 00407C33
Magellan MSWHEEL, xrefs: 00407C22

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0040FECC, Relevance: 6.1, APIs: 4, Instructions: 115

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0040FF7B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0040FF97
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0041000E
VariantClear.OLEAUT32(?), ref: 00410037

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 00342E44, Relevance: 6.0, APIs: 4, Instructions: 39timefile

APIs

FindNextFileA.KERNEL32(?,?), ref: 00342E54
GetLastError.KERNEL32(?,?), ref: 00342E5D
FileTimeToLocalFileTime.KERNEL32(?), ref: 00342E71
FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 00342E80

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 003400CC, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118

APIs

RtlEnterCriticalSection.NTDLL(`0), ref: 00340120
RtlLeaveCriticalSection.NTDLL(`0), ref: 00340258

Part of subcall function 0033F888: RtlInitializeCriticalSection.NTDLL(`0), ref: 0033F89E
Part of subcall function 0033F888: RtlEnterCriticalSection.NTDLL(`0), ref: 0033F8B1
Part of subcall function 0033F888: LocalAlloc.KERNEL32(00000000,00000FF8,00000000,0033F93E), ref: 0033F8DB
Part of subcall function 0033F888: RtlLeaveCriticalSection.NTDLL(`0), ref: 0033F938

Strings

`0, xrefs: 0034011B, 00340253

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0034F39C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,0034F4B1), ref: 0034F3DF

Part of subcall function 003439A4: GetLocalTime.KERNEL32(?), ref: 003439AC

Strings

\user.dat, xrefs: 0034F42A
\pagefile.sys, xrefs: 0034F45E

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00340440, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70

APIs

RtlEnterCriticalSection.NTDLL(`0), ref: 00340483

Part of subcall function 0033FF44: RtlEnterCriticalSection.NTDLL(`0), ref: 0033FF87
Part of subcall function 0033FF44: RtlLeaveCriticalSection.NTDLL(`0), ref: 003400B2

RtlLeaveCriticalSection.NTDLL(`0), ref: 003404EC

Part of subcall function 003400CC: RtlEnterCriticalSection.NTDLL(`0), ref: 00340120
Part of subcall function 003400CC: RtlLeaveCriticalSection.NTDLL(`0), ref: 00340258

Part of subcall function 0033F888: RtlInitializeCriticalSection.NTDLL(`0), ref: 0033F89E
Part of subcall function 0033F888: RtlEnterCriticalSection.NTDLL(`0), ref: 0033F8B1
Part of subcall function 0033F888: LocalAlloc.KERNEL32(00000000,00000FF8,00000000,0033F93E), ref: 0033F8DB
Part of subcall function 0033F888: RtlLeaveCriticalSection.NTDLL(`0), ref: 0033F938

Strings

`0, xrefs: 0034047E, 003404E7

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 00346AF0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25thread

APIs

GetCurrentThreadId.KERNEL32 ref: 00346B3E

Strings

0U4, xrefs: 00346B0D
|S4, xrefs: 00346AFC, 00346B1E, 00346B2F, 00346B4A

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0033FA29, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 8

APIs

RtlLeaveCriticalSection.NTDLL(`0), ref: 0033FA14
RtlDeleteCriticalSection.NTDLL(`0), ref: 0033FA1E

Strings

`0, xrefs: 0033FA0F, 0033FA19

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Function 0041AFB0, Relevance: 5.1, Strings: 4, Instructions: 105

Strings

8NA, xrefs: 0041B057
ZA, xrefs: 0041B05F
@NA, xrefs: 0041B0BC
H[A, xrefs: 0041B0C4

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041B788, Relevance: 5.1, Strings: 4, Instructions: 71

Strings

Owner, xrefs: 0041B7E8
., xrefs: 0041B7FF
-, xrefs: 0041B805
>, xrefs: 0041B80B

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0041CCC4, Relevance: 5.0, Strings: 4, Instructions: 48

Strings

False, xrefs: 0041CD45
Null, xrefs: 0041CD6F
True, xrefs: 0041CD53
nil, xrefs: 0041CD61

Memory Dump Source

Source File: 00000001.00000002.425442085.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.425433026.00400000.00000002.sdmp
Associated: 00000001.00000002.425672453.00499000.00000008.sdmp
Associated: 00000001.00000002.425680765.004A4000.00000008.sdmp
Associated: 00000001.00000002.425739783.004C3000.00000008.sdmp
Associated: 00000001.00000002.426892348.00614000.00000004.sdmp
Associated: 00000001.00000002.426904799.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_DOC000YUT600.jbxd

Function 0034E31C, Relevance: 5.0, Strings: 4, Instructions: 22

Strings

0U4, xrefs: 0034E340
0U4, xrefs: 0034E330
0U4, xrefs: 0034E348
0U4, xrefs: 0034E338

Memory Dump Source

Source File: 00000001.00000003.419010716.0033D000.00000004.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_33d000_DOC000YUT600.jbxd

Analysis Process: regdrv.exe PID: 3452 Parent PID: 3420

Executed Functions

Function 0040D9E0, Relevance: 7.7, Strings: 6, Instructions: 201

Strings

:mm:ss, xrefs: 0040DC66
mmmm d, yyyy, xrefs: 0040DB12
:mm, xrefs: 0040DC49
m/d/yy, xrefs: 0040DAE5
AMPM, xrefs: 0040DC2A
AMPM , xrefs: 0040DC39

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00406554, Relevance: 2.7, Strings: 2, Instructions: 184

Strings

Software\Borland\Delphi\Locales, xrefs: 004065C0
Software\Borland\Locales, xrefs: 00406584, 004065A2

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00418184, Relevance: 1.3, Strings: 1, Instructions: 52

Strings

hmA, xrefs: 004181A6

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0040706A, Relevance: 1.1, Instructions: 1111

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041D6FC, Relevance: .2, Instructions: 190

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041C7F0, Relevance: .2, Instructions: 176

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00401BA0, Relevance: .2, Instructions: 174

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0040D1EE, Relevance: .1, Instructions: 78

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041CAA0, Relevance: .1, Instructions: 69

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0040D91C, Relevance: .1, Instructions: 56

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041801C, Relevance: .1, Instructions: 53

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041FCA0, Relevance: .1, Instructions: 52

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041822C, Relevance: .0, Instructions: 46

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00407B64, Relevance: .0, Instructions: 44

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00407BBC, Relevance: .0, Instructions: 43

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00404BCC, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041CA30, Relevance: .0, Instructions: 40

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00415110, Relevance: .0, Instructions: 39

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 004016E0, Relevance: .0, Instructions: 38

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00406E30, Relevance: .0, Instructions: 32

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041AE48, Relevance: .0, Instructions: 29

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 004062F0, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 004017FA, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00419CD4, Relevance: .0, Instructions: 25

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00404C35, Relevance: .0, Instructions: 19

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041FC76, Relevance: .0, Instructions: 15

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00404C34, Relevance: .0, Instructions: 12

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041F058, Relevance: .0, Instructions: 3

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Non-executed Functions

Function 004021D8, Relevance: .1, Instructions: 94

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0040EF78, Relevance: 28.9, Strings: 23, Instructions: 141

Strings

VarR4FromStr, xrefs: 0040F0C3
VarBoolFromStr, xrefs: 0040F11B
VarNot, xrefs: 0040EFBB
VarNeg, xrefs: 0040EFA5
oleaut32.dll, xrefs: 0040EF7C
VarMul, xrefs: 0040EFFD
VarBstrFromCy, xrefs: 0040F131
VarXor, xrefs: 0040F081
VarAdd, xrefs: 0040EFD1
VarCmp, xrefs: 0040F097
VarIdiv, xrefs: 0040F029
VarSub, xrefs: 0040EFE7
VarDiv, xrefs: 0040F013
VarMod, xrefs: 0040F03F
VarAnd, xrefs: 0040F055
VarI4FromStr, xrefs: 0040F0AD
VariantChangeTypeEx, xrefs: 0040EF8F
VarR8FromStr, xrefs: 0040F0D9
VarDateFromStr, xrefs: 0040F0EF
VarBstrFromBool, xrefs: 0040F15D
VarOr, xrefs: 0040F06B
VarBstrFromDate, xrefs: 0040F147
VarCyFromStr, xrefs: 0040F105

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041016C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00410205
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00410221
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0041025A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004102D7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004102F0
VariantCopy.OLEAUT32(?), ref: 00410325

Strings

, xrefs: 00410186

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00402644, Relevance: 11.5, Strings: 9, Instructions: 254

Strings

Unknown, xrefs: 004028A0
The sizes of unexpected leaked medium and large blocks are: , xrefs: 0040295D
The unexpected small block leaks are:, xrefs: 0040281B
, xrefs: 00402928
An unexpected memory leak has occurred. , xrefs: 004027A4
bytes: , xrefs: 00402871
String, xrefs: 004028B5
Unexpected Memory Leak, xrefs: 004029D4
7, xrefs: 004027B5

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00403020, Relevance: 11.4, Strings: 9, Instructions: 110

Strings

", xrefs: 0040303D
", xrefs: 004030E0
, xrefs: 0040309C
", xrefs: 004030B3
", xrefs: 00403078
", xrefs: 00403042
, xrefs: 00403038
", xrefs: 00403054
, xrefs: 0040310D

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 004146C0, Relevance: 6.3, Strings: 5, Instructions: 85

Strings

ByRef , xrefs: 004147C3
Any, xrefs: 0041472A
LH, xrefs: 00414798
String, xrefs: 00414712
Array , xrefs: 004147B0

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 00407C1D, Relevance: 6.3, Strings: 5, Instructions: 54

Strings

MSWHEEL_ROLLMSG, xrefs: 00407C33
MSH_WHEELSUPPORT_MSG, xrefs: 00407C42
MouseZ, xrefs: 00407C27
MSH_SCROLL_LINES_MSG, xrefs: 00407C4E
Magellan MSWHEEL, xrefs: 00407C22

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0040FECC, Relevance: 6.1, APIs: 4, Instructions: 115

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0040FF7B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0040FF97
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0041000E
VariantClear.OLEAUT32(?), ref: 00410037

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041AFB0, Relevance: 5.1, Strings: 4, Instructions: 105

Strings

ZA, xrefs: 0041B05F
8NA, xrefs: 0041B057
H[A, xrefs: 0041B0C4
@NA, xrefs: 0041B0BC

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041B788, Relevance: 5.1, Strings: 4, Instructions: 71

Strings

>, xrefs: 0041B80B
-, xrefs: 0041B805
Owner, xrefs: 0041B7E8
., xrefs: 0041B7FF

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Function 0041CCC4, Relevance: 5.0, Strings: 4, Instructions: 48

Strings

True, xrefs: 0041CD53
nil, xrefs: 0041CD61
Null, xrefs: 0041CD6F
False, xrefs: 0041CD45

Memory Dump Source

Source File: 00000002.00000002.451222330.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.451212243.00400000.00000002.sdmp
Associated: 00000002.00000002.451327316.00499000.00000008.sdmp
Associated: 00000002.00000002.451336597.004A4000.00000008.sdmp
Associated: 00000002.00000002.451363863.004C3000.00000008.sdmp
Associated: 00000002.00000002.451611285.00614000.00000004.sdmp
Associated: 00000002.00000002.451621919.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_regdrv.jbxd

Analysis Process: regdrv.exe PID: 3468 Parent PID: 3452

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	1663
Total number of Limit Nodes:	42

Executed Functions

Function 004818F8, Relevance: 49.2, APIs: 10, Strings: 18, Instructions: 236
keyboard

Control-flow Graph

Executed
Not Executed

APIs

CallNextHookEx.USER32(000601F9,00000000,?,?), ref: 00481948

Part of subcall function 004818E0: MapVirtualKeyA.USER32(00000000,00000000), ref: 004818E6

CallNextHookEx.USER32(000601F9,00000000,00000100,?), ref: 0048198C
GetKeyState.USER32(00000014), ref: 00481C4E
GetKeyState.USER32(00000011), ref: 00481C60
GetKeyState.USER32(000000A0), ref: 00481C75
GetKeyState.USER32(000000A1), ref: 00481C8A
GetKeyboardState.USER32(?), ref: 00481CA5
MapVirtualKeyA.USER32(00000000,00000000), ref: 00481CD7
ToAscii.USER32(00000000,00000000,00000000,00000000,?), ref: 00481CDE

Part of subcall function 00481318: ExitThread.KERNEL32(00000000,00000000,00481687,?,00000000,004816C3,?,?,?,?,0000000C,00000000,00000000), ref: 0048135E
Part of subcall function 00481318: CreateThread.KERNEL32(00000000,00000000,Function_000810D4,00000000,00000000,00499F94), ref: 0048162D

CallNextHookEx.USER32(000601F9,00000000,?,?), ref: 00481D3C

Strings

[LEFT], xrefs: 00481C07
[F3], xrefs: 00481B65
[DOWN], xrefs: 00481C2B
[<-], xrefs: 00481B1D
[NUM_LOCK], xrefs: 00481B2F
[RIGHT], xrefs: 00481C19
[F7], xrefs: 00481BAD
[DEL], xrefs: 00481BD1
[UP], xrefs: 00481C3D
[F4], xrefs: 00481B77
[ESC], xrefs: 00481AE7
[F8], xrefs: 00481BBF
[F5], xrefs: 00481B89
[F1], xrefs: 00481B41
[INS], xrefs: 00481BE3
[F6], xrefs: 00481B9B
[SNAPSHOT], xrefs: 00481BF5
[F2], xrefs: 00481B53

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00406C2C, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibrary

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,00400000,004917C0), ref: 00406C48
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00400000,004917C0), ref: 00406C66
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00400000,004917C0), ref: 00406C84
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00406CA2

Part of subcall function 00406A68: GetModuleHandleA.KERNEL32(kernel32.dll,?,00400000,004917C0), ref: 00406A85
Part of subcall function 00406A68: GetProcAddress.KERNEL32(?,GetLongPathNameA,kernel32.dll,?,00400000,004917C0), ref: 00406A9C
Part of subcall function 00406A68: lstrcpynA.KERNEL32(?,?,?,?,00400000,004917C0), ref: 00406ACC
Part of subcall function 00406A68: lstrcpynA.KERNEL32(?,?,?,kernel32.dll,?,00400000,004917C0), ref: 00406B30
Part of subcall function 00406A68: lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,00400000,004917C0), ref: 00406B66
Part of subcall function 00406A68: FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,00400000,004917C0), ref: 00406B79
Part of subcall function 00406A68: FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,00400000,004917C0), ref: 00406B8B
Part of subcall function 00406A68: lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,00400000,004917C0), ref: 00406B97
Part of subcall function 00406A68: lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,00400000), ref: 00406BCB
Part of subcall function 00406A68: lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll), ref: 00406BD7
Part of subcall function 00406A68: lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 00406BF9

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00406D31,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00406CEB
RegQueryValueExA.ADVAPI32(?,00406E98,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00406D31,?,80000001), ref: 00406D09
RegCloseKey.ADVAPI32(?,00406D38,00000000,?,?,00000000,00406D31,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00406D2B
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00406D48
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00406D55
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00406D5B
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00406D86
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00406DCD
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00406DDD
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00406E05
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00406E15
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00406E3B
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 00406E4B

Strings

Software\Borland\Locales, xrefs: 00406C5C, 00406C7A
Software\Borland\Delphi\Locales, xrefs: 00406C98

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004865E0, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 218
networkwindowsleep

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000000C8), ref: 00486682
TranslateMessage.USER32(?), ref: 00486690
DispatchMessageA.USER32(?), ref: 0048669C
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004866B0
socket.WSOCK32(00000002,00000001,00000000,?,00000000,00000000,00000000,00000001,000000C8), ref: 004866CE
ntohs.WSOCK32(00000774,00000002,00000001,00000000,?,00000000,00000000,00000000,00000001,000000C8), ref: 004866F8
inet_addr.WSOCK32(015EAA88,00000774,00000002,00000001,00000000,?,00000000,00000000,00000000,00000001,000000C8), ref: 00486709
gethostbyname.WSOCK32(015EAA88,015EAA88,00000774,00000002,00000001,00000000,?,00000000,00000000,00000000,00000001,000000C8), ref: 0048671F
connect.WSOCK32(00000248,00000002,00000010,015EAA88,00000774,00000002,00000001,00000000,?,00000000,00000000,00000000,00000001,000000C8), ref: 00486744

Part of subcall function 0041FA34: GetLastError.KERNEL32(00486514,00000004,0048650C,00000000,0041FADE,?,00499F5C), ref: 0041FA94

Part of subcall function 0041FC40: SetThreadPriority.KERNEL32(?,015CDB28,00499F5C,?,0047EC9E,?,?,?,00000000,00000000,?,0049062B), ref: 0041FC55

Part of subcall function 0041FEF0: ResumeThread.KERNEL32(?,00499F5C,?,0047ECAA,?,?,?,00000000,00000000,?,0049062B), ref: 0041FEF8

recv.WSOCK32(00000248,?,00002000,00000000,00000248,00000002,00000010,015EAA88,00000774,00000002,00000001,00000000,?,00000000,00000000,00000000), ref: 004867CD
shutdown.WSOCK32(00000248,00000001,00000248,00000002,00000010,015EAA88,00000774,00000002,00000001,00000000,?,00000000,00000000,00000000,00000001,000000C8), ref: 00486881
closesocket.WSOCK32(00000248,00000248,00000001,00000248,00000002,00000010,015EAA88,00000774,00000002,00000001,00000000,?,00000000,00000000,00000000,00000001), ref: 0048688E

Part of subcall function 00405D40: SysFreeString.OLEAUT32(?), ref: 00405D53

Part of subcall function 00486528: shutdown.WSOCK32(00000248,00000002,00000001,004867E2,00000248,?,00002000,00000000,00000248,00000002,00000010,015EAA88,00000774,00000002,00000001,00000000), ref: 004865BC
Part of subcall function 00486528: closesocket.WSOCK32(00000248,00000248,00000002,00000001,004867E2,00000248,?,00002000,00000000,00000248,00000002,00000010,015EAA88,00000774,00000002,00000001), ref: 004865C9

Strings

AI, xrefs: 0048681D
`cH, xrefs: 00486760

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00406D38, Relevance: 15.1, APIs: 10, Instructions: 98
stringlibrarythread

Control-flow Graph

Executed
Not Executed

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00406D48
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00406D55
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00406D5B
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00406D86
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00406DCD
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00406DDD
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00406E05
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00406E15
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00406E3B
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 00406E4B

Strings

Software\Borland\Locales, xrefs: 00406C5C, 00406C7A
Software\Borland\Delphi\Locales, xrefs: 00406C98

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048AEA8, Relevance: 9.1, APIs: 6, Instructions: 108

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000,0048AFAF,?,00000000,0048AFD6,?,00000000,?,00000000), ref: 0048AEFF
OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0048AFAF,?,00000000,0048AFD6,?,00000000,?,00000000), ref: 0048AF05
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0048AF2F
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,?,00000000,0048AF93,?,00000000,00000028,?,00000000,0048AFAF,?,00000000), ref: 0048AF77
CloseHandle.KERNEL32(?), ref: 0048AF8D
GetLastError.KERNEL32(00000000,00000028,?,00000000,0048AFAF,?,00000000,0048AFD6,?,00000000,?,00000000), ref: 0048AF9A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048DDE0, Relevance: 7.6, APIs: 5, Instructions: 54

APIs

FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 0048DE1A
LoadResource.KERNEL32(00000000,00000000,00000000,0048DE71,?,?,?,015D5070), ref: 0048DE24
SizeofResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,0048DE71,?,?,?,015D5070), ref: 0048DE2E
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,0048DE71,?,?,?,015D5070), ref: 0048DE36
FreeResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0048DE71,?,?,?,015D5070), ref: 0048DE51

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00481ED8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00482007,?,?,00000003,00000000,00000000,?,00482033), ref: 00481EFB
SetWindowsHookExA.USER32(0000000D,004818F8,00000000,00000000), ref: 00481F09

Part of subcall function 0048ADCC: SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0048ADF9
Part of subcall function 0048ADCC: SHGetPathFromIDListA.SHELL32(?,?,00000000,0048AE8C,?,?,00000005,?,004856FD,00000000,00485755,?,?,00000005,00000000,00000000), ref: 0048AE09

Part of subcall function 0040A290: GetFileAttributesA.KERNEL32(00000000,?,0048FD09,?,?,00490710,?), ref: 0040A29B

Part of subcall function 00480F70: GetForegroundWindow.USER32 ref: 00480F8F
Part of subcall function 00480F70: GetWindowTextLengthA.USER32(00000000), ref: 00480F9B
Part of subcall function 00480F70: GetWindowTextA.USER32(00000000,00000000,00000001), ref: 00480FB8

Strings

dclogs\, xrefs: 00481F26, 00481F4C, 00481F6E
3 H, xrefs: 00481F16, 00481F23, 00481F30

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048CE74, Relevance: 1.5, APIs: 1, Instructions: 19

APIs

GetUserNameA.ADVAPI32(?), ref: 0048CE8A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048FA10, Relevance: 104.0, APIs: 13, Strings: 46, Instructions: 713
sleepfilethread

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0048B724: GetCurrentHwProfileA.ADVAPI32(?), ref: 0048B776

Part of subcall function 0040A26C: GetFileAttributesA.KERNEL32(00000000,?,0048F947,.dcp,?,?,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040A277

Part of subcall function 0040F234: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,?,0048F90F,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040F24B

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0048FD52
CopyFileA.KERNEL32(00000000,00000000,?), ref: 0048FE2F

Part of subcall function 00485150: RegOpenKeyA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 00485199
Part of subcall function 00485150: RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,?,00000000,004851DE,?,00000000,0048520A), ref: 004851C6
Part of subcall function 00485150: RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,?,00000000,004851DE,?,00000000,0048520A), ref: 004851CF

Part of subcall function 0048C308: CloseHandle.KERNEL32(?), ref: 0048C390

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0048FF7A

Part of subcall function 004729DC: SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00472B0D,?,?,00000000,?,00000000,00000000,00472BD6,?,00000000,00472C12), ref: 00472AFE

ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 00490298

Part of subcall function 00472924: SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00472969,?,?,?,?,00490051), ref: 0047294E

Sleep.KERNEL32(000003E8), ref: 004902A2

Part of subcall function 00472974: SetFileAttributesA.KERNEL32(00000000,00000000,00000000,004729D0), ref: 004729B0

Part of subcall function 0046D36C: ShellExecuteA.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 0046D3B9

Sleep.KERNEL32(000001F4), ref: 004901DD
ExitProcess.KERNEL32(00000000,000003E8), ref: 004902A9

Part of subcall function 00474F80: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0047500B
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?,00000000,00475246), ref: 0047511C
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?,00000000,00475246), ref: 00475122
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?,00000000), ref: 00475133
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 00475139
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000), ref: 0047514B
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000), ref: 00475151
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000), ref: 00475163
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000), ref: 00475169
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000), ref: 0047517B
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000), ref: 00475181
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32), ref: 00475193
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000), ref: 00475199
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32), ref: 004751AB
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000), ref: 004751B1
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32), ref: 004751C3
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000), ref: 004751C9
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32), ref: 004751DB
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000), ref: 004751E1
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,OpenProcess,00000000,kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32), ref: 004751F3
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,OpenProcess,00000000,kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000), ref: 004751F9
Part of subcall function 00474F80: GetModuleHandleA.KERNEL32(kernel32,GetExitCodeProcess,00000000,kernel32,OpenProcess,00000000,kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32), ref: 0047520B
Part of subcall function 00474F80: GetProcAddress.KERNEL32(00000000,kernel32,GetExitCodeProcess,00000000,kernel32,OpenProcess,00000000,kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000), ref: 00475211

Part of subcall function 0040A290: GetFileAttributesA.KERNEL32(00000000,?,0048FD09,?,?,00490710,?), ref: 0040A29B

CreateThread.KERNEL32(00000000,00000000,0048E340,00000000,00000000,00499F94), ref: 004902E3
CreateThread.KERNEL32(00000000,00000000,0048E29C,00000000,00000000,00499F94), ref: 0049031D
SetLastError.KERNEL32(00000000,?,00490710,?), ref: 0049046F

Part of subcall function 00407978: CreateMutexA.KERNEL32(?,?,?,?,0049048A,00000000,00000000,00000000,00000000,?,00490710,?), ref: 0040798E

GetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,00490710,?), ref: 0049048A
ExitProcess.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00490710,?), ref: 00490498
Sleep.KERNEL32(000001F4,00000000,00000000,00000000,00000000,?,00490710,?), ref: 004904EB

Part of subcall function 004754C4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 00475590
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,LoadLibraryA,00000000,00475829,?,?,?,?,?,00490626), ref: 004756B4
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,LoadLibraryA,00000000,00475829,?,?,?,?,?,00490626), ref: 004756BA
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829,?,?,?,?,?,00490626), ref: 004756CB
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829,?,?,?,?,?,00490626), ref: 004756D1
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829,?,?,?,?,?,00490626), ref: 004756E3
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829), ref: 004756E9
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829), ref: 004756FB
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829), ref: 00475701
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829), ref: 00475713
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000), ref: 00475719
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32), ref: 0047572B
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000), ref: 00475731
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32), ref: 00475743
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000), ref: 00475749
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32), ref: 0047575B
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000), ref: 00475761
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32), ref: 00475773
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000), ref: 00475779
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32), ref: 0047578B
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000), ref: 00475791
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32), ref: 004757A3
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000), ref: 004757A9
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32), ref: 004757BB
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000), ref: 004757C1
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,WaitForSingleObject,00000000,kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32), ref: 004757D3
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,WaitForSingleObject,00000000,kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000), ref: 004757D9
Part of subcall function 004754C4: GetModuleHandleA.KERNEL32(kernel32,OpenProcess,00000000,kernel32,WaitForSingleObject,00000000,kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32), ref: 004757EB
Part of subcall function 004754C4: GetProcAddress.KERNEL32(00000000,kernel32,OpenProcess,00000000,kernel32,WaitForSingleObject,00000000,kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000), ref: 004757F1

Part of subcall function 0047EAEC: CreateThread.KERNEL32(00000000,00000000,00482028,00000000,00000000,00499F94), ref: 0047EB8D
Part of subcall function 0047EAEC: TranslateMessage.USER32(00499F5C), ref: 0047ECAD
Part of subcall function 0047EAEC: DispatchMessageA.USER32(00499F5C), ref: 0047ECB3
Part of subcall function 0047EAEC: GetMessageA.USER32(00499F5C,00000000,00000000,00000000), ref: 0047ECBF

Part of subcall function 00473C24: ExitProcess.KERNEL32(00000000,00000000,00473CF8,?,?,00000000,00000000,00000000,?,00490560,00000000,00000000,00000000,00000000,?,00490710), ref: 00473C8E
Part of subcall function 00473C24: ExitProcess.KERNEL32(00000000,00000000,00473CF8,?,?,00000000,00000000,00000000,?,00490560,00000000,00000000,00000000,00000000,?,00490710), ref: 00473CD8

Part of subcall function 0048C5D0: EnumResourceNamesA.KERNEL32(00000000,DPLUG,0048C494,00000000), ref: 0048C5F2

Part of subcall function 0048BEE4: EnumResourceNamesA.KERNEL32(00000000,DBIND,0048BDD4,00000000), ref: 0048BF06

Part of subcall function 0040BC98: GetLocalTime.KERNEL32(?), ref: 0040BCA0

Part of subcall function 0040BCC4: GetLocalTime.KERNEL32(?), ref: 0040BCCC

Strings

CHIDEF, xrefs: 004900A1
SH7, xrefs: 004903D7
DIRATTRIB, xrefs: 00490057
" +s +h, xrefs: 004900D5, 00490191
,xI, xrefs: 0048FC6C
MULTIBIND, xrefs: 004904A3
SH8, xrefs: 004903FE
MULTIPLUGS, xrefs: 004904F6
FAKEMSG, xrefs: 0048FEF7
SH4, xrefs: 00490354
PLUGS, xrefs: 004901E8, 00490518
COMBOPATH, xrefs: 0048FB0F
NETDATA, xrefs: 0048FA28
AI, xrefs: 0048FADA, 0048FAEC, 00490474, 004905E5, 00490614
PERSINST, xrefs: 004902B4
Guest, xrefs: 0048FAA4
at , xrefs: 0048FC84
MSGCORE, xrefs: 0048FF51
open, xrefs: 00490291
SH9, xrefs: 00490425
CHANGEDATE, xrefs: 0048FEB3
MELT, xrefs: 00490245
SH5, xrefs: 00490380
OVDNS, xrefs: 0048FFAF
GENCODE, xrefs: 0048FB35, 0048FD65, 00490566
SH1, xrefs: 004902EE
attrib ", xrefs: 004900BD, 0049014E
SH3, xrefs: 00490328
MUTEX, xrefs: 0048FAB1
SH10, xrefs: 0049044C
MSGTITLE, xrefs: 0048FF35
FILEATTRIB, xrefs: 0049000D
CHIDED, xrefs: 004900FB
notepad, xrefs: 00490274, 004905F5, 0049061C
EDTPATH, xrefs: 0048FAFE
SID, xrefs: 0048FA64
BIND, xrefs: 004901B7, 004904C5
PERS, xrefs: 004905C0
MSGICON, xrefs: 0048FF19
SH6, xrefs: 004903B0
DCMUTEX, xrefs: 0048FAF1
KEYNAME, xrefs: 0048FE84
INSTALL, xrefs: 0048FCCC, 00490223
PDNS, xrefs: 0048FF85, 0048FFD1, 0048FFF0
EDTDATE, xrefs: 0048FED5
FWB, xrefs: 0049053F

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0047EAEC, Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 149
windowthread

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,00482028,00000000,00000000,00499F94), ref: 0047EB8D
GetMessageA.USER32(00499F5C,00000000,00000000,00000000), ref: 0047ECBF

Part of subcall function 0040BC98: GetLocalTime.KERNEL32(?), ref: 0040BCA0

Part of subcall function 0040BCC4: GetLocalTime.KERNEL32(?), ref: 0040BCCC

Part of subcall function 0041FA34: GetLastError.KERNEL32(00486514,00000004,0048650C,00000000,0041FADE,?,00499F5C), ref: 0041FA94

Part of subcall function 0041FC40: SetThreadPriority.KERNEL32(?,015CDB28,00499F5C,?,0047EC9E,?,?,?,00000000,00000000,?,0049062B), ref: 0041FC55

Part of subcall function 0041FEF0: ResumeThread.KERNEL32(?,00499F5C,?,0047ECAA,?,?,?,00000000,00000000,?,0049062B), ref: 0041FEF8

TranslateMessage.USER32(00499F5C), ref: 0047ECAD
DispatchMessageA.USER32(00499F5C), ref: 0047ECB3

Strings

OFFLINEK, xrefs: 0047EB61
,xI, xrefs: 0047EC45
AI, xrefs: 0047EB11, 0047EB3E
at , xrefs: 0047EC58
Unknow, xrefs: 0047EC0B
AI, xrefs: 0047EBFA, 0047EC04, 0047EC60
MPI, xrefs: 0047EB9D
PWD, xrefs: 0047EB26

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004458CC, Relevance: 19.9, APIs: 13, Instructions: 386
window

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00445780: SetThreadLocale.KERNEL32(00000400,?,?,?,0044593F,00000000,00445F57), ref: 004457A3

Part of subcall function 00445F90: SetActiveWindow.USER32(?), ref: 00445FB5
Part of subcall function 00445F90: IsWindowEnabled.USER32(00000000), ref: 00445FE1
Part of subcall function 00445F90: SetWindowPos.USER32(?,00000000,00000000,00000000,?,00000000,00000040), ref: 0044602B
Part of subcall function 00445F90: DefWindowProcA.USER32(?,00000112,0000F020,00000000), ref: 00446040

Part of subcall function 00446070: SetActiveWindow.USER32(?), ref: 0044608F
Part of subcall function 00446070: ShowWindow.USER32(00000000,00000009), ref: 004460B4
Part of subcall function 00446070: IsWindowEnabled.USER32(00000000), ref: 004460D3
Part of subcall function 00446070: DefWindowProcA.USER32(?,00000112,0000F120,00000000), ref: 004460EC
Part of subcall function 00446070: SetWindowPos.USER32(?,00000000,00000000,?,?,00445ABE,00000000), ref: 00446132
Part of subcall function 00446070: SetFocus.USER32(00000000), ref: 00446180

Part of subcall function 00445F74: LoadIconA.USER32(00000000,00007F00), ref: 00445F8A

PostMessageA.USER32(?,0000B001,00000000,00000000), ref: 00445BCD

Part of subcall function 00445490: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000213), ref: 004454DE

PostMessageA.USER32(?,0000B000,00000000,00000000), ref: 00445BAB
SendMessageA.USER32(?,?,?,?), ref: 00445C73

Part of subcall function 00405388: FreeLibrary.KERNEL32(00400000,?,?,?,00000001,0040546E,00403003,0040304A), ref: 00405410
Part of subcall function 00405388: ExitProcess.KERNEL32(00000000,?,?,?,00000001,0040546E,00403003,0040304A), ref: 00405448

Part of subcall function 0044641C: IsWindowEnabled.USER32(00000000), ref: 00446458

IsWindowEnabled.USER32(00000000), ref: 00445D18
IsWindowVisible.USER32(00000000), ref: 00445D2D
GetFocus.USER32 ref: 00445D41
SetFocus.USER32(00000000), ref: 00445D50
SetFocus.USER32(00000000), ref: 00445D6F
IsWindowEnabled.USER32(00000000), ref: 00445DD0
SetFocus.USER32(00000000), ref: 00445DF2
GetLastActivePopup.USER32(?), ref: 00445E0A

Part of subcall function 0043B75C: IsIconic.USER32(?), ref: 0043B773

GetFocus.USER32 ref: 00445E4F

Part of subcall function 0043BA80: GetCurrentThreadId.KERNEL32(Function_0003BA1C,00000000,0044283C,00000000,004428BF), ref: 0043BA9A
Part of subcall function 0043BA80: EnumThreadWindows.USER32(00000000,Function_0003BA1C,00000000), ref: 0043BAA0

SetFocus.USER32(00000000), ref: 00445E70

Part of subcall function 00446A88: PostMessageA.USER32(?,0000B01F,00000000,00000000), ref: 00446BA1

Part of subcall function 004466B8: SendMessageA.USER32(?,0000B020,00000001,?), ref: 004466DC

Part of subcall function 0044665C: SendMessageA.USER32(?,0000B020,00000000,?), ref: 0044667E

Part of subcall function 0045D684: SystemParametersInfoA.USER32(00000068,00000000,015E3408,00000000), ref: 0045D6C8
Part of subcall function 0045D684: SendMessageA.USER32(?,?,00000000,00000000), ref: 0045D6DB

Part of subcall function 00445844: DefWindowProcA.USER32(?,?,?,?), ref: 0044586E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004450B4, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 131
windowregistry

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00421084: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 004210A2

GetClassInfoA.USER32(00400000,00444D50,?), ref: 00445113
RegisterClassA.USER32(004925FC), ref: 0044512B

Part of subcall function 00407550: LoadStringA.USER32(00000000,00010000,?,00001000), ref: 00407582

Part of subcall function 0040857C: CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004085BB

SetWindowLongA.USER32(?,000000FC,?), ref: 004451C2
DeleteMenu.USER32(00000000,0000F010,00000000), ref: 00445235

Part of subcall function 00445F74: LoadIconA.USER32(00000000,00007F00), ref: 00445F8A

SendMessageA.USER32(?,00000080,00000001,00000000), ref: 004451E4
SetClassLongA.USER32(?,000000F2,00000000), ref: 004451F7
GetSystemMenu.USER32(?,00000000), ref: 00445202
DeleteMenu.USER32(00000000,0000F030,00000000), ref: 00445211
DeleteMenu.USER32(00000000,0000F000,00000000), ref: 0044521E

Strings

PMD, xrefs: 00445107, 0044519E
LPI, xrefs: 004450DD

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0045DAE0, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 103
registrylibraryloader

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,00000000,0045DC58), ref: 0045DB01
GlobalAddAtomA.KERNEL32(00000000), ref: 0045DB34
GetCurrentThreadId.KERNEL32(?,?,00000000,0045DC58), ref: 0045DB4F
GlobalAddAtomA.KERNEL32(00000000), ref: 0045DB85
RegisterWindowMessageA.USER32(00000000,00000000,?,?,00000000,0045DC58), ref: 0045DB9B

Part of subcall function 00419AB0: InitializeCriticalSection.KERNEL32(004174C8,?,?,0045DBB1,00000000,00000000,?,?,00000000,0045DC58), ref: 00419ACF

Part of subcall function 0045D6E8: SetErrorMode.KERNEL32(00008000), ref: 0045D701
Part of subcall function 0045D6E8: GetModuleHandleA.KERNEL32(USER32,00000000,0045D84E,?,00008000), ref: 0045D725
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,WINNLSEnableIME,USER32,00000000,0045D84E,?,00008000), ref: 0045D732
Part of subcall function 0045D6E8: LoadLibraryA.KERNEL32(imm32.dll), ref: 0045D74E
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,ImmGetContext,imm32.dll,00000000,0045D84E,?,00008000), ref: 0045D770
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,0045D84E,?,00008000), ref: 0045D785
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,0045D84E,?,00008000), ref: 0045D79A
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,0045D84E,?,00008000), ref: 0045D7AF
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,0045D84E,?,00008000), ref: 0045D7C4
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,0045D84E), ref: 0045D7D9
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000), ref: 0045D7EE
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext), ref: 0045D803
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,ImmIsIME,00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext), ref: 0045D818
Part of subcall function 0045D6E8: GetProcAddress.KERNEL32(00000000,ImmNotifyIME,00000000,ImmIsIME,00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus), ref: 0045D82D
Part of subcall function 0045D6E8: SetErrorMode.KERNEL32(?,0045D855,00008000), ref: 0045D848

Part of subcall function 00443B58: GetKeyboardLayout.USER32(00000000), ref: 00443B9D
Part of subcall function 00443B58: GetDC.USER32(00000000), ref: 00443BF2
Part of subcall function 00443B58: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00443BFC
Part of subcall function 00443B58: ReleaseDC.USER32(00000000,00000000), ref: 00443C07

Part of subcall function 00444D60: LoadIconA.USER32(00400000,MAINICON), ref: 00444E57
Part of subcall function 00444D60: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON), ref: 00444E89
Part of subcall function 00444D60: OemToCharA.USER32(?,?), ref: 00444E9C
Part of subcall function 00444D60: CharNextA.USER32(?), ref: 00444EDB
Part of subcall function 00444D60: CharLowerA.USER32(00000000), ref: 00444EE1

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,?,?,00000000,0045DC58), ref: 0045DC1F
GetProcAddress.KERNEL32(00000000,AnimateWindow,USER32,00000000,00000000,?,?,00000000,0045DC58), ref: 0045DC30

Strings

Delphi%.8X, xrefs: 0045DB12
ControlOfs%.8X%.8X, xrefs: 0045DB63
AnimateWindow, xrefs: 0045DC2A
USER32, xrefs: 0045DC1A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00444D60, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 135
window

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 00444E57

Part of subcall function 0042B29C: GetIconInfo.USER32(?,?), ref: 0042B2BD
Part of subcall function 0042B29C: GetObjectA.GDI32(?,00000018,?), ref: 0042B2DE
Part of subcall function 0042B29C: DeleteObject.GDI32(?), ref: 0042B30A
Part of subcall function 0042B29C: DeleteObject.GDI32(?), ref: 0042B313

GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON), ref: 00444E89
OemToCharA.USER32(?,?), ref: 00444E9C
CharNextA.USER32(?), ref: 00444EDB
CharLowerA.USER32(00000000), ref: 00444EE1

Part of subcall function 00421140: GetClassInfoA.USER32(00400000,00421130,?), ref: 00421161
Part of subcall function 00421140: UnregisterClassA.USER32(00421130,00400000), ref: 0042118A
Part of subcall function 00421140: RegisterClassA.USER32(00491B50), ref: 00421194
Part of subcall function 00421140: SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 004211DF

Part of subcall function 004450B4: GetClassInfoA.USER32(00400000,00444D50,?), ref: 00445113
Part of subcall function 004450B4: RegisterClassA.USER32(004925FC), ref: 0044512B
Part of subcall function 004450B4: SetWindowLongA.USER32(?,000000FC,?), ref: 004451C2
Part of subcall function 004450B4: SendMessageA.USER32(?,00000080,00000001,00000000), ref: 004451E4
Part of subcall function 004450B4: SetClassLongA.USER32(?,000000F2,00000000), ref: 004451F7
Part of subcall function 004450B4: GetSystemMenu.USER32(?,00000000), ref: 00445202
Part of subcall function 004450B4: DeleteMenu.USER32(00000000,0000F030,00000000), ref: 00445211
Part of subcall function 004450B4: DeleteMenu.USER32(00000000,0000F000,00000000), ref: 0044521E
Part of subcall function 004450B4: DeleteMenu.USER32(00000000,0000F010,00000000), ref: 00445235

Strings

MAINICON, xrefs: 00444E4A
08B, xrefs: 00444E38
0PI, xrefs: 00444E4F, 00444E81
8PI, xrefs: 00444F14
\tA, xrefs: 00444DBF, 00444DD1, 00444DE3

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00481318, Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 241
thread

Control-flow Graph

Executed
Not Executed

APIs

ExitThread.KERNEL32(00000000,00000000,00481687,?,00000000,004816C3,?,?,?,?,0000000C,00000000,00000000), ref: 0048135E

Part of subcall function 00480F70: GetForegroundWindow.USER32 ref: 00480F8F
Part of subcall function 00480F70: GetWindowTextLengthA.USER32(00000000), ref: 00480F9B
Part of subcall function 00480F70: GetWindowTextA.USER32(00000000,00000000,00000001), ref: 00480FB8

Part of subcall function 0048ADCC: SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0048ADF9
Part of subcall function 0048ADCC: SHGetPathFromIDListA.SHELL32(?,?,00000000,0048AE8C,?,?,00000005,?,004856FD,00000000,00485755,?,?,00000005,00000000,00000000), ref: 0048AE09

Part of subcall function 0040A26C: GetFileAttributesA.KERNEL32(00000000,?,0048F947,.dcp,?,?,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040A277

Part of subcall function 0040BCC4: GetLocalTime.KERNEL32(?), ref: 0040BCCC

Part of subcall function 00480FEC: FindFirstFileA.KERNEL32(00000000,?,00000000,0048109E), ref: 0048101E

CreateThread.KERNEL32(00000000,00000000,Function_000810D4,00000000,00000000,00499F94), ref: 0048162D

Strings

FTPUPLOADK, xrefs: 0048159E
,xI, xrefs: 00481482, 0048151D
dclogs\, xrefs: 004813DB, 0048142A, 004815C7
FTPSIZE, xrefs: 004815F1
:: , xrefs: 00481492
Bytes (, xrefs: 0048153F
:: Clipboard Change : size = , xrefs: 0048152D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048B908, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 138

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,00000000,0048BA4E,?,00000000,0048BAB3), ref: 0048B93E
OpenProcessToken.ADVAPI32(00000000,00000008,?,00000000,0048BA4E,?,00000000,0048BAB3), ref: 0048B944
GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),?,00000004,?,00000000,0048BA30,?,00000000,00000008,?,00000000,0048BA4E,?,00000000,0048BAB3), ref: 0048B96F
GetTokenInformation.ADVAPI32(?,00000014(TokenIntegrityLevel),?,00000004,?,?,TokenIntegrityLevel,?,00000004,?,00000000,0048BA30,?,00000000,00000008,?), ref: 0048B9DF
CloseHandle.KERNEL32(?), ref: 0048BA2A

Strings

unknow, xrefs: 0048B9B6
Limited, xrefs: 0048B9A7
Default, xrefs: 0048B989
Full, xrefs: 0048B998

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004035C4, Relevance: 15.1, APIs: 10, Instructions: 129
file

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0040364C
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00403670
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0040368C
ReadFile.KERNEL32(?,?,00000080,?,00000000), ref: 004036AD
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 004036D6
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 004036E4
GetStdHandle.KERNEL32(000000F5), ref: 0040371F
GetFileType.KERNEL32 ref: 00403735
CloseHandle.KERNEL32 ref: 00403750
GetLastError.KERNEL32(000000F5), ref: 00403768

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040EBCC, Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201
thread

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040EB08: GetThreadLocale.KERNEL32 ref: 0040EB2A
Part of subcall function 0040EB08: GetSystemMetrics.USER32(0000004A), ref: 0040EB7D
Part of subcall function 0040EB08: GetSystemMetrics.USER32(0000002A), ref: 0040EB8C

Part of subcall function 0040D3E8: GetThreadLocale.KERNEL32(00000000,0040D4FB,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040D404

GetThreadLocale.KERNEL32(00000000,0040EE97,?,?,00000000,00000000), ref: 0040EC02

Part of subcall function 0040D334: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0040D352

Part of subcall function 0040D380: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040EC7E,00000000,0040EE97,?,?,00000000,00000000), ref: 0040D393

Part of subcall function 0040D670: GetThreadLocale.KERNEL32(?,00000000,0040D840,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040D69F

Part of subcall function 0040D5C0: GetThreadLocale.KERNEL32(?,00000000,0040D657,?,?,00000000), ref: 0040D5D8
Part of subcall function 0040D5C0: GetThreadLocale.KERNEL32(00000000,00000004,00000000,0040D657,?,?,00000000), ref: 0040D608
Part of subcall function 0040D5C0: EnumCalendarInfoA.KERNEL32(Function_0000D50C,00000000,00000000,00000004), ref: 0040D613
Part of subcall function 0040D5C0: GetThreadLocale.KERNEL32(00000000,00000003,00000000,0040D657,?,?,00000000), ref: 0040D631
Part of subcall function 0040D5C0: EnumCalendarInfoA.KERNEL32(Function_0000D548,00000000,00000000,00000003), ref: 0040D63C

Strings

AMPM , xrefs: 0040EE25
mmmm d, yyyy, xrefs: 0040ECFE
m/d/yy, xrefs: 0040ECD1
:mm, xrefs: 0040EE35
:mm:ss, xrefs: 0040EE52
AMPM, xrefs: 0040EE16

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0045F5F8, Relevance: 10.6, APIs: 7, Instructions: 117
file

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040A26C: GetFileAttributesA.KERNEL32(00000000,?,0048F947,.dcp,?,?,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040A277

CreateFileA.KERNEL32(00000000,80000000,00000003,00000000,00000003,08000080,00000000), ref: 0045F637
CreateFileMappingA.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0045F665
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,00000000,0045F6FA,?,00000000,0045F718,?,?,?,?), ref: 0045F691
GetFileSize.KERNEL32(000000FF,00000000,00000000,0045F6DC,?,00000000,00000004,00000000,00000000,00000000,00000000,0045F6FA,?,00000000,0045F718), ref: 0045F6B3
UnmapViewOfFile.KERNEL32(00000000,0045F6E3,0045F6DC,?,00000000,00000004,00000000,00000000,00000000,00000000,0045F6FA,?,00000000,0045F718), ref: 0045F6D6
CloseHandle.KERNEL32(00000000), ref: 0045F6F4
CloseHandle.KERNEL32(000000FF), ref: 0045F712

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048AFE8, Relevance: 10.6, APIs: 7, Instructions: 94sleep

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000,0048B0F3), ref: 0048B016
OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0048B0F3), ref: 0048B01C
Sleep.KERNEL32(00000001,00000000,00000028,?,00000000,0048B0F3), ref: 0048B027
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000320,?,00000000,00000028,?,00000000,0048B0F3), ref: 0048B03C
Sleep.KERNEL32(00000001,?,TokenIntegrityLevel,00000000,00000320,?,00000000,00000028,?,00000000,0048B0F3), ref: 0048B047
LookupPrivilegeNameA.ADVAPI32(00000000,00000004,00000000,000000FF), ref: 0048B094
LookupPrivilegeDisplayNameA.ADVAPI32(00000000,00000000,?,000000FF,?), ref: 0048B0A8

Part of subcall function 0048AEA8: GetCurrentProcess.KERNEL32(00000028,?,00000000,0048AFAF,?,00000000,0048AFD6,?,00000000,?,00000000), ref: 0048AEFF
Part of subcall function 0048AEA8: OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0048AFAF,?,00000000,0048AFD6,?,00000000,?,00000000), ref: 0048AF05
Part of subcall function 0048AEA8: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 0048AF2F
Part of subcall function 0048AEA8: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,?,00000000,0048AF93,?,00000000,00000028,?,00000000,0048AFAF,?,00000000), ref: 0048AF77
Part of subcall function 0048AEA8: CloseHandle.KERNEL32(?), ref: 0048AF8D
Part of subcall function 0048AEA8: GetLastError.KERNEL32(00000000,00000028,?,00000000,0048AFAF,?,00000000,0048AFD6,?,00000000,?,00000000), ref: 0048AF9A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048F888, Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 110

APIs

Part of subcall function 004076D4: GetModuleHandleA.KERNEL32(00000000,?,0048F8A5,?,?,?,0000002F,00000000,00000000), ref: 004076E0

CoInitialize.OLE32(00000000), ref: 0048F8B5

Part of subcall function 0048AFE8: GetCurrentProcess.KERNEL32(00000028,?,00000000,0048B0F3), ref: 0048B016
Part of subcall function 0048AFE8: OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0048B0F3), ref: 0048B01C
Part of subcall function 0048AFE8: Sleep.KERNEL32(00000001,00000000,00000028,?,00000000,0048B0F3), ref: 0048B027
Part of subcall function 0048AFE8: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000320,?,00000000,00000028,?,00000000,0048B0F3), ref: 0048B03C
Part of subcall function 0048AFE8: Sleep.KERNEL32(00000001,?,TokenIntegrityLevel,00000000,00000320,?,00000000,00000028,?,00000000,0048B0F3), ref: 0048B047
Part of subcall function 0048AFE8: LookupPrivilegeNameA.ADVAPI32(00000000,00000004,00000000,000000FF), ref: 0048B094
Part of subcall function 0048AFE8: LookupPrivilegeDisplayNameA.ADVAPI32(00000000,00000000,?,000000FF,?), ref: 0048B0A8

Part of subcall function 0040F234: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,?,0048F90F,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040F24B

Part of subcall function 0040A26C: GetFileAttributesA.KERNEL32(00000000,?,0048F947,.dcp,?,?,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040A277

Strings

.dcp, xrefs: 0048F92D, 0048F989
DCDATA, xrefs: 0048F8E9
NETDATA, xrefs: 0048F9B6
MPI, xrefs: 0048F8BA
GENCODE, xrefs: 0048F920, 0048F97C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042B47C, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0042B4A2

Part of subcall function 004217A0: RegCloseKey.ADVAPI32(10940000,00421610,00000000,004216E2,000F003F,00000001,00421726,?,?,?,0048B244,00000000,0048B2B5,?,00000000,0048B2DD), ref: 004217B4

Part of subcall function 00421A08: RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00421BB9), ref: 00421A81
Part of subcall function 00421A08: RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,00000000,00421BB9), ref: 00421AF1
Part of subcall function 00421A08: RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?), ref: 00421B5C

Part of subcall function 00421770: RegFlushKey.ADVAPI32(00010000,00421610,004217C7,00421610,00000000,004216E2,000F003F,00000001,00421726,?,?,?,0048B244,00000000,0048B2B5), ref: 00421781
Part of subcall function 00421770: RegCloseKey.ADVAPI32(00010000,00421610,004217C7,00421610,00000000,004216E2,000F003F,00000001,00421726,?,?,?,0048B244,00000000,0048B2B5), ref: 0042178A

Part of subcall function 0042B438: GetDC.USER32(00000000), ref: 0042B441
Part of subcall function 0042B438: SelectObject.GDI32(00000000,018A002E), ref: 0042B453
Part of subcall function 0042B438: GetTextMetricsA.GDI32(00000000), ref: 0042B45E
Part of subcall function 0042B438: ReleaseDC.USER32(00000000,00000000), ref: 0042B46F

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 0042B4F8
MS Shell Dlg 2, xrefs: 0042B50C
Tahoma, xrefs: 0042B4C4

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00480F70, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43

APIs

GetForegroundWindow.USER32 ref: 00480F8F
GetWindowTextLengthA.USER32(00000000), ref: 00480F9B
GetWindowTextA.USER32(00000000,00000000,00000001), ref: 00480FB8

Strings

3 H, xrefs: 00480FD4, 00480FA3, 00480FAE, 00480FBF

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00421140, Relevance: 6.1, APIs: 4, Instructions: 59registry

APIs

GetClassInfoA.USER32(00400000,00421130,?), ref: 00421161
UnregisterClassA.USER32(00421130,00400000), ref: 0042118A
RegisterClassA.USER32(00491B50), ref: 00421194

Part of subcall function 0040857C: CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004085BB

Part of subcall function 00421084: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 004210A2

SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 004211DF

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00421808, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74registry

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,000F003F,00000000,?,?,00000000,004218D4,?,?,?,00000000), ref: 0042187F
RegCloseKey.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,000F003F,00000000,?,?,00000000,004218D4,?,?,?,00000000), ref: 00421893

Strings

ddA, xrefs: 004218A7

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00486374, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66network

APIs

send.WSOCK32(?,?,?,00000000,00000000,0048642A), ref: 004863F3

Strings

AI, xrefs: 004863A6
#KEEPALIVE#, xrefs: 00486399

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048DD0C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51

APIs

GlobalMemoryStatus.KERNEL32(00000020), ref: 0048DD44

Strings

%d%, xrefs: 0048DD5C
, xrefs: 0048DD39

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00421A04, Relevance: 4.6, APIs: 3, Instructions: 146registry

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00421BB9), ref: 00421A81
RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,00000000,00421BB9), ref: 00421AF1
RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?), ref: 00421B5C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040EB08, Relevance: 4.6, APIs: 3, Instructions: 56thread

APIs

GetThreadLocale.KERNEL32 ref: 0040EB2A
GetSystemMetrics.USER32(0000004A), ref: 0040EB7D
GetSystemMetrics.USER32(0000002A), ref: 0040EB8C

Part of subcall function 0040EAAC: GetCPInfo.KERNEL32(00000000,?), ref: 0040EABC

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048CF38, Relevance: 4.5, APIs: 3, Instructions: 43

APIs

GetForegroundWindow.USER32 ref: 0048CF57
GetWindowTextLengthA.USER32(00000000), ref: 0048CF63
GetWindowTextA.USER32(00000000,00000000,00000001), ref: 0048CF80

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00482028, Relevance: 4.5, APIs: 3, Instructions: 19window

APIs

Part of subcall function 00481ED8: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00482007,?,?,00000003,00000000,00000000,?,00482033), ref: 00481EFB
Part of subcall function 00481ED8: SetWindowsHookExA.USER32(0000000D,004818F8,00000000,00000000), ref: 00481F09

TranslateMessage.USER32 ref: 00482036
DispatchMessageA.USER32 ref: 0048203C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00482048

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048C91C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75

APIs

GetVolumeInformationA.KERNEL32(00000000,00000000,00000104,?,?,?,00000000,00000104), ref: 0048C974

Strings

%.4x:%.4x, xrefs: 0048C9B9

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048CFB4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58

APIs

capGetDriverDescriptionA.AVICAP32(00000000,?,00000105,?,00000105,00000000,0048D07B), ref: 0048CFF9

Strings

- , xrefs: 0048D026

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00475E2C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51network

APIs

send.WSOCK32(00000248,00000000,?,00000000,00000000,00475EBD), ref: 00475E9D

Strings

AI, xrefs: 00475E55

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004221F0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47registry

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000), ref: 0042221B

Strings

ldA, xrefs: 00422231

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00421F68, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registry

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,n"B,?,?,?,?,00000000,0042226E), ref: 00421F9A

Strings

n"B, xrefs: 00421F81, 00421F84

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004218E4, Relevance: 3.1, APIs: 2, Instructions: 94registry

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,00000000,004219E9,?,?,00000000), ref: 0042195E
RegCreateKeyExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004219E9,?,?,00000000), ref: 00421992

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048ADCC, Relevance: 3.1, APIs: 2, Instructions: 61

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0048ADF9
SHGetPathFromIDListA.SHELL32(?,?,00000000,0048AE8C,?,?,00000005,?,004856FD,00000000,00485755,?,?,00000005,00000000,00000000), ref: 0048AE09

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00403558, Relevance: 3.0, APIs: 2, Instructions: 29file

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00403577
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00403580

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048D6A4, Relevance: 3.0, APIs: 2, Instructions: 17

APIs

GetUserDefaultLangID.KERNEL32 ref: 0048D6AA
VerLanguageNameA.KERNEL32(?,00000064,00000064), ref: 0048D6BA

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048B724, Relevance: 1.6, APIs: 1, Instructions: 107

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0048B776

Part of subcall function 00489BB0: GetTempPathA.KERNEL32(?,00000000), ref: 00489BEC

Part of subcall function 0048C91C: GetVolumeInformationA.KERNEL32(00000000,00000000,00000104,?,?,?,00000000,00000104), ref: 0048C974

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00421A08, Relevance: 1.6, APIs: 1, Instructions: 75registry

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00421BB9), ref: 00421A81
RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,00000000,00421BB9), ref: 00421AF1
RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?), ref: 00421B5C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00422274, Relevance: 1.6, APIs: 1, Instructions: 50registry

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,00000000,004222FA,?,?,00000000), ref: 004222DF

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00404544, Relevance: 1.5, APIs: 1, Instructions: 46

APIs

CompareStringA.KERNEL32(00000800,00000001,00000000,00000000,00000000,00000000,00000000,004045CB), ref: 004045AA

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040857A, Relevance: 1.5, APIs: 1, Instructions: 45

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004085BB

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040857C, Relevance: 1.5, APIs: 1, Instructions: 44

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004085BB

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004054B4, Relevance: 1.5, APIs: 1, Instructions: 38thread

APIs

CreateThread.KERNEL32(00000000,?,Function_0000547C,00000000,?,00499F5C), ref: 00405504

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042230C, Relevance: 1.5, APIs: 1, Instructions: 37registry

APIs

Part of subcall function 00422274: RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,00000000,004222FA,?,?,00000000), ref: 004222DF

RegCloseKey.ADVAPI32(00000000,00000000,00422371,?,00000000), ref: 0042234F

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048F6D4, Relevance: 1.5, APIs: 1, Instructions: 34

APIs

GetVersion.KERNEL32(00000000,0048F75A), ref: 0048F6EE

Part of subcall function 0045DAE0: GetCurrentProcessId.KERNEL32(?,00000000,0045DC58), ref: 0045DB01
Part of subcall function 0045DAE0: GlobalAddAtomA.KERNEL32(00000000), ref: 0045DB34
Part of subcall function 0045DAE0: GetCurrentThreadId.KERNEL32(?,?,00000000,0045DC58), ref: 0045DB4F
Part of subcall function 0045DAE0: GlobalAddAtomA.KERNEL32(00000000), ref: 0045DB85
Part of subcall function 0045DAE0: RegisterWindowMessageA.USER32(00000000,00000000,?,?,00000000,0045DC58), ref: 0045DB9B
Part of subcall function 0045DAE0: GetModuleHandleA.KERNEL32(USER32,00000000,00000000,?,?,00000000,0045DC58), ref: 0045DC1F
Part of subcall function 0045DAE0: GetProcAddress.KERNEL32(00000000,AnimateWindow,USER32,00000000,00000000,?,?,00000000,0045DC58), ref: 0045DC30

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004069C8, Relevance: 1.5, APIs: 1, Instructions: 26

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 004069E6

Part of subcall function 00406C2C: GetModuleFileNameA.KERNEL32(00000000,?,00000105,00400000,004917C0), ref: 00406C48
Part of subcall function 00406C2C: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00400000,004917C0), ref: 00406C66
Part of subcall function 00406C2C: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00400000,004917C0), ref: 00406C84
Part of subcall function 00406C2C: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00406CA2
Part of subcall function 00406C2C: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00406D31,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00406CEB
Part of subcall function 00406C2C: RegQueryValueExA.ADVAPI32(?,00406E98,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00406D31,?,80000001), ref: 00406D09
Part of subcall function 00406C2C: RegCloseKey.ADVAPI32(?,00406D38,00000000,?,?,00000000,00406D31,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00406D2B
Part of subcall function 00406C2C: lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00406D48
Part of subcall function 00406C2C: GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00406D55
Part of subcall function 00406C2C: GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00406D5B
Part of subcall function 00406C2C: lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00406D86
Part of subcall function 00406C2C: lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00406DCD
Part of subcall function 00406C2C: LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00406DDD
Part of subcall function 00406C2C: lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00406E05
Part of subcall function 00406C2C: LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00406E15
Part of subcall function 00406C2C: lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00406E3B
Part of subcall function 00406C2C: LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 00406E4B

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004607E0, Relevance: 1.5, APIs: 1, Instructions: 25network

APIs

gethostname.WSOCK32(?,00000100,?,?,0046084B,00000000,0046086D,?,?,?,00000000), ref: 004607FD

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00473A40, Relevance: 1.5, APIs: 1, Instructions: 25

APIs

SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,?,00473AAB,00000000,00473AD0,?,00000000,00000000,?,00473BAB,?,00000000), ref: 00473A51

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00445844, Relevance: 1.5, APIs: 1, Instructions: 24

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 0044586E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0041FEF0, Relevance: 1.5, APIs: 1, Instructions: 17thread

APIs

ResumeThread.KERNEL32(?,00499F5C,?,0047ECAA,?,?,?,00000000,00000000,?,0049062B), ref: 0041FEF8

Part of subcall function 0041FC00: GetLastError.KERNEL32(00000005,0041FC67,?,015CDB28,00499F5C,?,0047EC9E,?,?,?,00000000,00000000,?,0049062B), ref: 0041FC07

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040A26C, Relevance: 1.5, APIs: 1, Instructions: 16

APIs

GetFileAttributesA.KERNEL32(00000000,?,0048F947,.dcp,?,?,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040A277

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040A290, Relevance: 1.5, APIs: 1, Instructions: 16

APIs

GetFileAttributesA.KERNEL32(00000000,?,0048FD09,?,?,00490710,?), ref: 0040A29B

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00407978, Relevance: 1.5, APIs: 1, Instructions: 14synchronization

APIs

CreateMutexA.KERNEL32(?,?,?,?,0049048A,00000000,00000000,00000000,00000000,?,00490710,?), ref: 0040798E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040A84C, Relevance: 1.5, APIs: 1, Instructions: 12

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000001,0040A378,00000000,0040A39D,?,?,00000000,00000000,00000000,00000000,?,0048FDBD,00490710,?), ref: 0040A859

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0041FA34, Relevance: 1.3, APIs: 1, Instructions: 60

APIs

Part of subcall function 0041F79C: InterlockedIncrement.KERNEL32(004999E8), ref: 0041F7A1

Part of subcall function 004054B4: CreateThread.KERNEL32(00000000,?,Function_0000547C,00000000,?,00499F5C), ref: 00405504

GetLastError.KERNEL32(00486514,00000004,0048650C,00000000,0041FADE,?,00499F5C), ref: 0041FA94

Part of subcall function 0040D2E8: FormatMessageA.KERNEL32(00003200,00000000,00000000,00000000,?,00000100,00000000), ref: 0040D307

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00421084, Relevance: 1.3, APIs: 1, Instructions: 52memory

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 004210A2

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004016F8, Relevance: 1.3, APIs: 1, Instructions: 38memory

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00401D07,?,004019DA), ref: 0040170E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Non-executed Functions

Function 0048B42C, Relevance: 70.2, APIs: 32, Strings: 8, Instructions: 219keyboard

APIs

keybd_event.USER32(00000011,00000045,00000001,00000000), ref: 0048B460
keybd_event.USER32(00000041,00000045,00000001,00000000), ref: 0048B46D
keybd_event.USER32(00000011,00000045,00000003,00000000), ref: 0048B47A
keybd_event.USER32(00000041,00000045,00000003,00000000), ref: 0048B487
keybd_event.USER32(00000011,00000045,00000001,00000000), ref: 0048B4A8
keybd_event.USER32(00000056,00000045,00000001,00000000), ref: 0048B4B5
keybd_event.USER32(00000011,00000045,00000003,00000000), ref: 0048B4C2
keybd_event.USER32(00000056,00000045,00000003,00000000), ref: 0048B4CF
keybd_event.USER32(00000011,00000045,00000001,00000000), ref: 0048B4F0
keybd_event.USER32(00000043,00000045,00000001,00000000), ref: 0048B4FD
keybd_event.USER32(00000011,00000045,00000003,00000000), ref: 0048B50A
keybd_event.USER32(00000043,00000045,00000003,00000000), ref: 0048B517
keybd_event.USER32(00000011,00000045,00000001,00000000), ref: 0048B538
keybd_event.USER32(00000058,00000045,00000001,00000000), ref: 0048B545
keybd_event.USER32(00000011,00000045,00000003,00000000), ref: 0048B552
keybd_event.USER32(00000058,00000045,00000003,00000000), ref: 0048B55F
keybd_event.USER32(00000011,00000045,00000001,00000000), ref: 0048B580
keybd_event.USER32(00000050,00000045,00000001,00000000), ref: 0048B58D
keybd_event.USER32(00000011,00000045,00000003,00000000), ref: 0048B59A
keybd_event.USER32(00000050,00000045,00000003,00000000), ref: 0048B5A7
keybd_event.USER32(00000011,00000045,00000001,00000000), ref: 0048B5C8
keybd_event.USER32(0000005A,00000045,00000001,00000000), ref: 0048B5D5
keybd_event.USER32(00000011,00000045,00000003,00000000), ref: 0048B5E2
keybd_event.USER32(0000005A,00000045,00000003,00000000), ref: 0048B5EF
keybd_event.USER32(00000011,00000045,00000001,00000000), ref: 0048B610
keybd_event.USER32(00000059,00000045,00000001,00000000), ref: 0048B61D
keybd_event.USER32(00000011,00000045,00000003,00000000), ref: 0048B62A
keybd_event.USER32(00000059,00000045,00000003,00000000), ref: 0048B637
keybd_event.USER32(00000011,00000045,00000001,00000000), ref: 0048B655
keybd_event.USER32(00000046,00000045,00000001,00000000), ref: 0048B662
keybd_event.USER32(00000011,00000045,00000003,00000000), ref: 0048B66F
keybd_event.USER32(00000046,00000045,00000003,00000000), ref: 0048B67C

Strings

CTRLP, xrefs: 0048B56C
CTRLC, xrefs: 0048B4DC
CTRLV, xrefs: 0048B494
CTRLY, xrefs: 0048B5FC
CTRLF, xrefs: 0048B641
CTRLZ, xrefs: 0048B5B4
CTRLX, xrefs: 0048B524
CTRLA, xrefs: 0048B44C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00460AC0, Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloader

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,00460D47,00000000,00000000,00466CF5,?,?,00000000,0046722E,?,?,?,?), ref: 00460AD4
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot,kernel32.dll,00000002,00460D47,00000000,00000000,00466CF5,?,?,00000000,0046722E,?,?,?,?), ref: 00460AEC
GetProcAddress.KERNEL32(00000000,Heap32ListFirst,00000000,CreateToolhelp32Snapshot,kernel32.dll,00000002,00460D47,00000000,00000000,00466CF5,?,?,00000000,0046722E,?,?), ref: 00460AFE
GetProcAddress.KERNEL32(00000000,Heap32ListNext,00000000,Heap32ListFirst,00000000,CreateToolhelp32Snapshot,kernel32.dll,00000002,00460D47,00000000,00000000,00466CF5,?,?,00000000,0046722E), ref: 00460B10
GetProcAddress.KERNEL32(00000000,Heap32First,00000000,Heap32ListNext,00000000,Heap32ListFirst,00000000,CreateToolhelp32Snapshot,kernel32.dll,00000002,00460D47,00000000,00000000,00466CF5), ref: 00460B22
GetProcAddress.KERNEL32(00000000,Heap32Next,00000000,Heap32First,00000000,Heap32ListNext,00000000,Heap32ListFirst,00000000,CreateToolhelp32Snapshot,kernel32.dll,00000002,00460D47,00000000,00000000,00466CF5), ref: 00460B34
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory,00000000,Heap32Next,00000000,Heap32First,00000000,Heap32ListNext,00000000,Heap32ListFirst,00000000,CreateToolhelp32Snapshot,kernel32.dll,00000002,00460D47,00000000), ref: 00460B46
GetProcAddress.KERNEL32(00000000,Process32First,00000000,Toolhelp32ReadProcessMemory,00000000,Heap32Next,00000000,Heap32First,00000000,Heap32ListNext,00000000,Heap32ListFirst,00000000,CreateToolhelp32Snapshot,kernel32.dll,00000002), ref: 00460B58
GetProcAddress.KERNEL32(00000000,Process32Next,00000000,Process32First,00000000,Toolhelp32ReadProcessMemory,00000000,Heap32Next,00000000,Heap32First,00000000,Heap32ListNext,00000000,Heap32ListFirst,00000000,CreateToolhelp32Snapshot), ref: 00460B6A
GetProcAddress.KERNEL32(00000000,Process32FirstW,00000000,Process32Next,00000000,Process32First,00000000,Toolhelp32ReadProcessMemory,00000000,Heap32Next,00000000,Heap32First,00000000,Heap32ListNext,00000000,Heap32ListFirst), ref: 00460B7C
GetProcAddress.KERNEL32(00000000,Process32NextW,00000000,Process32FirstW,00000000,Process32Next,00000000,Process32First,00000000,Toolhelp32ReadProcessMemory,00000000,Heap32Next,00000000,Heap32First,00000000,Heap32ListNext), ref: 00460B8E
GetProcAddress.KERNEL32(00000000,Thread32First,00000000,Process32NextW,00000000,Process32FirstW,00000000,Process32Next,00000000,Process32First,00000000,Toolhelp32ReadProcessMemory,00000000,Heap32Next,00000000,Heap32First), ref: 00460BA0
GetProcAddress.KERNEL32(00000000,Thread32Next,00000000,Thread32First,00000000,Process32NextW,00000000,Process32FirstW,00000000,Process32Next,00000000,Process32First,00000000,Toolhelp32ReadProcessMemory,00000000,Heap32Next), ref: 00460BB2
GetProcAddress.KERNEL32(00000000,Module32First,00000000,Thread32Next,00000000,Thread32First,00000000,Process32NextW,00000000,Process32FirstW,00000000,Process32Next,00000000,Process32First,00000000,Toolhelp32ReadProcessMemory), ref: 00460BC4
GetProcAddress.KERNEL32(00000000,Module32Next,00000000,Module32First,00000000,Thread32Next,00000000,Thread32First,00000000,Process32NextW,00000000,Process32FirstW,00000000,Process32Next,00000000,Process32First), ref: 00460BD6
GetProcAddress.KERNEL32(00000000,Module32FirstW,00000000,Module32Next,00000000,Module32First,00000000,Thread32Next,00000000,Thread32First,00000000,Process32NextW,00000000,Process32FirstW,00000000,Process32Next), ref: 00460BE8
GetProcAddress.KERNEL32(00000000,Module32NextW,00000000,Module32FirstW,00000000,Module32Next,00000000,Module32First,00000000,Thread32Next,00000000,Thread32First,00000000,Process32NextW,00000000,Process32FirstW), ref: 00460BFA

Strings

Toolhelp32ReadProcessMemory, xrefs: 00460B3E
CreateToolhelp32Snapshot, xrefs: 00460AE4
Heap32First, xrefs: 00460B1A
Thread32First, xrefs: 00460B98
Module32First, xrefs: 00460BBC
Process32FirstW, xrefs: 00460B74
Heap32Next, xrefs: 00460B2C
Process32First, xrefs: 00460B50
Module32Next, xrefs: 00460BCE
Module32NextW, xrefs: 00460BF2
Heap32ListFirst, xrefs: 00460AF6
Thread32Next, xrefs: 00460BAA
Module32FirstW, xrefs: 00460BE0
Heap32ListNext, xrefs: 00460B08
Process32NextW, xrefs: 00460B86
kernel32.dll, xrefs: 00460ACF
Process32Next, xrefs: 00460B62

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00428B08, Relevance: 48.5, APIs: 32, Instructions: 500window

APIs

GetObjectA.GDI32(00000000,00000054,?), ref: 00428B88
GetDC.USER32(00000000), ref: 00428B99
CreateCompatibleDC.GDI32(00000000), ref: 00428BAA
CreateBitmap.GDI32(00000000,?,00000001,00000001,00000000), ref: 00428BF6
CreateCompatibleBitmap.GDI32(00000028,00000000,?), ref: 00428C1A
GetDeviceCaps.GDI32(00000028,0000000C), ref: 00428C6A
GetDeviceCaps.GDI32(00000028,0000000E), ref: 00428C77
SelectObject.GDI32(?,?), ref: 00428D7F

Part of subcall function 004262B4: GetObjectA.GDI32(?,00000004), ref: 004262CB
Part of subcall function 004262B4: GetPaletteEntries.GDI32(?,00000000,?,?), ref: 004262EE

SelectObject.GDI32(?,00000000), ref: 00428D21
GetDIBColorTable.GDI32(?,00000000,00000100,-00000027), ref: 00428D47
GetDIBits.GDI32(?,00000000,00000000,?,00000000,00000001,00000000), ref: 00428D72
CreateDIBSection.GDI32(00000028,00000001,00000000,00000003,00000000,00000000), ref: 00428DD5
GetDIBits.GDI32(?,00000000,00000000,?,00000000,00000001,00000000), ref: 00428E36

Part of subcall function 00425A70: GetLastError.KERNEL32(00000000,00425B0C), ref: 00425A90
Part of subcall function 00425A70: FormatMessageA.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,00425B0C), ref: 00425AB6

SelectObject.GDI32(?,?), ref: 00428E77
SelectPalette.GDI32(?,00000000,00000000), ref: 00428EB7
RealizePalette.GDI32(?), ref: 00428EC3
SelectPalette.GDI32(?,?,000000FF), ref: 004290CE

Part of subcall function 00424FEC: CreateBrushIndirect.GDI32(?), ref: 00425097

FillRect.USER32(?,?,00000000), ref: 00428F14
SetTextColor.GDI32(?,00000000), ref: 00428F2C
SetBkColor.GDI32(?,00000000), ref: 00428F46
SetDIBColorTable.GDI32(?,00000000,00000002,?), ref: 00428F8E
PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 00428FB0
CreateCompatibleDC.GDI32(00000028), ref: 00428FC3
SelectObject.GDI32(?,00000000), ref: 00428FE6
SelectPalette.GDI32(?,00000000,00000000), ref: 00429002
RealizePalette.GDI32(?), ref: 0042900D
DeleteDC.GDI32(?), ref: 004290A4

Part of subcall function 00424230: GetSysColor.USER32(?), ref: 0042423A

SetTextColor.GDI32(?,00000000), ref: 0042902B
SetBkColor.GDI32(?,00000000), ref: 00429045
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042906D
SelectPalette.GDI32(?,00000000,000000FF), ref: 0042907F
SelectObject.GDI32(?,00000000), ref: 00429089

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0047FA8C, Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 241networkwindow

APIs

socket.WSOCK32(00000002,00000001,00000000,00000000,0047FD80), ref: 0047FACB
ntohs.WSOCK32(00000774), ref: 0047FAEF
inet_addr.WSOCK32(015EAA88,00000774), ref: 0047FB03
gethostbyname.WSOCK32(015EAA88,015EAA88,00000774), ref: 0047FB1B
connect.WSOCK32(000000FF,00000002,00000010,015EAA88,00000774), ref: 0047FB42
recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 0047FB59

Part of subcall function 00475ECC: send.WSOCK32(?,00000000,?,00000000,00000000,00475F58), ref: 00475F38

recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 0047FBA9
GetDC.USER32(00000000), ref: 0047FBE3
CreateCompatibleDC.GDI32(?), ref: 0047FBEF
GetDeviceCaps.GDI32(?,0000000A), ref: 0047FBFD
GetDeviceCaps.GDI32(?,00000008), ref: 0047FC09
CreateCompatibleBitmap.GDI32(?,00000000,?), ref: 0047FC13
SelectObject.GDI32(?,?), ref: 0047FC23
GetDeviceCaps.GDI32(?,0000000A), ref: 0047FC3E
GetDeviceCaps.GDI32(?,00000008), ref: 0047FC4A
BitBlt.GDI32(?,00000000,00000000,00000000,?,00000008,00000000,?,0000000A), ref: 0047FC58
send.WSOCK32(000000FF,?,00000000,00000000,?,000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,000000FF,00000002,00000010), ref: 0047FCCD
recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,?,00000000,00000000,?,000000FF,?,00002000,00000000,000000FF,?,00002000), ref: 0047FCE4
SelectObject.GDI32(?,?), ref: 0047FD08
DeleteObject.GDI32(?), ref: 0047FD11
DeleteObject.GDI32(?), ref: 0047FD1A
ReleaseDC.USER32(00000000,?), ref: 0047FD25
shutdown.WSOCK32(000000FF,00000002,00000002,00000001,00000000,00000000,0047FD80), ref: 0047FD54
closesocket.WSOCK32(000000FF,000000FF,00000002,00000002,00000001,00000000,00000000,0047FD80), ref: 0047FD5D

Strings

THUMB, xrefs: 0047FB7F

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00486918, Relevance: 40.8, APIs: 27, Instructions: 343networksleep

APIs

recv.WSOCK32(?,?,00000002,00000002,00000000,00486E16), ref: 00486971
recv.WSOCK32(?,00000005,?,00000000), ref: 004869A0
send.WSOCK32(?,00000005,00000002,00000000,?,00000005,?,00000000), ref: 004869EE
send.WSOCK32(?,00000005,00000002,00000000,?,00000005,?,00000000), ref: 00486A0B
recv.WSOCK32(?,?,00000259,00000000,?,00000005,00000002,00000000,?,00000005,?,00000000), ref: 00486A1F
send.WSOCK32(?,00000001,00000002,00000000), ref: 00486A9E
send.WSOCK32(?,00000001,00000002,00000000), ref: 00486ABB
send.WSOCK32(?,00000005,00000002,00000000,?,00000005,?,00000000), ref: 00486AE8
send.WSOCK32(?,00000005,00000002,00000000,?,00000005,?,00000000), ref: 00486B02
send.WSOCK32(?,00000005,00000002,00000000,?,00000005,?,00000000), ref: 00486B2B
recv.WSOCK32(?,?,0000000C,00000002,?,00000005,?,00000000), ref: 00486B41
recv.WSOCK32(?,?,0000000C,00000000,?,?,0000000C,00000002,?,00000005,?,00000000), ref: 00486B7C
recv.WSOCK32(?,?,?,00000000,?,?,0000000C,00000002,?,00000005,?,00000000), ref: 00486BD9
gethostbyname.WSOCK32(00000000,?,?,?,00000000,?,?,0000000C,00000002,?,00000005,?,00000000), ref: 00486BFF
ntohs.WSOCK32(?,00000000,?,?,?,00000000,?,?,0000000C,00000002,?,00000005,?,00000000), ref: 00486C29
socket.WSOCK32(00000002,00000001,00000000), ref: 00486C44
connect.WSOCK32(00000000,00000002,00000010,00000002,00000001,00000000), ref: 00486C55
getsockname.WSOCK32(00000000,?,00000010,00000000,00000002,00000010,00000002,00000001,00000000), ref: 00486CA8
send.WSOCK32(?,00000005,0000000A,00000000,00000000,?,00000010,00000000,00000002,00000010,00000002,00000001,00000000), ref: 00486CDD
select.WSOCK32(00000000,?,00000000,00000000,00000000,?,00000005,0000000A,00000000,00000000,?,00000010,00000000,00000002,00000010,00000002), ref: 00486D1D
Sleep.KERNEL32(00000096,00000000,?,00000000,00000000,00000000,?,00000005,0000000A,00000000,00000000,?,00000010,00000000,00000002,00000010), ref: 00486DCA

Part of subcall function 00408710: __WSAFDIsSet.WSOCK32(00000000,?,00000000,?,00486D36,00000000,?,00000000,00000000,00000000,00000096,00000000,?,00000000,00000000,00000000), ref: 00408718

recv.WSOCK32(00000000,?,00001000,00000000,00000000,?,00000000,00000000,00000000,00000096,00000000,?,00000000,00000000,00000000,?), ref: 00486D5B
send.WSOCK32(?,?,00000000,00000000,00000000,?,00001000,00000000,00000000,?,00000000,00000000,00000000,00000096,00000000,?), ref: 00486D72
recv.WSOCK32(?,?,00001000,00000000,00000000,?,00000000,00000000,00000000,00000096,00000000,?,00000000,00000000,00000000,?), ref: 00486DA9
send.WSOCK32(00000000,?,00000000,00000000,?,?,00001000,00000000,00000000,?,00000000,00000000,00000000,00000096,00000000,?), ref: 00486DC0
closesocket.WSOCK32(?,?,?,00000002,00000002,00000000,00486E16), ref: 00486DE2
closesocket.WSOCK32(?,?,?,?,00000002,00000002,00000000,00486E16), ref: 00486DE8

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004801FC, Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 286network

APIs

socket.WSOCK32(00000002,00000001,00000000), ref: 00480264
ntohs.WSOCK32(00000774), ref: 00480288
inet_addr.WSOCK32(015EAA88,00000774), ref: 0048029C
gethostbyname.WSOCK32(015EAA88,015EAA88,00000774), ref: 004802B4
connect.WSOCK32(000000FF,00000002,00000010,015EAA88,00000774), ref: 004802DB
recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 004802F2
closesocket.WSOCK32(000000FF,000000FF,00000002,000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 004805DE

Part of subcall function 00475ECC: send.WSOCK32(?,00000000,?,00000000,00000000,00475F58), ref: 00475F38

recv.WSOCK32(000000FF,?,00002000,00000000,?,0048064C,?,00000000,?,FILETRANSFER,000000FF,?,00002000,00000000,000000FF,00000002), ref: 0048036A
recv.WSOCK32(000000FF,?,00002000,00000000,?,00000000,?,0048064C,?,FILEBOF,?,FILETRANSFER,000000FF,?,00002000,00000000), ref: 00480401

Part of subcall function 0040A26C: GetFileAttributesA.KERNEL32(00000000,?,0048F947,.dcp,?,?,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040A277

recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,?,00000000,?,0048064C,?,FILEBOF,?,FILETRANSFER), ref: 00480451
send.WSOCK32(000000FF,?,00000000,00000000,00000000,00480523,?,000000FF,?,00002000,00000000,?,00000000,?,0048064C,?), ref: 004804DB
recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,?,00000000,00000000,00000000,00480523,?,000000FF,?,00002000,00000000,?), ref: 004804F5
recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,?,00000000,?,0048064C,?,FILEBOF,?,FILETRANSFER), ref: 00480583

Part of subcall function 00475F68: send.WSOCK32(?,00000000,?,00000000,00000000,00475FCA), ref: 00475FAF

recv.WSOCK32(000000FF,?,00002000,00000000,?,FILETRANSFER,000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 004805B6
shutdown.WSOCK32(000000FF,00000002,000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 004805D5

Strings

FILEERR, xrefs: 00480432
FILEEOF, xrefs: 00480564
FILEBOF, xrefs: 004803A6
FILEEND, xrefs: 00480597
FILETRANSFER, xrefs: 004802FE

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048E06C, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 175windowmemorythread

APIs

Part of subcall function 0048DFF0: GetForegroundWindow.USER32 ref: 0048E00F
Part of subcall function 0048DFF0: GetWindowTextLengthA.USER32(00000000), ref: 0048E01B
Part of subcall function 0048DFF0: GetWindowTextA.USER32(00000000,00000000,00000001), ref: 0048E038

FindWindowA.USER32(#32770,00000000), ref: 0048E0C3
FindWindowExA.USER32(?,00000000,#32770,00000000), ref: 0048E0D8
FindWindowExA.USER32(?,00000000,SysListView32,00000000), ref: 0048E0ED
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0048E102
VirtualAlloc.KERNEL32(00000000,0000012C,00003000,00000004,?,00000000,SysListView32,00000000,00000000,0048E273,?,?,?,?), ref: 0048E12A
GetWindowThreadProcessId.USER32(?,?), ref: 0048E139
OpenProcess.KERNEL32(00000038,00000000,?,00000000,0000012C,00003000,00000004,?,00000000,SysListView32,00000000,00000000,0048E273), ref: 0048E146
VirtualAllocEx.KERNEL32(00000000,00000000,0000012C,00003000,00000004,00000038,00000000,?,00000000,0000012C,00003000,00000004,?,00000000,SysListView32,00000000), ref: 0048E158
WriteProcessMemory.KERNEL32(00000000,00000000,00000000,00000400,?,00000000,00000000,0000012C,00003000,00000004,00000038,00000000,?,00000000,0000012C,00003000), ref: 0048E18A
SendMessageA.USER32(d"H,0000102D,00000000,00000000), ref: 0048E19D
ReadProcessMemory.KERNEL32(00000000,00000000,00000000,00000400,?,d"H,0000102D,00000000,00000000,00000000,00000000,00000000,00000400,?,00000000,00000000), ref: 0048E1AE
SendMessageA.USER32(d"H,00001008,00000000,00000000), ref: 0048E219
VirtualFree.KERNEL32(00000000,00000000,00008000,d"H,00001008,00000000,00000000,00000000,00000000,00000000,00000400,?,d"H,0000102D,00000000,00000000), ref: 0048E226
VirtualFreeEx.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00008000,d"H,00001008,00000000,00000000,00000000,00000000,00000000,00000400,?), ref: 0048E234
CloseHandle.KERNEL32(00000000), ref: 0048E23A

Strings

SysListView32, xrefs: 0048E0E2
d"H, xrefs: 0048E199, 0048E215, 0048E19C, 0048E218
#32770, xrefs: 0048E0BE, 0048E0CD

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00480880, Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 276network

APIs

socket.WSOCK32(00000002,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000,00480C86), ref: 004808B5
ntohs.WSOCK32(00000774), ref: 004808D9
inet_addr.WSOCK32(015EAA88,00000774), ref: 004808ED
gethostbyname.WSOCK32(015EAA88,015EAA88,00000774), ref: 00480905
connect.WSOCK32(000000FF,00000002,00000010,015EAA88,00000774), ref: 0048092C
recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 00480943
closesocket.WSOCK32(000000FF,000000FF,00000002,000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 00480C2F

Part of subcall function 00475ECC: send.WSOCK32(?,00000000,?,00000000,00000000,00475F58), ref: 00475F38

recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 00480993
recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88), ref: 004809C8
shutdown.WSOCK32(000000FF,00000002,?,?,?,000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,000000FF,?,00002000), ref: 00480B80
closesocket.WSOCK32(000000FF,000000FF,00000002,?,?,?,000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,000000FF,?), ref: 00480B89

Part of subcall function 00480860: send.WSOCK32(?,00000000,00000001,00000000), ref: 00480879

shutdown.WSOCK32(000000FF,00000002,000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 00480C26

Part of subcall function 00405D40: SysFreeString.OLEAUT32(?), ref: 00405D53

Strings

FILEERR, xrefs: 00480BB6
FILEBOF, xrefs: 00480A34
FILEEOF, xrefs: 00480B0B
UPLOADFILE, xrefs: 00480969
FILEEND, xrefs: 00480B6A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048851C, Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 302network

APIs

socket.WSOCK32(00000002,00000001,00000000,00000000,00488943), ref: 00488581
ntohs.WSOCK32(00000774), ref: 004885A7
inet_addr.WSOCK32(015EAA88,00000774), ref: 004885BB
gethostbyname.WSOCK32(015EAA88,015EAA88,00000774), ref: 004885D3
connect.WSOCK32(?,00000002,00000010,015EAA88,00000774), ref: 004885FD
recv.WSOCK32(?,?,00002000,00000000,?,00000002,00000010,015EAA88,00000774), ref: 00488617

Part of subcall function 00475ECC: send.WSOCK32(?,00000000,?,00000000,00000000,00475F58), ref: 00475F38

recv.WSOCK32(?,?,00002000,00000000,?,?,00002000,00000000,?,00000002,00000010,015EAA88,00000774), ref: 00488670
recv.WSOCK32(?,?,00002000,00000000,?,?,00002000,00000000,?,?,00002000,00000000,?,00000002,00000010,015EAA88), ref: 004886B7
mouse_event.USER32(00000800,00000000,00000000,00000000,00000000), ref: 00488743

Part of subcall function 00488F80: SetCursorPos.USER32(00000000,00000000), ref: 004890E0
Part of subcall function 00488F80: mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 004890FB
Part of subcall function 00488F80: mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 0048910A
Part of subcall function 00488F80: mouse_event.USER32(00000008,00000000,00000000,00000000,00000000), ref: 0048911B
Part of subcall function 00488F80: mouse_event.USER32(00000010,00000000,00000000,00000000,00000000), ref: 0048912A
Part of subcall function 00488F80: mouse_event.USER32(00000020,00000000,00000000,00000000,00000000), ref: 0048913B
Part of subcall function 00488F80: mouse_event.USER32(00000040,00000000,00000000,00000000,00000000), ref: 0048914A

shutdown.WSOCK32(?,00000002,00000002,00000001,00000000,00000000,00488943), ref: 00488907
closesocket.WSOCK32(?,?,00000002,00000002,00000001,00000000,00000000,00488943), ref: 00488913

Strings

XLEFT, xrefs: 004887C6
CONTROLIO, xrefs: 00488640
XRIGHT, xrefs: 0048882E
XMID, xrefs: 00488896
XWHEEL, xrefs: 00488701

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048317C, Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 191networkthread

APIs

socket.WSOCK32(00000002,00000001,00000000,00000000,004833A9,?,00000000,0048340F), ref: 00483247
ExitThread.KERNEL32(00000000,00000002,00000001,00000000,00000000,004833A9,?,00000000,0048340F), ref: 00483257
ntohs.WSOCK32(00000774), ref: 0048326E
inet_addr.WSOCK32(015EAA88,00000774), ref: 00483282
gethostbyname.WSOCK32(015EAA88,015EAA88,00000774), ref: 0048329A
ExitThread.KERNEL32(00000000,015EAA88,015EAA88,00000774), ref: 004832A7
connect.WSOCK32(000000FF,00000002,00000010,015EAA88,00000774), ref: 004832C6
recv.WSOCK32(000000FF,?,00000400,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 004832D7
ExitThread.KERNEL32(00000000,000000FF,000000FF,00000002,000000FF,?,00000400,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 0048339A

Part of subcall function 00475ECC: send.WSOCK32(?,00000000,?,00000000,00000000,00475F58), ref: 00475F38

recv.WSOCK32(000000FF,?,00000400,00000000,?,00483440,?,DATAFLUX,000000FF,?,00000400,00000000,000000FF,00000002,00000010,015EAA88), ref: 0048331D
send.WSOCK32(000000FF,?,00000000,00000000), ref: 0048335C
recv.WSOCK32(000000FF,?,00000400,00000000,000000FF,?,00000000,00000000), ref: 00483370
shutdown.WSOCK32(000000FF,00000002,000000FF,?,00000400,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 00483382
closesocket.WSOCK32(000000FF,000000FF,00000002,000000FF,?,00000400,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 0048338B

Strings

AI, xrefs: 00483218
DATAFLUX, xrefs: 004832E3

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0047F4E0, Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 295network

APIs

socket.WSOCK32(00000002,00000001,00000000,?,00000000,0047F930,?,?,?,?,00000000,00000000), ref: 0047F543
ntohs.WSOCK32(00000774), ref: 0047F567
inet_addr.WSOCK32(015EAA88,00000774), ref: 0047F57B
gethostbyname.WSOCK32(015EAA88,015EAA88,00000774), ref: 0047F593
connect.WSOCK32(000000FF,00000002,00000010,015EAA88,00000774), ref: 0047F5BA
recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 0047F5D1
closesocket.WSOCK32(000000FF,000000FF,00000002,000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 0047F8C2

Part of subcall function 00475ECC: send.WSOCK32(?,00000000,?,00000000,00000000,00475F58), ref: 00475F38

recv.WSOCK32(000000FF,?,00002000,00000000,?,0047F968,?,0047F968,?,QUICKUP,000000FF,?,00002000,00000000,000000FF,00000002), ref: 0047F63F
recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,?,0047F968,?,0047F968,?,QUICKUP,000000FF,?), ref: 0047F66F

Part of subcall function 0047F4C0: send.WSOCK32(?,00000000,00000001,00000000), ref: 0047F4D9

recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,?,0047F968,?,0047F968), ref: 0047F859

Part of subcall function 0048ADCC: SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0048ADF9
Part of subcall function 0048ADCC: SHGetPathFromIDListA.SHELL32(?,?,00000000,0048AE8C,?,?,00000005,?,004856FD,00000000,00485755,?,?,00000005,00000000,00000000), ref: 0048AE09

recv.WSOCK32(000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,000000FF,?,00002000,00000000,?,0047F968,?,0047F968), ref: 0047F786

Part of subcall function 0047EE3C: ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 0047EEA0
Part of subcall function 0047EE3C: ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 0047EF11
Part of subcall function 0047EE3C: ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 0047EF31
Part of subcall function 0047EE3C: ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 0047EF60
Part of subcall function 0047EE3C: ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0047EF96
Part of subcall function 0047EE3C: SetFileAttributesA.KERNEL32(00000000,00000080,?,00000000,0047F0FE,?,?,?,00000003,00000000,00000000), ref: 0047EFD6
Part of subcall function 0047EE3C: DeleteFileA.KERNEL32(00000000,00000000,00000080,?,00000000,0047F0FE,?,?,?,00000003,00000000,00000000), ref: 0047EFFF
Part of subcall function 0047EE3C: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0047F033
Part of subcall function 0047EE3C: PlaySoundA.WINMM(00000000,00000000,00000001,?,00000000,0047F0FE,?,?,?,00000003,00000000,00000000), ref: 0047F059
Part of subcall function 0047EE3C: CopyFileA.KERNEL32(00000000,00000000,.dcp), ref: 0047F0D1

shutdown.WSOCK32(000000FF,00000002,000000FF,?,00002000,00000000,000000FF,00000002,00000010,015EAA88,00000774), ref: 0047F8B9

Part of subcall function 00405D40: SysFreeString.OLEAUT32(?), ref: 00405D53

Strings

PLUGIN, xrefs: 0047F527
QUICKUP, xrefs: 0047F5DD
FILEEND, xrefs: 0047F7E4

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00489244, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 150networkthread

APIs

socket.WSOCK32(00000002,00000001,00000000,00000000,00489441), ref: 004892BA
ntohs.WSOCK32(00000774), ref: 004892DC
inet_addr.WSOCK32(015EAA88,00000774), ref: 004892F0
gethostbyname.WSOCK32(015EAA88,015EAA88,00000774), ref: 00489308
connect.WSOCK32(00000000,00000002,00000010,015EAA88,00000774), ref: 0048932C
recv.WSOCK32(00000000,?,00000400,00000000,00000000,00000002,00000010,015EAA88,00000774), ref: 00489340

Part of subcall function 00475ECC: send.WSOCK32(?,00000000,?,00000000,00000000,00475F58), ref: 00475F38

recv.WSOCK32(00000000,?,00000400,00000000,?,0048946C,?,DATAFLUX,00000000,?,00000400,00000000,00000000,00000002,00000010,015EAA88), ref: 00489399
send.WSOCK32(00000000,?,00000000,00000000), ref: 004893E3
recv.WSOCK32(00000000,?,00000400,00000000,00000000,?,00000000,00000000), ref: 004893FA
shutdown.WSOCK32(00000000,00000002,00000002,00000001,00000000,00000000,00489441), ref: 00489409
closesocket.WSOCK32(00000000,00000000,00000002,00000002,00000001,00000000,00000000,00489441), ref: 0048940F
ExitThread.KERNEL32(00000000,00000000,00000000,00000002,00000002,00000001,00000000,00000000,00489441), ref: 0048941E

Strings

DATAFLUX, xrefs: 0048934C
AI, xrefs: 0048928B

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00406A68, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfile

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00400000,004917C0), ref: 00406A85
GetProcAddress.KERNEL32(?,GetLongPathNameA,kernel32.dll,?,00400000,004917C0), ref: 00406A9C
lstrcpynA.KERNEL32(?,?,?,?,00400000,004917C0), ref: 00406ACC
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,?,00400000,004917C0), ref: 00406B30

Part of subcall function 00406A48: CharNextA.USER32(?), ref: 00406A4F

lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,00400000,004917C0), ref: 00406B66
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,00400000,004917C0), ref: 00406B79
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,00400000,004917C0), ref: 00406B8B
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,00400000,004917C0), ref: 00406B97
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,00400000), ref: 00406BCB
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll), ref: 00406BD7
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 00406BF9

Strings

GetLongPathNameA, xrefs: 00406A93
\, xrefs: 00406BA9
kernel32.dll, xrefs: 00406A80

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00486E2C, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 178networkthreadsleep

APIs

socket.WSOCK32(00000002,00000001,00000006,00000000,00487046), ref: 00486E87
ntohs.WSOCK32(?,00000002,00000001,00000006,00000000,00487046), ref: 00486EA8
bind.WSOCK32(00000000,00000002,00000010,?,00000002,00000001,00000006,00000000,00487046), ref: 00486EBD
listen.WSOCK32(00000000,00000005,00000000,00000002,00000010,?,00000002,00000001,00000006,00000000,00487046), ref: 00486ECD

Part of subcall function 004870D4: EnterCriticalSection.KERNEL32(0049C3A8,00000000,004872FC,?,?,00000000,?,00000003,00000000,00000000,?,00486F27,00000000,?,?,00000000), ref: 00487110
Part of subcall function 004870D4: LeaveCriticalSection.KERNEL32(0049C3A8,004872E1,004872FC,?,?,00000000,?,00000003,00000000,00000000,?,00486F27,00000000,?,?,00000000), ref: 004872D4

accept.WSOCK32(00000000,?,00000010,00000000,?,?,00000000,00000000,00000005,00000000,00000002,00000010,?,00000002,00000001,00000006), ref: 00486F37
LocalAlloc.KERNEL32(00000040,00000010,00000000,?,00000010,00000000,?,?,00000000,00000000,00000005,00000000,00000002,00000010,?,00000002), ref: 00486F49
CreateThread.KERNEL32(00000000,00000000,Function_00086918,00000000,00000000,?), ref: 00486F83
CloseHandle.KERNEL32(00000000), ref: 00486F89
Sleep.KERNEL32(00000064,00000000,00000000,00000000,Function_00086918,00000000,00000000,?,00000040,00000010,00000000,?,00000010,00000000,?,?), ref: 00486FD0

Part of subcall function 00487488: EnterCriticalSection.KERNEL32(0049C3A8,00000000,00487671,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00487016), ref: 004874B5
Part of subcall function 00487488: closesocket.WSOCK32(00000000,FpH,?,?,?,?,0049C3A8,00000000,00487671,?,?,00000000,?,00000000,00000000,00000000), ref: 0048761C
Part of subcall function 00487488: LeaveCriticalSection.KERNEL32(0049C3A8,00487656,00487671,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00487016), ref: 00487649

ExitThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000010,?,00000002,00000001,00000006,00000000,00487046), ref: 00487018

Strings

ERR|Socket error..|, xrefs: 00486FA4
OK|Successfully started..|, xrefs: 00486EEF
ERR|Cannot listen to port, try another one..|, xrefs: 00486FEE

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048298C, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 119threadnetwork

APIs

socket.WSOCK32(00000002,00000001,00000000,00000000,00482AC1,?,00000000,00482B03), ref: 004829FE
ExitThread.KERNEL32(00000000,00000002,00000001,00000000,00000000,00482AC1,?,00000000,00482B03), ref: 00482A0C
ntohs.WSOCK32(?,00000002,00000001,00000000,00000000,00482AC1,?,00000000,00482B03), ref: 00482A18
inet_addr.WSOCK32(00000000,?,00000002,00000001,00000000,00000000,00482AC1,?,00000000,00482B03), ref: 00482A2A
gethostbyname.WSOCK32(00000000,00000000,?,00000002,00000001,00000000,00000000,00482AC1,?,00000000,00482B03), ref: 00482A40
ExitThread.KERNEL32(00000000,00000000,00000000,?,00000002,00000001,00000000,00000000,00482AC1,?,00000000,00482B03), ref: 00482A4D
connect.WSOCK32(00000000,00000002,00000010,00000000,?,00000002,00000001,00000000,00000000,00482AC1,?,00000000,00482B03), ref: 00482A63
ExitThread.KERNEL32(00000000,00000000,00000000,00000002,00000010,00000000,?,00000002,00000001,00000000,00000000,00482AC1,?,00000000,00482B03), ref: 00482AB2

Part of subcall function 00475E2C: send.WSOCK32(00000248,00000000,?,00000000,00000000,00475EBD), ref: 00475E9D

closesocket.WSOCK32(00000000,?,00482B30,?,PortScanAdd,00000000,00000002,00000010,00000000,?,00000002,00000001,00000000,00000000,00482AC1), ref: 00482A9C
ExitThread.KERNEL32(00000000,00000000,?,00482B30,?,PortScanAdd,00000000,00000002,00000010,00000000,?,00000002,00000001,00000000,00000000,00482AC1), ref: 00482AA3
closesocket.WSOCK32(00000000,00000000,00000002,00000010,00000000,?,00000002,00000001,00000000,00000000,00482AC1,?,00000000,00482B03), ref: 00482AAB

Strings

T)H, xrefs: 004829A6, 00482AEF
PortScanAdd, xrefs: 00482A6C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004836D8, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 99threadnetworksleep

APIs

socket.WSOCK32(00000002,00000001,00000006,00483854,00000000,?,POST /index.php/1.0Host: ,00000000,00483817), ref: 0048373A
ExitThread.KERNEL32(00000000,00000002,00000001,00000006,00483854,00000000,?,POST /index.php/1.0Host: ,00000000,00483817), ref: 00483747
inet_addr.WSOCK32(?,00000002,00000001,00000006,00483854,00000000,?,POST /index.php/1.0Host: ,00000000,00483817), ref: 00483762
ntohs.WSOCK32(00000050,?,00000002,00000001,00000006,00483854,00000000,?,POST /index.php/1.0Host: ,00000000,00483817), ref: 0048376B
gethostbyname.WSOCK32(?,00000050,?,00000002,00000001,00000006,00483854,00000000,?,POST /index.php/1.0Host: ,00000000,00483817), ref: 0048377B
ExitThread.KERNEL32(00000000,?,00000050,?,00000002,00000001,00000006,00483854,00000000,?,POST /index.php/1.0Host: ,00000000,00483817), ref: 00483788
connect.WSOCK32(00000000,00000002,00000010,00000050,?,00000002,00000001,00000006,00483854,00000000,?,POST /index.php/1.0Host: ,00000000,00483817), ref: 0048379E
ExitThread.KERNEL32(00000000,00000000,00000002,00000010,00000050,?,00000002,00000001,00000006,00483854,00000000,?,POST /index.php/1.0Host: ,00000000,00483817), ref: 004837A9

Part of subcall function 00475F68: send.WSOCK32(?,00000000,?,00000000,00000000,00475FCA), ref: 00475FAF

recv.WSOCK32(00000000,?,00000400,00000000,00000000,00000002,00000010,00000050,?,00000002,00000001,00000006,00483854,00000000,?,POST /index.php/1.0Host: ), ref: 004837C7
Sleep.KERNEL32(000003E8,00000000,?,00000400,00000000,00000000,00000002,00000010,00000050,?,00000002,00000001,00000006,00483854,00000000,?), ref: 004837DF
closesocket.WSOCK32(00000000,000003E8,00000000,?,00000400,00000000,00000000,00000002,00000010,00000050,?,00000002,00000001,00000006,00483854,00000000), ref: 004837E5
ExitThread.KERNEL32(00000000,00000000,000003E8,00000000,?,00000400,00000000,00000000,00000002,00000010,00000050,?,00000002,00000001,00000006,00483854), ref: 004837EC

Strings

POST /index.php/1.0Host: , xrefs: 00483708

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00482630, Relevance: 18.1, APIs: 12, Instructions: 116threadnetworksleep

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000000,004827A8), ref: 004826CB
ExitThread.KERNEL32(00000000,00000002,00000001,00000006,?,00000000,004827A8), ref: 004826D8
inet_addr.WSOCK32(00000000,00000002,00000001,00000006,?,00000000,004827A8), ref: 004826F3
ntohs.WSOCK32(00000000,00000000,00000002,00000001,00000006,?,00000000,004827A8), ref: 004826FC
gethostbyname.WSOCK32(00000000,00000000,00000000,00000002,00000001,00000006,?,00000000,004827A8), ref: 0048270C
ExitThread.KERNEL32(00000000,00000000,00000000,00000000,00000002,00000001,00000006,?,00000000,004827A8), ref: 00482719
connect.WSOCK32(00000000,00000002,00000010,00000000,00000000,00000002,00000001,00000006,?,00000000,004827A8), ref: 0048272F
ExitThread.KERNEL32(00000000,00000000,00000002,00000010,00000000,00000000,00000002,00000001,00000006,?,00000000,004827A8), ref: 0048273A

Part of subcall function 004824B0: send.WSOCK32(?,?,00000400,00000000,00000000,00482542), ref: 00482525

recv.WSOCK32(00000000,?,00000400,00000000,00000000,00000002,00000010,00000000,00000000,00000002,00000001,00000006,?,00000000,004827A8), ref: 00482758
Sleep.KERNEL32(000003E8,00000000,?,00000400,00000000,00000000,00000002,00000010,00000000,00000000,00000002,00000001,00000006,?,00000000,004827A8), ref: 00482770
closesocket.WSOCK32(00000000,000003E8,00000000,?,00000400,00000000,00000000,00000002,00000010,00000000,00000000,00000002,00000001,00000006,?,00000000), ref: 00482776
ExitThread.KERNEL32(00000000,00000000,000003E8,00000000,?,00000400,00000000,00000000,00000002,00000010,00000000,00000000,00000002,00000001,00000006,?), ref: 0048277D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004821A0, Relevance: 15.1, APIs: 10, Instructions: 112threadnetworksleep

APIs

socket.WSOCK32(00000002,00000002,00000000,?,00000000,00482302), ref: 0048223B
ExitThread.KERNEL32(00000000,00000002,00000002,00000000,?,00000000,00482302), ref: 00482248
inet_addr.WSOCK32(00000000,00000002,00000002,00000000,?,00000000,00482302), ref: 00482263
ntohs.WSOCK32(00000000,00000000,00000002,00000002,00000000,?,00000000,00482302), ref: 0048226C
gethostbyname.WSOCK32(00000000,00000000,00000000,00000002,00000002,00000000,?,00000000,00482302), ref: 0048227C
ExitThread.KERNEL32(00000000,00000000,00000000,00000000,00000002,00000002,00000000,?,00000000,00482302), ref: 00482289
sendto.WSOCK32(00000000,?,?,00000000,00000002,00000010,00000000,00000000,00000002,00000002,00000000,?,00000000,00482302), ref: 004822B2
Sleep.KERNEL32(000003E8,00000000,?,?,00000000,00000002,00000010,00000000,00000000,00000002,00000002,00000000,?,00000000,00482302), ref: 004822CA
closesocket.WSOCK32(00000000,000003E8,00000000,?,?,00000000,00000002,00000010,00000000,00000000,00000002,00000002,00000000,?,00000000,00482302), ref: 004822D0
ExitThread.KERNEL32(00000000,00000000,000003E8,00000000,?,?,00000000,00000002,00000010,00000000,00000000,00000002,00000002,00000000,?,00000000), ref: 004822D7

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00458910, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64window

APIs

IsIconic.USER32(?), ref: 0045891F
GetWindowPlacement.USER32(?,0000002C), ref: 0045893C
GetWindowRect.USER32(?), ref: 00458955
GetWindowLongA.USER32(?,000000F0), ref: 00458963
GetWindowLongA.USER32(?,000000F8), ref: 00458978
ScreenToClient.USER32(00000000), ref: 00458985
ScreenToClient.USER32(00000000,?), ref: 00458990

Strings

,, xrefs: 00458928

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0043B7D8, Relevance: 12.1, APIs: 8, Instructions: 72window

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0043B7E8
IsIconic.USER32(?), ref: 0043B800
IsWindowVisible.USER32(?), ref: 0043B80C
ShowWindow.USER32(?,00000000), ref: 0043B840
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0043B855
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0043B866
ShowWindow.USER32(?,00000006), ref: 0043B881
ShowWindow.USER32(?,00000005), ref: 0043B88B

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004389B4, Relevance: 10.9, APIs: 7, Instructions: 405window

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 00438ECA

Part of subcall function 00437AE0: SendMessageA.USER32(?,00000234,00000000,00000000), ref: 00437B66
Part of subcall function 00437AE0: DrawMenuBar.USER32(00000000), ref: 00437B77

GetSubMenu.USER32(?,?), ref: 00438AB0

Part of subcall function 00425108: InitializeCriticalSection.KERNEL32(00428600,004285C8,?,00000001,0042875E,?,?,?,004299D5,?,?,004297F5,?,0000000E,00000000,?), ref: 00425128

SaveDC.GDI32(?), ref: 00438C84
RestoreDC.GDI32(?,?), ref: 00438CF8
GetWindowDC.USER32(?), ref: 00438D72
SaveDC.GDI32(?), ref: 00438DA9
RestoreDC.GDI32(?,?), ref: 00438E16

Part of subcall function 00438594: GetMenuItemCount.USER32(?), ref: 004385C0
Part of subcall function 00438594: GetMenuState.USER32(?,00000000,00000400), ref: 004385E0
Part of subcall function 00438594: GetMenuState.USER32(?,00000000,00000400), ref: 00438678

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0043E644, Relevance: 10.9, APIs: 7, Instructions: 356window

APIs

Part of subcall function 00448224: SetActiveWindow.USER32(?), ref: 0044823F
Part of subcall function 00448224: SetFocus.USER32(00000000), ref: 00448289

SetFocus.USER32(00000000), ref: 0043E76F

Part of subcall function 0043F4F4: SendMessageA.USER32(00000000,00000229,00000000,00000000), ref: 0043F51B

Part of subcall function 0044D2F4: GetWindowThreadProcessId.USER32(?), ref: 0044D301
Part of subcall function 0044D2F4: GetCurrentProcessId.KERNEL32(?,00000000,?,004387ED,?,004378A9), ref: 0044D30A
Part of subcall function 0044D2F4: GlobalFindAtomA.KERNEL32(00000000), ref: 0044D31F
Part of subcall function 0044D2F4: GetPropA.USER32(?,00000000), ref: 0044D336

GetParent.USER32(?), ref: 0043E78A

Part of subcall function 00425108: InitializeCriticalSection.KERNEL32(00428600,004285C8,?,00000001,0042875E,?,?,?,004299D5,?,?,004297F5,?,0000000E,00000000,?), ref: 00425128

SaveDC.GDI32(?), ref: 0043E92D
RestoreDC.GDI32(?,?), ref: 0043E99E
GetWindowDC.USER32(00000000), ref: 0043EA0A
SaveDC.GDI32(?), ref: 0043EA41
RestoreDC.GDI32(?,?), ref: 0043EAA5

Part of subcall function 00447EF0: InvalidateRect.USER32(00000000,00000000,000000FF), ref: 00447F83
Part of subcall function 00447EF0: InvalidateRect.USER32(00000000,00000000,000000FF), ref: 00447FB6

Part of subcall function 004556F4: SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000077), ref: 004557E5
Part of subcall function 004556F4: _TrackMouseEvent.COMCTL32(00000010), ref: 00455A9D
Part of subcall function 004556F4: DefWindowProcA.USER32(00000000,?,?,?), ref: 00455AEF
Part of subcall function 004556F4: GetCapture.USER32 ref: 00455B5A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00471850, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 97service

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,00471976,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00471890
CreateServiceA.ADVAPI32(00000000,?,?,000F01FF,00000110,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047193B), ref: 004718D1

Part of subcall function 004711E8: RegCreateKeyA.ADVAPI32(?,00000000,?), ref: 0047122E
Part of subcall function 004711E8: RegSetValueExA.ADVAPI32(?,00000000,00000000,00000002,00000000,?,00000000,00471291), ref: 0047125A
Part of subcall function 004711E8: RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000002,00000000,?,00000000,00471291), ref: 00471269

CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,000F01FF,00000110,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00471926
CloseServiceHandle.ADVAPI32(00000000,00000000,?,00000000,?,?,000F01FF,00000110,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0047192C

Strings

Description, xrefs: 00471916
System\CurrentControlSet\Services\, xrefs: 004718F7

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004714B8, Relevance: 10.6, APIs: 7, Instructions: 89service

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,0047159E), ref: 004714FD
OpenServiceA.ADVAPI32(00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 0047152D
StartServiceA.ADVAPI32(00000000,00000000,?,00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 00471555
ControlService.ADVAPI32(00000000,00000001,?,00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 00471563
QueryServiceStatus.ADVAPI32(00000000,?,00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 0047156D
CloseServiceHandle.ADVAPI32(00000000,00000000,?,00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 00471573
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 00471579

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048A070, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51shutdown

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0048A083
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0048A089
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000000), ref: 0048A0A4
AdjustTokenPrivileges.ADVAPI32(00000002,00000000,00000002,00000010,?,?,00000000), ref: 0048A0E5
ExitWindowsEx.USER32(00000012,00000000), ref: 0048A0ED

Strings

SeShutdownPrivilege, xrefs: 0048A09D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042E370, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46window

APIs

IsIconic.USER32(?), ref: 0042E3B9
GetWindowPlacement.USER32(?,?), ref: 0042E3C7
GetWindowRect.USER32(?,?), ref: 0042E3D3

Part of subcall function 0042E2E0: GetSystemMetrics.USER32(00000000), ref: 0042E331
Part of subcall function 0042E2E0: GetSystemMetrics.USER32(00000001), ref: 0042E33D

Part of subcall function 0042E174: GetProcAddress.KERNEL32(76C70000,00000000,00000000,0042E231), ref: 0042E1F3

Strings

pB, xrefs: 0042E38C, 0042E399, 0042E3A0
MonitorFromWindow, xrefs: 0042E387

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004715B0, Relevance: 7.5, APIs: 5, Instructions: 49service

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,0047162F), ref: 004715DB
OpenServiceA.ADVAPI32(00000000,00000000,00010000,00000000,00000000,000F003F,00000000,0047162F), ref: 004715F5
DeleteService.ADVAPI32(00000000,00000000,00000000,00010000,00000000,00000000,000F003F,00000000,0047162F), ref: 00471601
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000000,00010000,00000000,00000000,000F003F,00000000,0047162F), ref: 0047160E
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00010000,00000000,00000000,000F003F,00000000,0047162F), ref: 00471614

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00474D58, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57memoryinjection

APIs

VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040,00000000,00474DDE,?,DCPERSFWBP,?,?,00000000,00000000,00000000,?,004755A7), ref: 00474D98
WriteProcessMemory.KERNEL32(?,00000000,kernel32.dll,?,?,?,00000000,?,00003000,00000040,00000000,00474DDE,?,DCPERSFWBP,?,?), ref: 00474DBE

Strings

DCPERSFWBP, xrefs: 00474D63
kernel32.dll, xrefs: 00474DBB

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00466038, Relevance: 6.1, APIs: 4, Instructions: 80memory

APIs

FreeLibrary.KERNEL32(00000000,?,?,00000000,?,00000000,00465C6C), ref: 004660A7
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,00000000,00465C6C), ref: 004660D8
GetProcessHeap.KERNEL32(00000000,?,?,?,00000000,?,00000000,00465C6C), ref: 004660E0
HeapFree.KERNEL32(00000000,00000000,?), ref: 004660E6

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048A218, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45

APIs

ShellExecuteExA.SHELL32(0000003C,00000000,0048A2A4), ref: 0048A283

Strings

runas, xrefs: 0048A268
<, xrefs: 0048A24C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00471640, Relevance: 4.6, APIs: 3, Instructions: 140service

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000005,00000000,00471828), ref: 004716A2
EnumServicesStatusA.ADVAPI32(00000000,0000013F,00000003,?,00004800,?,?,?), ref: 004716DC

Part of subcall function 004714B8: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,0047159E), ref: 004714FD
Part of subcall function 004714B8: OpenServiceA.ADVAPI32(00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 0047152D
Part of subcall function 004714B8: StartServiceA.ADVAPI32(00000000,00000000,?,00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 00471555
Part of subcall function 004714B8: ControlService.ADVAPI32(00000000,00000001,?,00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 00471563
Part of subcall function 004714B8: QueryServiceStatus.ADVAPI32(00000000,?,00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 0047156D
Part of subcall function 004714B8: CloseServiceHandle.ADVAPI32(00000000,00000000,?,00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 00471573
Part of subcall function 004714B8: CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000020,00000000,00000000,000F003F,00000000,0047159E), ref: 00471579

CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000005,00000000,00471828), ref: 00471805

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00428418, Relevance: 4.6, APIs: 3, Instructions: 51fileclipboard

APIs

GetClipboardData.USER32(0000000E), ref: 00428425
CopyEnhMetaFileA.GDI32(00000000,00000000), ref: 00428447
GetEnhMetaFileHeader.GDI32(?,00000064,?), ref: 00428459

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004576CC, Relevance: 3.1, APIs: 2, Instructions: 64window

APIs

IsIconic.USER32(?), ref: 00457704
GetCapture.USER32 ref: 0045770D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00460628, Relevance: 3.0, APIs: 2, Instructions: 50

APIs

Part of subcall function 004606CC: inet_addr.WSOCK32(00000000), ref: 004606F6
Part of subcall function 004606CC: gethostbyname.WSOCK32(00000000), ref: 00460711

inet_addr.WSOCK32(00000000,00000000,004606BD), ref: 00460679

Part of subcall function 004607A4: getservbyname.WSOCK32(00000000,00000000,?,?,?,0046068D,00000000,00000000,004606BD), ref: 004607BA
Part of subcall function 004607A4: ntohs.WSOCK32(?,00000000,00000000,?,?,?,0046068D,00000000,00000000,004606BD), ref: 004607C8

ntohs.WSOCK32(00000000,00000000,00000000,004606BD), ref: 0046068E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00425A70, Relevance: 3.0, APIs: 2, Instructions: 46window

APIs

GetLastError.KERNEL32(00000000,00425B0C), ref: 00425A90
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,00425B0C), ref: 00425AB6

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040A488, Relevance: 3.0, APIs: 2, Instructions: 33file

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,?,00461DB1,00000000,00461F3B), ref: 0040A4A3
GetLastError.KERNEL32(00000000,?,?,?,?,00461DB1,00000000,00461F3B), ref: 0040A4C8

Part of subcall function 0040A404: FindNextFileA.KERNEL32(?,?), ref: 0040A415
Part of subcall function 0040A404: GetLastError.KERNEL32(?,?), ref: 0040A41E
Part of subcall function 0040A404: FileTimeToLocalFileTime.KERNEL32(?), ref: 0040A434
Part of subcall function 0040A404: FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 0040A443

Part of subcall function 0040A4FC: FindClose.KERNEL32(?,?,0040A4C6,00000000,?,?,?,?,00461DB1,00000000,00461F3B), ref: 0040A508

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004607A4, Relevance: 3.0, APIs: 2, Instructions: 28

APIs

getservbyname.WSOCK32(00000000,00000000,?,?,?,0046068D,00000000,00000000,004606BD), ref: 004607BA
ntohs.WSOCK32(?,00000000,00000000,?,?,?,0046068D,00000000,00000000,004606BD), ref: 004607C8

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00474DF0, Relevance: 3.0, APIs: 2, Instructions: 28memoryinjection

APIs

VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040,?,?,00475328,?,?,00474E3D,DCPERSFWBP,?,?), ref: 00474E06
WriteProcessMemory.KERNEL32(?,00000000,?,?,?,?,00000000,?,00003000,00000040,?,?,00475328,?,?,00474E3D), ref: 00474E12

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0046ADBC, Relevance: 1.6, Strings: 1, Instructions: 368

Strings

@, xrefs: 0046B197

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00480FEC, Relevance: 1.6, APIs: 1, Instructions: 57file

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0048109E), ref: 0048101E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040A746, Relevance: 1.6, APIs: 1, Instructions: 50

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 0040A769

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00473560, Relevance: 1.5, APIs: 1, Instructions: 42filenetwork

APIs

FtpPutFileA.WININET(00000000,00000000,00000000,00000002,00000000), ref: 004735B2

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040D334, Relevance: 1.5, APIs: 1, Instructions: 29

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0040D352

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048CEEC, Relevance: 1.5, APIs: 1, Instructions: 24

APIs

GetLocaleInfoA.KERNEL32(00000400,0000005A,00000005,00000005), ref: 0048CF00

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040D380, Relevance: 1.5, APIs: 1, Instructions: 23

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040EC7E,00000000,0040EE97,?,?,00000000,00000000), ref: 0040D393

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0043B75C, Relevance: 1.5, APIs: 1, Instructions: 10window

APIs

IsIconic.USER32(?), ref: 0043B773

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0045EC78, Relevance: .9, Instructions: 908

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0046797C, Relevance: .2, Instructions: 238

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00402370, Relevance: .1, Instructions: 94

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004064C0, Relevance: .1, Instructions: 64

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040838E, Relevance: .0, Instructions: 2

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042F204, Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 266libraryloader

APIs

LoadLibraryA.KERNEL32(uxtheme.dll), ref: 0042F23A
GetProcAddress.KERNEL32(00000000,OpenThemeData,uxtheme.dll,00000000,0042F5B7), ref: 0042F252
GetProcAddress.KERNEL32(00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000,0042F5B7), ref: 0042F264
GetProcAddress.KERNEL32(00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000,0042F5B7), ref: 0042F276
GetProcAddress.KERNEL32(00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000,0042F5B7), ref: 0042F288
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000,0042F5B7), ref: 0042F29A
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000,0042F5B7), ref: 0042F2AC
GetProcAddress.KERNEL32(00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000), ref: 0042F2BE
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData), ref: 0042F2D0
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData), ref: 0042F2E2
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground), ref: 0042F2F4
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText), ref: 0042F306
GetProcAddress.KERNEL32(00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect), ref: 0042F318
GetProcAddress.KERNEL32(00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect), ref: 0042F32A
GetProcAddress.KERNEL32(00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize), ref: 0042F33C
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent), ref: 0042F34E
GetProcAddress.KERNEL32(00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics), ref: 0042F360
GetProcAddress.KERNEL32(00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion), ref: 0042F372
GetProcAddress.KERNEL32(00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground), ref: 0042F384
GetProcAddress.KERNEL32(00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge), ref: 0042F396
GetProcAddress.KERNEL32(00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon), ref: 0042F3A8
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined), ref: 0042F3BA
GetProcAddress.KERNEL32(00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent), ref: 0042F3CC
GetProcAddress.KERNEL32(00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor), ref: 0042F3DE
GetProcAddress.KERNEL32(00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric), ref: 0042F3F0
GetProcAddress.KERNEL32(00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString), ref: 0042F402
GetProcAddress.KERNEL32(00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool), ref: 0042F414
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt), ref: 0042F426
GetProcAddress.KERNEL32(00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue), ref: 0042F438
GetProcAddress.KERNEL32(00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition), ref: 0042F44A
GetProcAddress.KERNEL32(00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont), ref: 0042F45C
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect), ref: 0042F46E
GetProcAddress.KERNEL32(00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins), ref: 0042F480
GetProcAddress.KERNEL32(00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList), ref: 0042F492
GetProcAddress.KERNEL32(00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin), ref: 0042F4A4
GetProcAddress.KERNEL32(00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme), ref: 0042F4B6
GetProcAddress.KERNEL32(00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename), ref: 0042F4C8
GetProcAddress.KERNEL32(00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor), ref: 0042F4DA
GetProcAddress.KERNEL32(00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush), ref: 0042F4EC
GetProcAddress.KERNEL32(00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool), ref: 0042F4FE
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize), ref: 0042F510
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont), ref: 0042F522
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString), ref: 0042F534
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt), ref: 0042F546
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive), ref: 0042F558
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed), ref: 0042F56A
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground,00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme), ref: 0042F57C
GetProcAddress.KERNEL32(00000000,EnableTheming,00000000,DrawThemeParentBackground,00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture), ref: 0042F58E

Strings

EnableTheming, xrefs: 0042F586
CloseThemeData, xrefs: 0042F25C
DrawThemeText, xrefs: 0042F280
GetThemePosition, xrefs: 0042F3C4
IsThemeBackgroundPartiallyTransparent, xrefs: 0042F346
GetThemeBool, xrefs: 0042F38E
GetThemeTextMetrics, xrefs: 0042F2DA
IsThemeDialogTextureEnabled, xrefs: 0042F51A
GetThemeMetric, xrefs: 0042F36A
GetThemeSysInt, xrefs: 0042F4C0
GetThemeInt, xrefs: 0042F3A0
SetThemeAppProperties, xrefs: 0042F53E
IsAppThemed, xrefs: 0042F4E4
EnableThemeDialogTexture, xrefs: 0042F508
GetThemeEnumValue, xrefs: 0042F3B2
GetThemeSysSize, xrefs: 0042F48A
GetThemeTextExtent, xrefs: 0042F2C8
DrawThemeBackground, xrefs: 0042F26E
GetThemeBackgroundRegion, xrefs: 0042F2EC
IsThemeActive, xrefs: 0042F4D2
GetThemeBackgroundContentRect, xrefs: 0042F292, 0042F2A4
uxtheme.dll, xrefs: 0042F235
GetThemeSysString, xrefs: 0042F4AE
DrawThemeEdge, xrefs: 0042F310
GetThemeFilename, xrefs: 0042F442
GetThemeIntList, xrefs: 0042F40C
GetThemeSysBool, xrefs: 0042F478
GetThemeSysColor, xrefs: 0042F454
GetThemeFont, xrefs: 0042F3D6
GetWindowTheme, xrefs: 0042F4F6
GetThemeMargins, xrefs: 0042F3FA
GetThemeSysColorBrush, xrefs: 0042F466
GetCurrentThemeName, xrefs: 0042F550
GetThemeAppProperties, xrefs: 0042F52C
GetThemePropertyOrigin, xrefs: 0042F41E
OpenThemeData, xrefs: 0042F24A
GetThemeSysFont, xrefs: 0042F49C
GetThemeRect, xrefs: 0042F3E8
GetThemeDocumentationProperty, xrefs: 0042F562
IsThemePartDefined, xrefs: 0042F334
SetWindowTheme, xrefs: 0042F430
GetThemePartSize, xrefs: 0042F2B6
GetThemeColor, xrefs: 0042F358
DrawThemeParentBackground, xrefs: 0042F574
DrawThemeIcon, xrefs: 0042F322
GetThemeString, xrefs: 0042F37C
HitTestThemeBackground, xrefs: 0042F2FE

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004754C4, Relevance: 87.7, APIs: 29, Strings: 21, Instructions: 233libraryloaderprocess

APIs

Part of subcall function 0040A26C: GetFileAttributesA.KERNEL32(00000000,?,0048F947,.dcp,?,?,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040A277

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 00475590

Part of subcall function 00474D58: VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040,00000000,00474DDE,?,DCPERSFWBP,?,?,00000000,00000000,00000000,?,004755A7), ref: 00474D98
Part of subcall function 00474D58: WriteProcessMemory.KERNEL32(?,00000000,kernel32.dll,?,?,?,00000000,?,00003000,00000040,00000000,00474DDE,?,DCPERSFWBP,?,?), ref: 00474DBE

GetModuleHandleA.KERNEL32(kernel32,LoadLibraryA,00000000,00475829,?,?,?,?,?,00490626), ref: 004756B4
GetProcAddress.KERNEL32(00000000,kernel32,LoadLibraryA,00000000,00475829,?,?,?,?,?,00490626), ref: 004756BA
GetModuleHandleA.KERNEL32(kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829,?,?,?,?,?,00490626), ref: 004756CB
GetProcAddress.KERNEL32(00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829,?,?,?,?,?,00490626), ref: 004756D1
GetModuleHandleA.KERNEL32(kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829,?,?,?,?,?,00490626), ref: 004756E3
GetProcAddress.KERNEL32(00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829), ref: 004756E9
GetModuleHandleA.KERNEL32(user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829), ref: 004756FB
GetProcAddress.KERNEL32(00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829), ref: 00475701
GetModuleHandleA.KERNEL32(kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00475829), ref: 00475713
GetProcAddress.KERNEL32(00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000), ref: 00475719
GetModuleHandleA.KERNEL32(kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32), ref: 0047572B
GetProcAddress.KERNEL32(00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000), ref: 00475731
GetModuleHandleA.KERNEL32(kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32), ref: 00475743
GetProcAddress.KERNEL32(00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32,Sleep,00000000), ref: 00475749
GetModuleHandleA.KERNEL32(kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000,kernel32), ref: 0047575B
GetProcAddress.KERNEL32(00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32,MessageBoxA,00000000), ref: 00475761
GetModuleHandleA.KERNEL32(kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000,user32), ref: 00475773
GetProcAddress.KERNEL32(00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32,CloseHandle,00000000), ref: 00475779
GetModuleHandleA.KERNEL32(kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000,kernel32), ref: 0047578B
GetProcAddress.KERNEL32(00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32,CreateProcessA,00000000), ref: 00475791
GetModuleHandleA.KERNEL32(kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000,kernel32), ref: 004757A3
GetProcAddress.KERNEL32(00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32,GetLastError,00000000), ref: 004757A9
GetModuleHandleA.KERNEL32(kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000,kernel32), ref: 004757BB
GetProcAddress.KERNEL32(00000000,kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32,SetLastError,00000000), ref: 004757C1
GetModuleHandleA.KERNEL32(kernel32,WaitForSingleObject,00000000,kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000,kernel32), ref: 004757D3
GetProcAddress.KERNEL32(00000000,kernel32,WaitForSingleObject,00000000,kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32,CreateMutexA,00000000), ref: 004757D9
GetModuleHandleA.KERNEL32(kernel32,OpenProcess,00000000,kernel32,WaitForSingleObject,00000000,kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000,kernel32), ref: 004757EB
GetProcAddress.KERNEL32(00000000,kernel32,OpenProcess,00000000,kernel32,WaitForSingleObject,00000000,kernel32,TerminateProcess,00000000,kernel32,ExitThread,00000000,kernel32,GetExitCodeProcess,00000000), ref: 004757F1

Part of subcall function 00474E20: CreateRemoteThread.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00474E5E
Part of subcall function 00474E20: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00474E6E
Part of subcall function 00474E20: ReadProcessMemory.KERNEL32(?,00000000,?,?,?,DCPERSFWBP,?,?), ref: 00474E81

Part of subcall function 0040F234: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,?,0048F90F,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040F24B

Strings

ExitThread, xrefs: 00475622, 00475799
kernel32, xrefs: 004756AF, 004756C6, 004756DE, 0047570E, 00475726, 0047573E, 00475756, 0047576E, 00475786, 0047579E, 004757B6, 004757CE, 004757E6
GetProcAddress, xrefs: 004756C1
TerminateProcess, xrefs: 0047564C, 004757B1
notepad, xrefs: 00475543
CreateMutexA, xrefs: 00475604, 00475769
kernel32.dll, xrefs: 0047559B
user32.dll, xrefs: 004755AA
SetLastError, xrefs: 004755F5, 00475751
D, xrefs: 00475517
DCPERSFWBP, xrefs: 00475563
Sleep, xrefs: 004755B9, 004756D9
GetExitCodeProcess, xrefs: 0047565B, 00475781
user32, xrefs: 004756F6
WaitForSingleObject, xrefs: 0047567E, 004757C9
LoadLibraryA, xrefs: 004756AA
OpenProcess, xrefs: 00475631, 004757E1
MessageBoxA, xrefs: 004755C8, 004756F1
CreateProcessA, xrefs: 004755D7, 00475721
GetLastError, xrefs: 004755E6, 00475739
CloseHandle, xrefs: 00475613, 00475709

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00460DDC, Relevance: 75.4, APIs: 24, Strings: 19, Instructions: 132libraryloader

APIs

LoadLibraryA.KERNEL32(PSAPI.dll), ref: 00460DF0
GetProcAddress.KERNEL32(00000000,EnumProcesses,PSAPI.dll,?,00461159), ref: 00460E0C
GetProcAddress.KERNEL32(00000000,EnumProcessModules,00000000,EnumProcesses,PSAPI.dll,?,00461159), ref: 00460E1E
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameA,00000000,EnumProcessModules,00000000,EnumProcesses,PSAPI.dll,?,00461159), ref: 00460E30
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,EnumProcessModules,00000000,EnumProcesses,PSAPI.dll,?,00461159), ref: 00460E42
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameA,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,EnumProcessModules,00000000,EnumProcesses,PSAPI.dll,?,00461159), ref: 00460E54
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,EnumProcessModules,00000000,EnumProcesses,PSAPI.dll,?,00461159), ref: 00460E66
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,EnumProcessModules,00000000,EnumProcesses,PSAPI.dll), ref: 00460E78
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW,00000000,GetModuleBaseNameW,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,EnumProcessModules,00000000,EnumProcesses), ref: 00460E8A
GetProcAddress.KERNEL32(00000000,GetModuleInformation,00000000,GetModuleFileNameExW,00000000,GetModuleBaseNameW,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,EnumProcessModules), ref: 00460E9C
GetProcAddress.KERNEL32(00000000,EmptyWorkingSet,00000000,GetModuleInformation,00000000,GetModuleFileNameExW,00000000,GetModuleBaseNameW,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA), ref: 00460EAE
GetProcAddress.KERNEL32(00000000,QueryWorkingSet,00000000,EmptyWorkingSet,00000000,GetModuleInformation,00000000,GetModuleFileNameExW,00000000,GetModuleBaseNameW,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA,00000000,GetModuleFileNameExA), ref: 00460EC0
GetProcAddress.KERNEL32(00000000,InitializeProcessForWsWatch,00000000,QueryWorkingSet,00000000,EmptyWorkingSet,00000000,GetModuleInformation,00000000,GetModuleFileNameExW,00000000,GetModuleBaseNameW,00000000,GetModuleFileNameExA,00000000,GetModuleBaseNameA), ref: 00460ED2
GetProcAddress.KERNEL32(00000000,GetMappedFileNameA,00000000,InitializeProcessForWsWatch,00000000,QueryWorkingSet,00000000,EmptyWorkingSet,00000000,GetModuleInformation,00000000,GetModuleFileNameExW,00000000,GetModuleBaseNameW,00000000,GetModuleFileNameExA), ref: 00460EE4
GetProcAddress.KERNEL32(00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,InitializeProcessForWsWatch,00000000,QueryWorkingSet,00000000,EmptyWorkingSet,00000000,GetModuleInformation,00000000,GetModuleFileNameExW,00000000,GetModuleBaseNameW), ref: 00460EF6
GetProcAddress.KERNEL32(00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,InitializeProcessForWsWatch,00000000,QueryWorkingSet,00000000,EmptyWorkingSet,00000000,GetModuleInformation,00000000,GetModuleFileNameExW), ref: 00460F08
GetProcAddress.KERNEL32(00000000,GetMappedFileNameA,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,InitializeProcessForWsWatch,00000000,QueryWorkingSet,00000000,EmptyWorkingSet,00000000,GetModuleInformation), ref: 00460F1A
GetProcAddress.KERNEL32(00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,InitializeProcessForWsWatch,00000000,QueryWorkingSet,00000000,EmptyWorkingSet), ref: 00460F2C
GetProcAddress.KERNEL32(00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,InitializeProcessForWsWatch,00000000,QueryWorkingSet), ref: 00460F3E
GetProcAddress.KERNEL32(00000000,GetMappedFileNameW,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,InitializeProcessForWsWatch), ref: 00460F50
GetProcAddress.KERNEL32(00000000,GetDeviceDriverBaseNameW,00000000,GetMappedFileNameW,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA), ref: 00460F62
GetProcAddress.KERNEL32(00000000,GetDeviceDriverFileNameW,00000000,GetDeviceDriverBaseNameW,00000000,GetMappedFileNameW,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA), ref: 00460F74
GetProcAddress.KERNEL32(00000000,EnumDeviceDrivers,00000000,GetDeviceDriverFileNameW,00000000,GetDeviceDriverBaseNameW,00000000,GetMappedFileNameW,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA,00000000,GetDeviceDriverFileNameA), ref: 00460F86
GetProcAddress.KERNEL32(00000000,GetProcessMemoryInfo,00000000,EnumDeviceDrivers,00000000,GetDeviceDriverFileNameW,00000000,GetDeviceDriverBaseNameW,00000000,GetMappedFileNameW,00000000,GetDeviceDriverFileNameA,00000000,GetDeviceDriverBaseNameA,00000000,GetMappedFileNameA), ref: 00460F98

Strings

GetDeviceDriverFileNameA, xrefs: 00460F00, 00460F36
GetModuleInformation, xrefs: 00460E94
QueryWorkingSet, xrefs: 00460EB8
EnumProcessModules, xrefs: 00460E16
InitializeProcessForWsWatch, xrefs: 00460ECA
GetMappedFileNameA, xrefs: 00460EDC, 00460F12
GetDeviceDriverFileNameW, xrefs: 00460F6C
GetDeviceDriverBaseNameA, xrefs: 00460EEE, 00460F24
PSAPI.dll, xrefs: 00460DEB
EnumProcesses, xrefs: 00460E04
EnumDeviceDrivers, xrefs: 00460F7E
GetModuleBaseNameA, xrefs: 00460E28, 00460E4C
GetModuleFileNameExA, xrefs: 00460E3A, 00460E5E
GetDeviceDriverBaseNameW, xrefs: 00460F5A
EmptyWorkingSet, xrefs: 00460EA6
GetModuleFileNameExW, xrefs: 00460E82
GetModuleBaseNameW, xrefs: 00460E70
GetMappedFileNameW, xrefs: 00460F48
GetProcessMemoryInfo, xrefs: 00460F90

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00474F80, Relevance: 68.4, APIs: 23, Strings: 16, Instructions: 193libraryloaderprocess

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0047500B

Part of subcall function 0040A26C: GetFileAttributesA.KERNEL32(00000000,?,0048F947,.dcp,?,?,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040A277

Part of subcall function 00474D58: VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040,00000000,00474DDE,?,DCPERSFWBP,?,?,00000000,00000000,00000000,?,004755A7), ref: 00474D98
Part of subcall function 00474D58: WriteProcessMemory.KERNEL32(?,00000000,kernel32.dll,?,?,?,00000000,?,00003000,00000040,00000000,00474DDE,?,DCPERSFWBP,?,?), ref: 00474DBE

GetModuleHandleA.KERNEL32(kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?,00000000,00475246), ref: 0047511C
GetProcAddress.KERNEL32(00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?,00000000,00475246), ref: 00475122
GetModuleHandleA.KERNEL32(kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?,00000000), ref: 00475133
GetProcAddress.KERNEL32(00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 00475139
GetModuleHandleA.KERNEL32(kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000,00000000), ref: 0047514B
GetProcAddress.KERNEL32(00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000,08000000,00000000), ref: 00475151
GetModuleHandleA.KERNEL32(kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000,00000000), ref: 00475163
GetProcAddress.KERNEL32(00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000,00000000,00000000), ref: 00475169
GetModuleHandleA.KERNEL32(kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000,00000000), ref: 0047517B
GetProcAddress.KERNEL32(00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32,LoadLibraryA,00000000), ref: 00475181
GetModuleHandleA.KERNEL32(kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000,kernel32), ref: 00475193
GetProcAddress.KERNEL32(00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32,GetProcAddress,00000000), ref: 00475199
GetModuleHandleA.KERNEL32(kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000,kernel32), ref: 004751AB
GetProcAddress.KERNEL32(00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32,Sleep,00000000), ref: 004751B1
GetModuleHandleA.KERNEL32(kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000,kernel32), ref: 004751C3
GetProcAddress.KERNEL32(00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32,MessageBoxA,00000000), ref: 004751C9
GetModuleHandleA.KERNEL32(kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000,kernel32), ref: 004751DB
GetProcAddress.KERNEL32(00000000,kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32,ExitThread,00000000), ref: 004751E1
GetModuleHandleA.KERNEL32(kernel32,OpenProcess,00000000,kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000,kernel32), ref: 004751F3
GetProcAddress.KERNEL32(00000000,kernel32,OpenProcess,00000000,kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32,DeleteFileA,00000000), ref: 004751F9
GetModuleHandleA.KERNEL32(kernel32,GetExitCodeProcess,00000000,kernel32,OpenProcess,00000000,kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000,kernel32), ref: 0047520B
GetProcAddress.KERNEL32(00000000,kernel32,GetExitCodeProcess,00000000,kernel32,OpenProcess,00000000,kernel32,CloseHandle,00000000,kernel32,TerminateProcess,00000000,kernel32,GetLastError,00000000), ref: 00475211

Part of subcall function 00474E20: CreateRemoteThread.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00474E5E
Part of subcall function 00474E20: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00474E6E
Part of subcall function 00474E20: ReadProcessMemory.KERNEL32(?,00000000,?,?,?,DCPERSFWBP,?,?), ref: 00474E81

Part of subcall function 0040F234: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,?,0048F90F,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040F24B

Strings

DeleteFileA, xrefs: 0047509B, 00475189
user32.dll, xrefs: 0047505F
LoadLibraryA, xrefs: 00475112
Sleep, xrefs: 0047506E, 00475141
notepad, xrefs: 00475025
OpenProcess, xrefs: 004750D7, 004751E9
kernel32.dll, xrefs: 00475050
GetProcAddress, xrefs: 00475129
ExitThread, xrefs: 0047508C, 00475171
TerminateProcess, xrefs: 004750B9, 004751B9
kernel32, xrefs: 00475117, 0047512E, 00475146, 0047515E, 00475176, 0047518E, 004751A6, 004751BE, 004751D6, 004751EE, 00475206
MessageBoxA, xrefs: 0047507D, 00475159
CloseHandle, xrefs: 004750C8, 004751D1
GetLastError, xrefs: 004750AA, 004751A1
GetExitCodeProcess, xrefs: 004750E6, 00475201
D, xrefs: 00474FC9

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0045D6E8, Relevance: 49.1, APIs: 15, Strings: 13, Instructions: 95libraryloader

APIs

SetErrorMode.KERNEL32(00008000), ref: 0045D701
GetModuleHandleA.KERNEL32(USER32,00000000,0045D84E,?,00008000), ref: 0045D725
GetProcAddress.KERNEL32(00000000,WINNLSEnableIME,USER32,00000000,0045D84E,?,00008000), ref: 0045D732
LoadLibraryA.KERNEL32(imm32.dll), ref: 0045D74E
GetProcAddress.KERNEL32(00000000,ImmGetContext,imm32.dll,00000000,0045D84E,?,00008000), ref: 0045D770
GetProcAddress.KERNEL32(00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,0045D84E,?,00008000), ref: 0045D785
GetProcAddress.KERNEL32(00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,0045D84E,?,00008000), ref: 0045D79A
GetProcAddress.KERNEL32(00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,0045D84E,?,00008000), ref: 0045D7AF
GetProcAddress.KERNEL32(00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,0045D84E,?,00008000), ref: 0045D7C4
GetProcAddress.KERNEL32(00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,0045D84E), ref: 0045D7D9
GetProcAddress.KERNEL32(00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000), ref: 0045D7EE
GetProcAddress.KERNEL32(00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext), ref: 0045D803
GetProcAddress.KERNEL32(00000000,ImmIsIME,00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext), ref: 0045D818
GetProcAddress.KERNEL32(00000000,ImmNotifyIME,00000000,ImmIsIME,00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus), ref: 0045D82D
SetErrorMode.KERNEL32(?,0045D855,00008000), ref: 0045D848

Strings

USER32, xrefs: 0045D720
ImmReleaseContext, xrefs: 0045D77A
ImmNotifyIME, xrefs: 0045D822
ImmIsIME, xrefs: 0045D80D
ImmGetConversionStatus, xrefs: 0045D78F
ImmSetCompositionFontA, xrefs: 0045D7E3
ImmGetCompositionStringA, xrefs: 0045D7F8
ImmSetCompositionWindow, xrefs: 0045D7CE
ImmGetContext, xrefs: 0045D765
imm32.dll, xrefs: 0045D749
ImmSetOpenStatus, xrefs: 0045D7B9
WINNLSEnableIME, xrefs: 0045D72C
ImmSetConversionStatus, xrefs: 0045D7A4

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004104F0, Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 004104F9

Part of subcall function 004104C4: GetProcAddress.KERNEL32(00000000), ref: 004104DD

Strings

VarMod, xrefs: 004105B7
VarBstrFromCy, xrefs: 004106A9
VarBstrFromBool, xrefs: 004106D5
VarAnd, xrefs: 004105CD
VarDateFromStr, xrefs: 00410667
oleaut32.dll, xrefs: 004104F4
VariantChangeTypeEx, xrefs: 00410507
VarCmp, xrefs: 0041060F
VarBstrFromDate, xrefs: 004106BF
VarBoolFromStr, xrefs: 00410693
VarR8FromStr, xrefs: 00410651
VarR4FromStr, xrefs: 0041063B
VarDiv, xrefs: 0041058B
VarSub, xrefs: 0041055F
VarNeg, xrefs: 0041051D
VarAdd, xrefs: 00410549
VarOr, xrefs: 004105E3
VarMul, xrefs: 00410575
VarI4FromStr, xrefs: 00410625
VarCyFromStr, xrefs: 0041067D
VarIdiv, xrefs: 004105A1
VarXor, xrefs: 004105F9
VarNot, xrefs: 00410533

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0047EE3C, Relevance: 37.0, APIs: 10, Strings: 11, Instructions: 210file

APIs

ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 0047EEA0
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 0047EF11
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 0047EF31
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 0047EF60

Part of subcall function 00475BD8: closesocket.WSOCK32(00000248,00000000,00475D47,?,00000000,00475D76,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00475D2E
Part of subcall function 00475BD8: GetCurrentProcessId.KERNEL32(00000248,00000000,00475D47,?,00000000,00475D76,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00475D33

ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0047EF96
CopyFileA.KERNEL32(00000000,00000000,.dcp), ref: 0047F0D1

Part of subcall function 00489C78: GetSystemDirectoryA.KERNEL32(00000000,?), ref: 00489CB4

SetFileAttributesA.KERNEL32(00000000,00000080,?,00000000,0047F0FE,?,?,?,00000003,00000000,00000000), ref: 0047EFD6
DeleteFileA.KERNEL32(00000000,00000000,00000080,?,00000000,0047F0FE,?,?,?,00000003,00000000,00000000), ref: 0047EFFF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0047F033
PlaySoundA.WINMM(00000000,00000000,00000001,?,00000000,0047F0FE,?,?,?,00000003,00000000,00000000), ref: 0047F059

Strings

UPANDEXEC, xrefs: 0047EF74
UPLOADEXEC, xrefs: 0047EE7E
BATCH, xrefs: 0047EEC3
drivers\etc\hosts, xrefs: 0047EFC3, 0047EFE6, 0047F017
GENCODE, xrefs: 0047F0A0
UPDATE, xrefs: 0047EF3E
open, xrefs: 0047EE99, 0047EF0A, 0047EF2A, 0047EF59, 0047EF8F
HOSTS, xrefs: 0047EFA3
.dcp, xrefs: 0047F0AD
SOUND, xrefs: 0047F040
EDITSVR, xrefs: 0047F063

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00489580, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 221pipewindowsleep

APIs

CreatePipe.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 004895ED
CreatePipe.KERNEL32(?,?,00000000,00000000,FFFFFFFF,?,00000000,00000000), ref: 004895FD
GetEnvironmentVariableA.KERNEL32(COMSPEC,?,00000104,?,?,00000000,00000000,FFFFFFFF,?,00000000,00000000), ref: 00489613
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?), ref: 00489668
Sleep.KERNEL32(000007D0,00000000,?,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,COMSPEC,?,00000104,?,?), ref: 00489685
TranslateMessage.USER32(?), ref: 00489693
DispatchMessageA.USER32(?), ref: 0048969F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004896B3
GetExitCodeProcess.KERNEL32(?,?), ref: 004896C8
PeekNamedPipe.KERNEL32(FFFFFFFF,00000000,00000000,00000000,?,00000000,?,?,?,00000000,00000000,00000000,00000001,?,?,?), ref: 004896F2
ReadFile.KERNEL32(FFFFFFFF,?,00002400,00000000,00000000), ref: 00489717
OemToCharA.USER32(?,?), ref: 0048972E
PeekNamedPipe.KERNEL32(FFFFFFFF,00000000,00000000,00000000,00000000,00000000,?,FFFFFFFF,?,00002400,00000000,00000000,FFFFFFFF,00000000,00000000,00000000), ref: 00489781

Part of subcall function 0041FA34: GetLastError.KERNEL32(00486514,00000004,0048650C,00000000,0041FADE,?,00499F5C), ref: 0041FA94

Part of subcall function 0041FC40: SetThreadPriority.KERNEL32(?,015CDB28,00499F5C,?,0047EC9E,?,?,?,00000000,00000000,?,0049062B), ref: 0041FC55

Part of subcall function 0041FEF0: ResumeThread.KERNEL32(?,00499F5C,?,0047ECAA,?,?,?,00000000,00000000,?,0049062B), ref: 0041FEF8

Part of subcall function 0041FF20: GetCurrentThreadId.KERNEL32 ref: 0041FF2E
Part of subcall function 0041FF20: PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0041FF5A
Part of subcall function 0041FF20: MsgWaitForMultipleObjects.USER32(00000002,?,00000000,000003E8,00000040), ref: 0041FF6F
Part of subcall function 0041FF20: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041FF9C
Part of subcall function 0041FF20: GetExitCodeThread.KERNEL32(?,?,?,000000FF), ref: 0041FFA7

TerminateProcess.KERNEL32(?,00000000,00000000,?,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,COMSPEC,?,00000104,?), ref: 0048980A
CloseHandle.KERNEL32(?), ref: 00489813
CloseHandle.KERNEL32(?), ref: 0048981C

Strings

D, xrefs: 00489627
COMSPEC, xrefs: 0048960E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004291D0, Relevance: 31.7, APIs: 21, Instructions: 194window

APIs

GetObjectA.GDI32(?,00000054,?), ref: 004291F3
GetDC.USER32(00000000), ref: 00429221
CreateCompatibleDC.GDI32(?), ref: 00429232
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0042924D
SelectObject.GDI32(?,00000000), ref: 00429267
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 00429289
CreateCompatibleDC.GDI32(?), ref: 00429297
DeleteDC.GDI32(?), ref: 0042937D

Part of subcall function 00428B08: GetObjectA.GDI32(00000000,00000054,?), ref: 00428B88
Part of subcall function 00428B08: GetDC.USER32(00000000), ref: 00428B99
Part of subcall function 00428B08: CreateCompatibleDC.GDI32(00000000), ref: 00428BAA
Part of subcall function 00428B08: CreateBitmap.GDI32(00000000,?,00000001,00000001,00000000), ref: 00428BF6
Part of subcall function 00428B08: CreateCompatibleBitmap.GDI32(00000028,00000000,?), ref: 00428C1A
Part of subcall function 00428B08: GetDeviceCaps.GDI32(00000028,0000000C), ref: 00428C6A
Part of subcall function 00428B08: GetDeviceCaps.GDI32(00000028,0000000E), ref: 00428C77
Part of subcall function 00428B08: SelectObject.GDI32(?,00000000), ref: 00428D21
Part of subcall function 00428B08: GetDIBColorTable.GDI32(?,00000000,00000100,-00000027), ref: 00428D47
Part of subcall function 00428B08: GetDIBits.GDI32(?,00000000,00000000,?,00000000,00000001,00000000), ref: 00428D72
Part of subcall function 00428B08: SelectObject.GDI32(?,?), ref: 00428D7F
Part of subcall function 00428B08: CreateDIBSection.GDI32(00000028,00000001,00000000,00000003,00000000,00000000), ref: 00428DD5
Part of subcall function 00428B08: GetDIBits.GDI32(?,00000000,00000000,?,00000000,00000001,00000000), ref: 00428E36
Part of subcall function 00428B08: SelectObject.GDI32(?,?), ref: 00428E77
Part of subcall function 00428B08: SelectPalette.GDI32(?,00000000,00000000), ref: 00428EB7
Part of subcall function 00428B08: RealizePalette.GDI32(?), ref: 00428EC3
Part of subcall function 00428B08: FillRect.USER32(?,?,00000000), ref: 00428F14
Part of subcall function 00428B08: SetTextColor.GDI32(?,00000000), ref: 00428F2C
Part of subcall function 00428B08: SetBkColor.GDI32(?,00000000), ref: 00428F46
Part of subcall function 00428B08: SetDIBColorTable.GDI32(?,00000000,00000002,?), ref: 00428F8E
Part of subcall function 00428B08: PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 00428FB0
Part of subcall function 00428B08: CreateCompatibleDC.GDI32(00000028), ref: 00428FC3
Part of subcall function 00428B08: SelectObject.GDI32(?,00000000), ref: 00428FE6
Part of subcall function 00428B08: SelectPalette.GDI32(?,00000000,00000000), ref: 00429002
Part of subcall function 00428B08: RealizePalette.GDI32(?), ref: 0042900D
Part of subcall function 00428B08: SetTextColor.GDI32(?,00000000), ref: 0042902B
Part of subcall function 00428B08: SetBkColor.GDI32(?,00000000), ref: 00429045
Part of subcall function 00428B08: BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042906D
Part of subcall function 00428B08: SelectPalette.GDI32(?,00000000,000000FF), ref: 0042907F
Part of subcall function 00428B08: SelectObject.GDI32(?,00000000), ref: 00429089
Part of subcall function 00428B08: DeleteDC.GDI32(?), ref: 004290A4
Part of subcall function 00428B08: SelectPalette.GDI32(?,?,000000FF), ref: 004290CE

SelectObject.GDI32(?), ref: 004292DF
SelectPalette.GDI32(?,?,00000000), ref: 004292F2
RealizePalette.GDI32(?), ref: 004292FB
SelectPalette.GDI32(?,?,00000000), ref: 00429307
RealizePalette.GDI32(?), ref: 00429310
SetBkColor.GDI32(?), ref: 0042931A
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042933E
SetBkColor.GDI32(?,00000000), ref: 00429348
SelectObject.GDI32(?,00000000), ref: 0042935B
DeleteObject.GDI32 ref: 00429367
SelectObject.GDI32(?,00000000), ref: 00429398
DeleteDC.GDI32(00000000), ref: 004293B4
ReleaseDC.USER32(00000000,00000000), ref: 004293C5

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004031FC, Relevance: 27.1, APIs: 9, Strings: 9, Instructions: 110

APIs

CharNextA.USER32(00000000), ref: 00403208
CharNextA.USER32(00000000), ref: 00403236
CharNextA.USER32(00000000), ref: 00403240
CharNextA.USER32(00000000), ref: 0040325F
CharNextA.USER32(00000000), ref: 00403269
CharNextA.USER32(00000000), ref: 00403295
CharNextA.USER32(00000000), ref: 0040329F
CharNextA.USER32(00000000), ref: 004032C7
CharNextA.USER32(00000000), ref: 004032D1

Strings

", xrefs: 00403230
, xrefs: 004032E9
", xrefs: 0040328F
", xrefs: 0040321E
, xrefs: 00403214
", xrefs: 00403254
, xrefs: 00403278
", xrefs: 00403219
", xrefs: 004032BC

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00472E88, Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 199network

APIs

socket.WSOCK32(00000002,00000001,00000000,00000000,00473108), ref: 00472EC7
WSAIoctl.WS2_32(000000FF,4004747F,00000000,00000000,?,00000400,?,00000000,00000000), ref: 00472F08
inet_ntoa.WSOCK32(?,00000000,004730D5,?,00000002,00000001,00000000,00000000,00473108), ref: 00472F40
inet_ntoa.WSOCK32(?,00473130,?, IP : ,?,?,00000000,004730D5,?,00000002,00000001,00000000,00000000,00473108), ref: 00472F81
inet_ntoa.WSOCK32(?,00473130,?, IP Mask : ,?,?,00473130,?, IP : ,?,?,00000000,004730D5,?,00000002,00000001), ref: 00472FC2
closesocket.WSOCK32(000000FF,00000002,00000001,00000000,00000000,00473108), ref: 004730E3

Strings

Broadcast adress : , xrefs: 00472FCB
Status : UP, xrefs: 00473001
IP Mask : , xrefs: 00472F8A
Broadcasts : NO, xrefs: 00473057
Status : DOWN, xrefs: 0047301B
IP : , xrefs: 00472F49
Broadcasts : YES, xrefs: 0047303D
Network interface, xrefs: 00473091
Loopback interface, xrefs: 00473077

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0045944C, Relevance: 25.8, APIs: 17, Instructions: 258

APIs

GetWindowDC.USER32(00000000), ref: 00459480
GetClientRect.USER32(00000000,?), ref: 004594A3
GetWindowRect.USER32(00000000,?), ref: 004594B5
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 004594CB
OffsetRect.USER32(?,?,?), ref: 004594E0
ExcludeClipRect.GDI32(?,?,?,?,?), ref: 004594F9
InflateRect.USER32(?,00000000,00000000), ref: 00459517
GetWindowLongA.USER32(00000000,000000F0), ref: 00459531
DrawEdge.USER32(?,?,?,00000008), ref: 00459630
IntersectClipRect.GDI32(?,?,?,?,?), ref: 00459649
OffsetRect.USER32(?,?,?), ref: 00459673
GetRgnBox.GDI32(?,?), ref: 00459682
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00459698
IntersectRect.USER32(?,?,?), ref: 004596A9
OffsetRect.USER32(?,?,?), ref: 004596BE

Part of subcall function 00424FEC: CreateBrushIndirect.GDI32(?), ref: 00425097

FillRect.USER32(?,?,00000000), ref: 004596DA
ReleaseDC.USER32(00000000,?), ref: 004596F9

Part of subcall function 004328FC: GetWindowLongA.USER32(00000000,000000EC), ref: 00432917
Part of subcall function 004328FC: GetWindowRect.USER32(00000000,?), ref: 00432932
Part of subcall function 004328FC: OffsetRect.USER32(?,?,?), ref: 00432947
Part of subcall function 004328FC: GetWindowDC.USER32(00000000), ref: 00432955
Part of subcall function 004328FC: GetWindowLongA.USER32(00000000,000000F0), ref: 00432986
Part of subcall function 004328FC: GetSystemMetrics.USER32(00000002), ref: 0043299B
Part of subcall function 004328FC: GetSystemMetrics.USER32(00000003), ref: 004329A4
Part of subcall function 004328FC: InflateRect.USER32(?,000000FE,000000FE), ref: 004329B3
Part of subcall function 004328FC: GetSysColorBrush.USER32(0000000F), ref: 004329E0
Part of subcall function 004328FC: FillRect.USER32(?,?,00000000), ref: 004329EE
Part of subcall function 004328FC: ExcludeClipRect.GDI32(?,?,?,?,?), ref: 00432A13
Part of subcall function 004328FC: ReleaseDC.USER32(00000000,?), ref: 00432A51

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00465A0C, Relevance: 21.2, APIs: 6, Strings: 8, Instructions: 232memory

APIs

VirtualAlloc.KERNEL32(?,?,00002000,00000004), ref: 00465AC1
VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,?,?,00002000,00000004), ref: 00465ADC
GetProcessHeap.KERNEL32(00000000,00000011,?,?,00002000,00000004), ref: 00465B07
HeapAlloc.KERNEL32(00000000,00000000,00000011,?,?,00002000,00000004), ref: 00465B0D
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,00000000,00000000,00000011,?,?,00002000,00000004), ref: 00465B41
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,00000000,?,00001000,00000004,00000000,00000000,00000011,?,?,00002000,00000004), ref: 00465B55

Part of subcall function 004653A8: VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00465410
Part of subcall function 004653A8: VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 0046545B

Part of subcall function 00465598: LoadLibraryA.KERNEL32(00000000), ref: 00465607
Part of subcall function 00465598: GetProcAddress.KERNEL32(?,?), ref: 00465737
Part of subcall function 00465598: GetProcAddress.KERNEL32(?,?), ref: 0046576B
Part of subcall function 00465598: IsBadReadPtr.KERNEL32(?,00000014,00000000,004657D8), ref: 004657A9

Part of subcall function 004658F4: VirtualFree.KERNEL32(?,?,00004000), ref: 00465939
Part of subcall function 004658F4: VirtualProtect.KERNEL32(?,?,00000000,?), ref: 004659A5

Part of subcall function 00466038: FreeLibrary.KERNEL32(00000000,?,?,00000000,?,00000000,00465C6C), ref: 004660A7
Part of subcall function 00466038: VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,00000000,00465C6C), ref: 004660D8
Part of subcall function 00466038: GetProcessHeap.KERNEL32(00000000,?,?,?,00000000,?,00000000,00465C6C), ref: 004660E0
Part of subcall function 00466038: HeapFree.KERNEL32(00000000,00000000,?), ref: 004660E6

Strings

BTMemoryLoadLibary: BuildImportTable failed, xrefs: 00465BD5
BTMemoryLoadLibary: Can't attach library, xrefs: 00465C5A
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 00465A95
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 00465AEC
PE, xrefs: 00465A84
BTMemoryLoadLibary: dll dos header is not valid, xrefs: 00465A4E
MZ, xrefs: 00465A41
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 00465C28

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004296E0, Relevance: 21.2, APIs: 14, Instructions: 217window

APIs

Part of subcall function 00429D5C: GetDC.USER32(00000000), ref: 00429DB2
Part of subcall function 00429D5C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00429DC7
Part of subcall function 00429D5C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 00429DD1
Part of subcall function 00429D5C: CreateHalftonePalette.GDI32(00000000), ref: 00429DF5
Part of subcall function 00429D5C: ReleaseDC.USER32(00000000,00000000), ref: 00429E00

SelectPalette.GDI32(?,?,000000FF), ref: 00429723
RealizePalette.GDI32(?), ref: 00429732
GetDeviceCaps.GDI32(?,0000000C), ref: 00429744
GetDeviceCaps.GDI32(?,0000000E), ref: 00429753
GetBrushOrgEx.GDI32(?,?), ref: 00429786
SetStretchBltMode.GDI32(?,00000004), ref: 00429794
SetBrushOrgEx.GDI32(?,?,?,?), ref: 004297AC
SetStretchBltMode.GDI32(00000000,00000003), ref: 004297C9
SelectPalette.GDI32(?,?,000000FF), ref: 00429918

Part of subcall function 00429CFC: DeleteObject.GDI32(?), ref: 00429D1F

CreateCompatibleDC.GDI32(00000000), ref: 0042982A
SelectObject.GDI32(?,?), ref: 0042983F

Part of subcall function 00425CC8: CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00425D0B
Part of subcall function 00425CC8: SelectObject.GDI32(?,?), ref: 00425D20
Part of subcall function 00425CC8: MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029), ref: 00425D64
Part of subcall function 00425CC8: SelectObject.GDI32(?,?), ref: 00425D7E
Part of subcall function 00425CC8: DeleteObject.GDI32(?), ref: 00425D8A
Part of subcall function 00425CC8: CreateCompatibleDC.GDI32(00000000), ref: 00425D9E
Part of subcall function 00425CC8: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00425DBF
Part of subcall function 00425CC8: SelectObject.GDI32(?,?), ref: 00425DD4
Part of subcall function 00425CC8: SelectPalette.GDI32(?,48080787,00000000), ref: 00425DE8
Part of subcall function 00425CC8: SelectPalette.GDI32(?,?,00000000), ref: 00425DFA
Part of subcall function 00425CC8: SelectPalette.GDI32(?,00000000,000000FF), ref: 00425E0F
Part of subcall function 00425CC8: SelectPalette.GDI32(?,48080787,000000FF), ref: 00425E25
Part of subcall function 00425CC8: RealizePalette.GDI32(?), ref: 00425E31
Part of subcall function 00425CC8: StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 00425E53
Part of subcall function 00425CC8: StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 00425E75
Part of subcall function 00425CC8: SetTextColor.GDI32(?,00000000), ref: 00425E7D
Part of subcall function 00425CC8: SetBkColor.GDI32(?,00FFFFFF), ref: 00425E8B
Part of subcall function 00425CC8: StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 00425EB7
Part of subcall function 00425CC8: StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 00425EDC
Part of subcall function 00425CC8: SetTextColor.GDI32(?,?), ref: 00425EE6
Part of subcall function 00425CC8: SetBkColor.GDI32(?,?), ref: 00425EF0
Part of subcall function 00425CC8: SelectObject.GDI32(?,00000000), ref: 00425F03
Part of subcall function 00425CC8: DeleteObject.GDI32(?), ref: 00425F0C
Part of subcall function 00425CC8: SelectPalette.GDI32(?,00000000,00000000), ref: 00425F2E
Part of subcall function 00425CC8: DeleteDC.GDI32(?), ref: 00425F37

SelectObject.GDI32(?,00000000), ref: 0042989E
DeleteDC.GDI32(00000000), ref: 004298AD
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 004298F3

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00474208, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 49libraryloader

APIs

LoadLibraryA.KERNEL32(wlanapi.dll), ref: 00474216
GetProcAddress.KERNEL32(00000000,WlanOpenHandle,wlanapi.dll,?,?,0047466E,00000000,00474A0A), ref: 0047422E
GetProcAddress.KERNEL32(00000000,WlanCloseHandle,00000000,WlanOpenHandle,wlanapi.dll,?,?,0047466E,00000000,00474A0A), ref: 00474249
GetProcAddress.KERNEL32(00000000,WlanEnumInterfaces,00000000,WlanCloseHandle,00000000,WlanOpenHandle,wlanapi.dll,?,?,0047466E,00000000,00474A0A), ref: 00474264
GetProcAddress.KERNEL32(00000000,WlanQueryInterface,00000000,WlanEnumInterfaces,00000000,WlanCloseHandle,00000000,WlanOpenHandle,wlanapi.dll,?,?,0047466E,00000000,00474A0A), ref: 0047427F
GetProcAddress.KERNEL32(00000000,WlanGetAvailableNetworkList,00000000,WlanQueryInterface,00000000,WlanEnumInterfaces,00000000,WlanCloseHandle,00000000,WlanOpenHandle,wlanapi.dll,?,?,0047466E,00000000,00474A0A), ref: 0047429A

Strings

WlanOpenHandle, xrefs: 00474226
wlanapi.dll, xrefs: 00474211
WlanGetAvailableNetworkList, xrefs: 00474292
WlanQueryInterface, xrefs: 00474277
WlanEnumInterfaces, xrefs: 0047425C
WlanCloseHandle, xrefs: 00474241

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048D3C4, Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 132

APIs

GetVersionExA.KERNEL32(00000094), ref: 0048D410

Strings

Windows Me, xrefs: 0048D4F2
Windows NT 4.0, xrefs: 0048D441
Windows 2000, xrefs: 0048D467
Windows 95, xrefs: 0048D4D6
Windows 7, xrefs: 0048D4B1
Unknow, xrefs: 0048D3F5
Windows Vista, xrefs: 0048D4A3
Windows Server 2003, xrefs: 0048D486
Windows XP, xrefs: 0048D478
Windows 98, xrefs: 0048D4E4

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048C494, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 102filememorythread

APIs

FindResourceA.KERNEL32(00000000,?,?), ref: 0048C4C3

Part of subcall function 00489BB0: GetTempPathA.KERNEL32(?,00000000), ref: 00489BEC

CreateFileA.KERNEL32(00000000,.dll,?,?,40000000,00000002,00000000), ref: 0048C50F
SizeofResource.KERNEL32(00000000,00000000,?,00000000,00000002,00000080,00000000,00000000,0048C5AC,?,?,?,?,00000000,00000000,00000000), ref: 0048C51F
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000002,00000080,00000000,00000000,0048C5AC), ref: 0048C528
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000002,00000080,00000000,00000000,0048C5AC), ref: 0048C52E
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0048C535
CloseHandle.KERNEL32(00000000), ref: 0048C53B
LocalAlloc.KERNEL32(00000040,00000004,00000000,00000000,00000000,00000000,?,00000000,00000002,00000080,00000000,00000000,0048C5AC), ref: 0048C544
CreateThread.KERNEL32(00000000,00000000,0048C3E4,00000000,00000000,?), ref: 0048C586
CloseHandle.KERNEL32(00000000), ref: 0048C58C

Strings

.dll, xrefs: 0048C4F4, 0048C565

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004085D4, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61windowregistry

APIs

FindWindowA.USER32(MouseZ,Magellan MSWHEEL), ref: 004085EC
RegisterWindowMessageA.USER32(MSWHEEL_ROLLMSG,MouseZ,Magellan MSWHEEL), ref: 004085F8
RegisterWindowMessageA.USER32(MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG,MouseZ,Magellan MSWHEEL), ref: 00408607
RegisterWindowMessageA.USER32(MSH_SCROLL_LINES_MSG,MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG,MouseZ,Magellan MSWHEEL), ref: 00408613
SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 0040862B
SendMessageA.USER32(00000000,?,00000000,00000000), ref: 0040864F

Strings

MSH_SCROLL_LINES_MSG, xrefs: 0040860E
MSH_WHEELSUPPORT_MSG, xrefs: 00408602
MouseZ, xrefs: 004085E7
Magellan MSWHEEL, xrefs: 004085E2
MSWHEEL_ROLLMSG, xrefs: 004085F3

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00442280, Relevance: 18.5, APIs: 12, Instructions: 471window

APIs

Part of subcall function 004471C4: IsChild.USER32(00000000,00000000), ref: 00447222

SendMessageA.USER32(?,00000223,00000000,00000000), ref: 004426BE
ShowWindow.USER32(00000000,00000003), ref: 004426CE
ShowWindow.USER32(00000000,00000002), ref: 004426F0
CallWindowProcA.USER32(00407FF8,00000000,00000005,00000000,?), ref: 00442719
SendMessageA.USER32(?,00000234,00000000,00000000), ref: 0044273E
ShowWindow.USER32(00000000,?), ref: 00442763
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000097), ref: 004427FF
GetActiveWindow.USER32 ref: 00442815
ShowWindow.USER32(00000000,00000000), ref: 00442872

Part of subcall function 0043B75C: IsIconic.USER32(?), ref: 0043B773

Part of subcall function 0043BA80: GetCurrentThreadId.KERNEL32(Function_0003BA1C,00000000,0044283C,00000000,004428BF), ref: 0043BA9A
Part of subcall function 0043BA80: EnumThreadWindows.USER32(00000000,Function_0003BA1C,00000000), ref: 0043BAA0

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000097), ref: 0044285A
SetActiveWindow.USER32(00000000), ref: 00442860
ShowWindow.USER32(00000000,00000001), ref: 004428A2

Part of subcall function 00407550: LoadStringA.USER32(00000000,00010000,?,00001000), ref: 00407582

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004328FC, Relevance: 18.1, APIs: 12, Instructions: 142

APIs

GetWindowLongA.USER32(00000000,000000EC), ref: 00432917
GetWindowRect.USER32(00000000,?), ref: 00432932
OffsetRect.USER32(?,?,?), ref: 00432947
GetWindowDC.USER32(00000000), ref: 00432955
GetWindowLongA.USER32(00000000,000000F0), ref: 00432986
GetSystemMetrics.USER32(00000002), ref: 0043299B
GetSystemMetrics.USER32(00000003), ref: 004329A4
InflateRect.USER32(?,000000FE,000000FE), ref: 004329B3
GetSysColorBrush.USER32(0000000F), ref: 004329E0
FillRect.USER32(?,?,00000000), ref: 004329EE
ExcludeClipRect.GDI32(?,?,?,?,?), ref: 00432A13
ReleaseDC.USER32(00000000,?), ref: 00432A51

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00402820, Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254window

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 00402BBE

Strings

An unexpected memory leak has occurred. , xrefs: 00402980
String, xrefs: 00402A91
, xrefs: 00402B04
Unknown, xrefs: 00402A7C
The sizes of unexpected leaked medium and large blocks are: , xrefs: 00402B39
The unexpected small block leaks are:, xrefs: 004029F7
Unexpected Memory Leak, xrefs: 00402BB0
7, xrefs: 00402991
bytes: , xrefs: 00402A4D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0046F17C, Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 116window

APIs

GetWindowTextA.USER32(?,00000000,?), ref: 0046F1D2
GetWindowPlacement.USER32(?,0000002C), ref: 0046F1ED
IsWindowVisible.USER32(?), ref: 0046F258

Part of subcall function 0046F148: GetWindow.USER32(?,00000005), ref: 0046F156
Part of subcall function 0046F148: GetWindow.USER32(00000000,00000002), ref: 0046F164

Strings

,, xrefs: 0046F1E1
Minimized, xrefs: 0046F225
Show/Unactive, xrefs: 0046F239
True, xrefs: 0046F2AA
Maximized, xrefs: 0046F1FD
Normal, xrefs: 0046F211
Normal/Unactive, xrefs: 0046F24D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042E71C, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 109

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 0042E755
GetSystemMetrics.USER32(00000000), ref: 0042E77A
GetSystemMetrics.USER32(00000001), ref: 0042E785
GetClipBox.GDI32(?,?), ref: 0042E797
GetDCOrgEx.GDI32(?,?), ref: 0042E7A4
OffsetRect.USER32(?,?,?), ref: 0042E7BD
IntersectRect.USER32(?,?,?), ref: 0042E7CE
IntersectRect.USER32(?,?,?), ref: 0042E7E4
IntersectRect.USER32(?,?,?), ref: 0042E804

Part of subcall function 0042E174: GetProcAddress.KERNEL32(76C70000,00000000,00000000,0042E231), ref: 0042E1F3

Strings

EnumDisplayMonitors, xrefs: 0042E734

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0044D1B0, Relevance: 16.6, APIs: 11, Instructions: 91

APIs

IsWindowUnicode.USER32(?), ref: 0044D1CA
SetWindowLongW.USER32(?,000000FC,?), ref: 0044D1E5
GetWindowLongW.USER32(?,000000F0), ref: 0044D1F0
GetWindowLongW.USER32(?,000000F4), ref: 0044D202
SetWindowLongW.USER32(?,000000F4,?), ref: 0044D215
SetWindowLongA.USER32(?,000000FC,?), ref: 0044D22E
GetWindowLongA.USER32(?,000000F0), ref: 0044D239
GetWindowLongA.USER32(?,000000F4), ref: 0044D24B
SetWindowLongA.USER32(?,000000F4,?), ref: 0044D25E
SetPropA.USER32(?,00000000,00000000), ref: 0044D275
SetPropA.USER32(?,00000000,00000000), ref: 0044D28C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00485954, Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 236filewindow

APIs

Beep.KERNEL32(00000000,00000000,?,00000000,00485C82), ref: 00485C68

Part of subcall function 00489BB0: GetTempPathA.KERNEL32(?,00000000), ref: 00489BEC

Part of subcall function 0048AB58: DeleteFileA.KERNEL32(00000000,00000000,0048ABE5,?,00000000,0048AC07), ref: 0048ABA5

Part of subcall function 0048A8AC: CreateFileA.KERNEL32(?,C0000000,00000003,0000000C,00000004,00000100,00000000), ref: 0048A953
Part of subcall function 0048A8AC: CreateFileA.KERNEL32(?,C0000000,00000003,0000000C,00000002,00000100,00000000), ref: 0048A98D
Part of subcall function 0048A8AC: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,000000FF,00000110,00000000,00000000,00000044,?), ref: 0048AA10
Part of subcall function 0048A8AC: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0048AA2D
Part of subcall function 0048A8AC: CloseHandle.KERNEL32(00000000), ref: 0048AA68
Part of subcall function 0048A8AC: CloseHandle.KERNEL32(00000000), ref: 0048AA77
Part of subcall function 0048A8AC: CloseHandle.KERNEL32(00000000), ref: 0048AA86
Part of subcall function 0048A8AC: CloseHandle.KERNEL32(00000000), ref: 0048AA95

DeleteFileA.KERNEL32(00000000,Error,00000000,00485C82), ref: 00485A63
DeleteFileA.KERNEL32(00000000,00000000,Error,00000000,00485C82), ref: 00485A92

Part of subcall function 00485888: LocalAlloc.KERNEL32(00000040,00000014,00000000,00485939), ref: 004858C3
Part of subcall function 00485888: CreateThread.KERNEL32(00000000,00000000,Function_0008317C,00000000,00000000,00499F94), ref: 00485913
Part of subcall function 00485888: CloseHandle.KERNEL32(00000000), ref: 00485919

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00485BE3

Strings

systeminfo, xrefs: 00485A14
tmp.txt, xrefs: 004859CA, 00485A07, 00485A79
Error, xrefs: 004859DE
SYSINFO, xrefs: 00485AAE
out.txt, xrefs: 004859AB, 004859EE, 00485A2A, 00485A4A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00462C84, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 197com

APIs

CoCreateInstance.OLE32(00492A2C,00000000,00000003,0049296C,00000000), ref: 00462CC9
CoCreateInstance.OLE32(00492A8C,00000000,00000001,00462EC8,00000000), ref: 00462CF4
CoCreateInstance.OLE32(00492A9C,00000000,00000001,0049295C,00000000), ref: 00462D20
CoCreateInstance.OLE32(00492A1C,00000000,00000003,004929AC,00000000), ref: 00462E12

Strings

,*I, xrefs: 00462CC3
l)I, xrefs: 00462CB9
)I, xrefs: 00462E4B
\)I, xrefs: 00462D10
|*I, xrefs: 00462D3C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048485C, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 185networkfile

APIs

InternetOpenA.WININET(Mozilla,00000001,00000000,00000000,00000000), ref: 0048490C
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,04000000,00000000), ref: 00484944
HttpQueryInfoA.WININET(00000000,00000013,?,00000200,?), ref: 0048497D
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00484A04
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 00484A75
InternetCloseHandle.WININET(00000000), ref: 00484A95

Strings

200, xrefs: 004849BD
Mozilla, xrefs: 00484907
open, xrefs: 00484A6E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00448A94, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 170window

APIs

ImageList_DrawEx.COMCTL32(00000000,?,00000000,?,?,00000000,00000000,00000000,00000000,?), ref: 00448AF3

Part of subcall function 0042535C: FillRect.USER32(?,00000000,00000000), ref: 00425385

ImageList_DrawEx.COMCTL32(00000000,?,00000000,00000000,00000000,00000000,00000000,000000FF,00000000,00000000), ref: 00448B94
SetTextColor.GDI32(00000000,00FFFFFF), ref: 00448BE1
SetBkColor.GDI32(00000000,00000000), ref: 00448BE9
BitBlt.GDI32(00000000,?,?,?,?,00000000,00000000,00000000,00E20746), ref: 00448C0E
SetTextColor.GDI32(00000000,00FFFFFF), ref: 00448C2F
SetBkColor.GDI32(00000000,00000000), ref: 00448C37
BitBlt.GDI32(00000000,?,?,?,?,00000000,00000000,00000000,00E20746), ref: 00448C5A

Part of subcall function 00448A6C: ImageList_GetBkColor.COMCTL32(00000000,?,00448ACD,00000000,?), ref: 00448A82

Strings

6B, xrefs: 00448B05

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048A8AC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 146fileprocesssynchronization

APIs

Part of subcall function 0040A26C: GetFileAttributesA.KERNEL32(00000000,?,0048F947,.dcp,?,?,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040A277

CreateFileA.KERNEL32(?,C0000000,00000003,0000000C,00000004,00000100,00000000), ref: 0048A953
CreateFileA.KERNEL32(?,C0000000,00000003,0000000C,00000002,00000100,00000000), ref: 0048A98D
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,000000FF,00000110,00000000,00000000,00000044,?), ref: 0048AA10
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0048AA2D
CloseHandle.KERNEL32(00000000), ref: 0048AA68
CloseHandle.KERNEL32(00000000), ref: 0048AA77
CloseHandle.KERNEL32(00000000), ref: 0048AA86
CloseHandle.KERNEL32(00000000), ref: 0048AA95

Strings

D, xrefs: 0048A9BB

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00466D4C, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 146fileprocesssynchronization

APIs

Part of subcall function 0040A26C: GetFileAttributesA.KERNEL32(00000000,?,0048F947,.dcp,?,?,00000000,0048FA09,?,00000000,00490656,?,?,?,?,0000002F), ref: 0040A277

CreateFileA.KERNEL32(?,C0000000,00000003,0000000C,00000004,00000100,00000000), ref: 00466DF3
CreateFileA.KERNEL32(?,C0000000,00000003,0000000C,00000002,00000100,00000000), ref: 00466E2D
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,000000FF,00000110,00000000,00000000,00000044,?), ref: 00466EB0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00466ECD
CloseHandle.KERNEL32(00000000), ref: 00466F08
CloseHandle.KERNEL32(00000000), ref: 00466F17
CloseHandle.KERNEL32(00000000), ref: 00466F26
CloseHandle.KERNEL32(00000000), ref: 00466F35

Strings

D, xrefs: 00466E5B

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00483468, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 118networkthread

APIs

InternetOpenA.WININET(myappname,00000000,00000000,00000000,00000000), ref: 0048350C
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,00000000,00000000), ref: 00483537
InternetCloseHandle.WININET(00000000), ref: 0048353D
InternetCloseHandle.WININET(?), ref: 00483553

Part of subcall function 00475E2C: send.WSOCK32(00000248,00000000,?,00000000,00000000,00475EBD), ref: 00475E9D

ExitThread.KERNEL32(00000000, Times.,?,?,00000000,00483684,?,BTRESULTVisit URL|finished to visit ,?,004835AC,?,myappname,00000000,00000000,00000000,00000000), ref: 0048359F

Strings

myappname, xrefs: 00483507
H4H, xrefs: 00483497, 0048361C
BTRESULTVisit URL|finished to visit , xrefs: 00483558
Times., xrefs: 0048357D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0046F3B8, Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 110

APIs

GetWindowTextA.USER32(?,00000000,?), ref: 0046F40E
GetWindowPlacement.USER32(?,0000002C), ref: 0046F429

Part of subcall function 0046F148: GetWindow.USER32(?,00000005), ref: 0046F156
Part of subcall function 0046F148: GetWindow.USER32(00000000,00000002), ref: 0046F164

Strings

Maximized, xrefs: 0046F439
,, xrefs: 0046F41D
False, xrefs: 0046F4D6
Show/Unactive, xrefs: 0046F475
Normal, xrefs: 0046F44D
Minimized, xrefs: 0046F461
Normal/Unactive, xrefs: 0046F489

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00456278, Relevance: 15.2, APIs: 10, Instructions: 197

APIs

SaveDC.GDI32(?), ref: 00456295

Part of subcall function 0044EEA0: GetWindowOrgEx.GDI32(?), ref: 0044EEAE
Part of subcall function 0044EEA0: SetWindowOrgEx.GDI32(?,?,?,00000000), ref: 0044EEC4

IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 004562CE
GetWindowLongA.USER32(00000000,000000EC), ref: 004562E2
GetWindowLongA.USER32(00000000,000000F0), ref: 00456303

Part of subcall function 00456278: SetRect.USER32(00000010,00000000,00000000,?,?), ref: 00456363
Part of subcall function 00456278: IntersectClipRect.GDI32(?,00000000,00000000,00000010,?), ref: 004563D3
Part of subcall function 00456278: SetRect.USER32(?,00000000,00000000,?,?), ref: 004563F4
Part of subcall function 00456278: DrawEdge.USER32(?,?,00000000,00000000), ref: 00456403
Part of subcall function 00456278: IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 0045642C

RestoreDC.GDI32(?,?), ref: 004564AB

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0043F2B8, Relevance: 15.1, APIs: 10, Instructions: 133window

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 0043F329
GetWindowLongA.USER32(00000000,000000EC), ref: 0043F33B
GetClassLongA.USER32(00000000,000000E6), ref: 0043F34E
SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 0043F38E
SetWindowLongA.USER32(00000000,000000EC,?), ref: 0043F3A2
SetClassLongA.USER32(00000000,000000E6,?), ref: 0043F3B6
SendMessageA.USER32(00000000,00000080,00000001,00000000), ref: 0043F3F0
SendMessageA.USER32(00000000,00000080,00000001,00000000), ref: 0043F408
GetSystemMenu.USER32(00000000,000000FF), ref: 0043F417
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000037), ref: 0043F440

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0044155C, Relevance: 15.1, APIs: 10, Instructions: 74window

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 004415A7
DeleteMenu.USER32(00000000,0000F130,00000000), ref: 004415C5
DeleteMenu.USER32(00000000,00000007,00000400), ref: 004415D2
DeleteMenu.USER32(00000000,00000005,00000400), ref: 004415DF
DeleteMenu.USER32(00000000,0000F030,00000000), ref: 004415EC
DeleteMenu.USER32(00000000,0000F020,00000000), ref: 004415F9
DeleteMenu.USER32(00000000,0000F000,00000000), ref: 00441606
DeleteMenu.USER32(00000000,0000F120,00000000), ref: 00441613
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 00441631
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 0044164D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040281E, Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188window

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 00402BBE

Strings

An unexpected memory leak has occurred. , xrefs: 00402980
, xrefs: 00402B04
The sizes of unexpected leaked medium and large blocks are: , xrefs: 00402B39
The unexpected small block leaks are:, xrefs: 004029F7
Unexpected Memory Leak, xrefs: 00402BB0
7, xrefs: 00402991
bytes: , xrefs: 00402A4D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004710F0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 66

APIs

FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 0047111D
GetWindow.USER32(00000000,00000005), ref: 00471125
GetClassNameA.USER32(00000000,?,00000080), ref: 0047113D
ShowWindow.USER32(00000000,00000001), ref: 0047117C
ShowWindow.USER32(00000000,00000000), ref: 00471186
GetWindow.USER32(00000000,00000002), ref: 0047118E

Strings

BUTTON, xrefs: 00471168
Shell_TrayWnd, xrefs: 00471118

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040DA34, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 56filewindow

APIs

Part of subcall function 0040D8AC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040D8C9
Part of subcall function 0040D8AC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0040D8ED
Part of subcall function 0040D8AC: GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 0040D908
Part of subcall function 0040D8AC: LoadStringA.USER32(00000000,0000FFED,?,00000100), ref: 0040D99E

CharToOemA.USER32(?,?), ref: 0040DA6B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,0040E1ED,0040E312,0040FDD4,00000000,0040FF18), ref: 0040DA88
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?), ref: 0040DA8E
GetStdHandle.KERNEL32(000000F4,0040DAF8,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,0040E1ED,0040E312,0040FDD4,00000000,0040FF18), ref: 0040DAA3
WriteFile.KERNEL32(00000000,000000F4,0040DAF8,00000002,?), ref: 0040DAA9
LoadStringA.USER32(00000000,0000FFEE,?,00000040), ref: 0040DACB
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0040DAE1

Strings

LPI, xrefs: 0040DA48

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004564D0, Relevance: 13.7, APIs: 9, Instructions: 177window

APIs

Part of subcall function 00455D50: BeginPaint.USER32(00000000,?), ref: 00455D7B
Part of subcall function 00455D50: SaveDC.GDI32(00000000), ref: 00455DB4
Part of subcall function 00455D50: ExcludeClipRect.GDI32(00000000,?,?,?,?), ref: 00455E36
Part of subcall function 00455D50: RestoreDC.GDI32(00000000,00000000), ref: 00455E6C
Part of subcall function 00455D50: EndPaint.USER32(00000000,?), ref: 00455EA9

BeginPaint.USER32(00000000,?), ref: 004565EA
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00456600
CreateCompatibleDC.GDI32(00000000), ref: 00456617
SelectObject.GDI32(?,?), ref: 00456627
SetWindowOrgEx.GDI32(?,?,?,00000000), ref: 0045664B

Part of subcall function 004564D0: BeginPaint.USER32(00000000,?), ref: 0045653C
Part of subcall function 004564D0: EndPaint.USER32(00000000,?), ref: 004565D0

BitBlt.GDI32(00000000,?,?,?,?,?,?,?,00CC0020), ref: 00456699
SelectObject.GDI32(?,?), ref: 004566B3

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0045049C, Relevance: 13.7, APIs: 9, Instructions: 154

APIs

MulDiv.KERNEL32(?,?,?), ref: 004504D7
MulDiv.KERNEL32(?,?,?), ref: 004504F1
MulDiv.KERNEL32(?,?,?), ref: 0045051F
MulDiv.KERNEL32(?,?,?), ref: 00450535
MulDiv.KERNEL32(?,?,?), ref: 0045056D
MulDiv.KERNEL32(?,?,?), ref: 00450585

Part of subcall function 00450350: MulDiv.KERNEL32(?,00000000,00000000), ref: 00450365
Part of subcall function 00450350: MulDiv.KERNEL32(?,00000000,00000000), ref: 00450382
Part of subcall function 00450350: MulDiv.KERNEL32(?,00000000,00000000), ref: 0045039F
Part of subcall function 00450350: MulDiv.KERNEL32(?,00000000,00000000), ref: 004503BC

MulDiv.KERNEL32(?), ref: 004505DC
MulDiv.KERNEL32(?), ref: 00450606

Part of subcall function 00424A40: MulDiv.KERNEL32(00000000,00000048,?), ref: 00424A51

MulDiv.KERNEL32(00000000), ref: 0045062C

Part of subcall function 00424A5C: MulDiv.KERNEL32(00000000,?,00000048), ref: 00424A69

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004840D8, Relevance: 13.6, APIs: 9, Instructions: 150

APIs

OpenProcess.KERNEL32(00000400,00000000,?,00000000,00484275), ref: 00484108
OpenProcessToken.ADVAPI32(00000000,00000008,?,00000400,00000000,?,00000000,00484275), ref: 0048411E
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?,00000000,00000008,?,00000400,00000000,?,00000000,00484275), ref: 00484139
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,?,?,?,TokenIntegrityLevel,00000000,00000000,?,00000000,00000008,?,00000400,00000000), ref: 00484168
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,?,00000000,00000008,?,00000400,00000000,?,00000000,00484275), ref: 00484177
CloseHandle.KERNEL32(?), ref: 00484185
LookupAccountSidA.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 004841B4
LookupAccountSidA.ADVAPI32(00000000,?,00000000,00000000,00000000,00000000,?), ref: 00484205
CloseHandle.KERNEL32(00000000), ref: 00484255

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00451458, Relevance: 13.6, APIs: 9, Instructions: 122window

APIs

GetDesktopWindow.USER32 ref: 0045148F
GetDCEx.USER32(?,00000000,00000402), ref: 004514A2

Part of subcall function 00424FEC: CreateBrushIndirect.GDI32(?), ref: 00425097

SelectObject.GDI32(?,00000000), ref: 004514C5
PatBlt.GDI32(?,?,?,?,00000000,005A0049), ref: 004514EB
PatBlt.GDI32(?,?,?,00000000,?,005A0049), ref: 0045150D
PatBlt.GDI32(?,?,?,?,00000000,005A0049), ref: 0045152C
PatBlt.GDI32(?,?,?,00000000,?,005A0049), ref: 00451546
SelectObject.GDI32(?,?), ref: 00451553
ReleaseDC.USER32(?,?), ref: 0045156D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00465598, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 194libraryloader

APIs

LoadLibraryA.KERNEL32(00000000), ref: 00465607
GetProcAddress.KERNEL32(?,?), ref: 00465737
GetProcAddress.KERNEL32(?,?), ref: 0046576B
IsBadReadPtr.KERNEL32(?,00000014,00000000,004657D8), ref: 004657A9

Strings

BuildImportTable: can't load library: , xrefs: 00465644
BuildImportTable: ReallocMemory failed, xrefs: 0046568D
BuildImportTable: GetProcAddress failed, xrefs: 0046577C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00482E34, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 193sleepthread

APIs

ExitThread.KERNEL32(00000000,00000000,004830D3,?,?,?,?,00000000,00000000), ref: 004830A6

Part of subcall function 00473208: socket.WSOCK32(00000002,00000001,00000000,00000000,00473339), ref: 0047323B
Part of subcall function 00473208: WSAIoctl.WS2_32(000000FF,4004747F,00000000,00000000,?,00000400,?,00000000,00000000), ref: 0047327C
Part of subcall function 00473208: inet_ntoa.WSOCK32(?,000000FF,4004747F,00000000,00000000,?,00000400,?,00000000,00000000,00000000,0047330B,?,00000002,00000001,00000000), ref: 004732AC
Part of subcall function 00473208: inet_ntoa.WSOCK32(?,?,000000FF,4004747F,00000000,00000000,?,00000400,?,00000000,00000000,00000000,0047330B,?,00000002,00000001), ref: 004732E8
Part of subcall function 00473208: closesocket.WSOCK32(000000FF,00000000,?,00000400,?,00000000,00000000,00000000,0047330B,?,00000002,00000001,00000000,00000000,00473339), ref: 00473319

CreateThread.KERNEL32(00000000,00000000,Function_00082CDC,?,00000000,?), ref: 00483005
Sleep.KERNEL32(00000032,00000000,00000000,Function_00082CDC,?,00000000,?,?,00000000,00000000,00483104,?,00483104,?,00483104,?), ref: 0048300C
Sleep.KERNEL32(00000064,.255,?,00483104,?,00483104,?,?,00000000,004830D3,?,?,?,?,00000000,00000000), ref: 00483054

Part of subcall function 00475E2C: send.WSOCK32(00000248,00000000,?,00000000,00000000,00475EBD), ref: 00475E9D

Strings

127.0.0.1, xrefs: 00482E9D
LanList, xrefs: 0048306B
.255, xrefs: 0048303C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004117E8, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00411881
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0041189D
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 004118D6
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00411953
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0041196C
VariantCopy.OLEAUT32(?), ref: 004119A1

Strings

, xrefs: 00411802

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00454934, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134registry

APIs

Part of subcall function 00407550: LoadStringA.USER32(00000000,00010000,?,00001000), ref: 00407582

GetClassInfoA.USER32(?,?,?), ref: 004549F8
UnregisterClassA.USER32(?,?), ref: 00454A20
RegisterClassA.USER32(?), ref: 00454A36
GetWindowLongA.USER32(00000000,000000F0), ref: 00454A72
GetWindowLongA.USER32(00000000,000000F4), ref: 00454A87
SetWindowLongA.USER32(00000000,000000F4,00000000), ref: 00454A9A

Part of subcall function 00458910: IsIconic.USER32(?), ref: 0045891F
Part of subcall function 00458910: GetWindowPlacement.USER32(?,0000002C), ref: 0045893C
Part of subcall function 00458910: GetWindowRect.USER32(?), ref: 00458955
Part of subcall function 00458910: GetWindowLongA.USER32(?,000000F0), ref: 00458963
Part of subcall function 00458910: GetWindowLongA.USER32(?,000000F8), ref: 00458978
Part of subcall function 00458910: ScreenToClient.USER32(00000000), ref: 00458985
Part of subcall function 00458910: ScreenToClient.USER32(00000000,?), ref: 00458990

Part of subcall function 0042473C: CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000,Default,00000000,00424930,?,00000000,00424958), ref: 0042486B
Part of subcall function 0042473C: CreateFontIndirectA.GDI32(?), ref: 0042490D

Part of subcall function 0040F26C: GetLastError.KERNEL32(0040F31C,?,0041BBC3,?), ref: 0040F26C

Strings

@, xrefs: 0045496D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048AC14, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 110

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000,0048AD60), ref: 0048AC51
OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0048AD60), ref: 0048AC57
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000320,?,00000000,00000028,?,00000000,0048AD60), ref: 0048AC7D
LookupPrivilegeDisplayNameA.ADVAPI32(00000000,00000000,00000000,000000FF,?), ref: 0048ACEE

Part of subcall function 00489B40: MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00489B84

LookupPrivilegeNameA.ADVAPI32(00000000,?,00000000,000000FF), ref: 0048ACDD

Strings

GetTokenInformation error, xrefs: 0048AC86
OpenProcessToken error, xrefs: 0048AC60

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0041F7B4, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109thread

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F7BF
GetCurrentThreadId.KERNEL32 ref: 0041F7CE
EnterCriticalSection.KERNEL32(004999D0,0041F904,0041F95A,?,00000000,0041F979,?,004999D0), ref: 0041F8F7

Part of subcall function 0041F774: WaitForSingleObject.KERNEL32(000000EC), ref: 0041F77E

Part of subcall function 0041F768: ResetEvent.KERNEL32(000000EC,0041F809), ref: 0041F76E

EnterCriticalSection.KERNEL32(004999D0), ref: 0041F813
InterlockedExchange.KERNEL32(00491B2C,?), ref: 0041F82F
LeaveCriticalSection.KERNEL32(004999D0,00000000,0041F95A,?,00000000,0041F979,?,004999D0), ref: 0041F888

Strings

4PI, xrefs: 0041F7C4

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00449834, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 80libraryloader

APIs

ImageList_Write.COMCTL32(00000000,?,00000000,0044992E), ref: 004498F8

Part of subcall function 0040E3A4: GetFileVersionInfoSizeA.VERSION(00000000,?,00000000,0040E47A), ref: 0040E3E6
Part of subcall function 0040E3A4: GetFileVersionInfoA.VERSION(00000000,?,00000000,?,00000000,0040E45D,?,00000000,?,00000000,0040E47A), ref: 0040E41B
Part of subcall function 0040E3A4: VerQueryValueA.VERSION(?,0040E48C,?,?,00000000,?,00000000,?,00000000,0040E45D,?,00000000,?,00000000,0040E47A), ref: 0040E435

GetModuleHandleA.KERNEL32(comctl32.dll), ref: 00449868
GetProcAddress.KERNEL32(00000000,ImageList_WriteEx,comctl32.dll), ref: 00449879

Strings

comctl32.dll, xrefs: 00449863
ImageList_WriteEx, xrefs: 00449873
$qA, xrefs: 004498D4, 00449909
comctl32.dll, xrefs: 00449848

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042E4A0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68string

APIs

GetMonitorInfoA.USER32(?,?), ref: 0042E4D1
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0042E4F8
GetSystemMetrics.USER32(00000000), ref: 0042E50D
GetSystemMetrics.USER32(00000001), ref: 0042E518
lstrcpyA.KERNEL32(?,DISPLAY), ref: 0042E542

Part of subcall function 0042E174: GetProcAddress.KERNEL32(76C70000,00000000,00000000,0042E231), ref: 0042E1F3

Strings

DISPLAY, xrefs: 0042E539
GetMonitorInfo, xrefs: 0042E4B8

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042E574, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 68string

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0042E5CC
GetSystemMetrics.USER32(00000000), ref: 0042E5E1
GetSystemMetrics.USER32(00000001), ref: 0042E5EC
lstrcpyA.KERNEL32(?,DISPLAY), ref: 0042E616

Part of subcall function 0042E174: GetProcAddress.KERNEL32(76C70000,00000000,00000000,0042E231), ref: 0042E1F3

Strings

GetMonitorInfoA, xrefs: 0042E58C
tB, xrefs: 0042E591, 0042E59E, 0042E5A5
DISPLAY, xrefs: 0042E60D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042E648, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 68string

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0042E6A0
GetSystemMetrics.USER32(00000000), ref: 0042E6B5
GetSystemMetrics.USER32(00000001), ref: 0042E6C0
lstrcpyA.KERNEL32(?,DISPLAY), ref: 0042E6EA

Part of subcall function 0042E174: GetProcAddress.KERNEL32(76C70000,00000000,00000000,0042E231), ref: 0042E1F3

Strings

GetMonitorInfoW, xrefs: 0042E660
HB, xrefs: 0042E665, 0042E672, 0042E679
DISPLAY, xrefs: 0042E6E1

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004052FC, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindow

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,004053C3,?,?,?,00000001,0040546E,00403003,0040304A), ref: 00405335
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?), ref: 0040533B
GetStdHandle.KERNEL32(000000F5,00405384,00000002,?,00000000,00000000,?,004053C3,?,?,?,00000001,0040546E,00403003,0040304A), ref: 00405350
WriteFile.KERNEL32(00000000,000000F5,00405384,00000002,?), ref: 00405356
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00405374

Strings

Error, xrefs: 00405368
Runtime error at 00000000, xrefs: 0040532E, 0040536D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00442C9C, Relevance: 12.2, APIs: 8, Instructions: 154window

APIs

Part of subcall function 00407550: LoadStringA.USER32(00000000,00010000,?,00001000), ref: 00407582

GetCapture.USER32 ref: 00442D0D
GetCapture.USER32 ref: 00442D1C
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00442D22
ReleaseCapture.USER32 ref: 00442D27
GetActiveWindow.USER32 ref: 00442D78

Part of subcall function 004442A8: GetCursorPos.USER32 ref: 004442C3
Part of subcall function 004442A8: WindowFromPoint.USER32(?,?), ref: 004442D0
Part of subcall function 004442A8: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004442DE
Part of subcall function 004442A8: GetCurrentThreadId.KERNEL32(00000000,00000000,?,?), ref: 004442E5
Part of subcall function 004442A8: SendMessageA.USER32(00000000,00000084,00000000,?), ref: 0044430E
Part of subcall function 004442A8: SendMessageA.USER32(00000000,00000020,00000000,?), ref: 00444320
Part of subcall function 004442A8: SetCursor.USER32(00000000), ref: 00444332

Part of subcall function 0043B920: GetCurrentThreadId.KERNEL32(0043B8D0,00000000,00000000,0043B993,?,00000000,0043B9D1), ref: 0043B976
Part of subcall function 0043B920: EnumThreadWindows.USER32(00000000,0043B8D0,00000000), ref: 0043B97C

SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00442E0E
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00442E7B
GetActiveWindow.USER32 ref: 00442E8A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0046E0DC, Relevance: 12.1, APIs: 8, Instructions: 100registry

APIs

RegOpenKeyExA.ADVAPI32(80000000,00000000,00000000,000F003F,?,00000000,0046E238), ref: 0046E15A
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F,?,0046E23F,80000000,00000000,00000000,000F003F,?,00000000,0046E238), ref: 0046E17D
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,?,80000001,00000000,00000000,000F003F,?,0046E23F,80000000,00000000,00000000,000F003F,?), ref: 0046E19D
RegOpenKeyExA.ADVAPI32(80000003,00000000,00000000,000F003F,?,80000002,00000000,00000000,000F003F,?,80000001,00000000,00000000,000F003F,?,0046E23F), ref: 0046E1BD
RegOpenKeyExA.ADVAPI32(80000005,00000000,00000000,000F003F,?,80000003,00000000,00000000,000F003F,?,80000002,00000000,00000000,000F003F,?,80000001), ref: 0046E1DD
RegOpenKeyExA.ADVAPI32(80000006,00000000,00000000,000F003F,?,80000005,00000000,00000000,000F003F,?,80000003,00000000,00000000,000F003F,?,80000002), ref: 0046E1FD
RegDeleteValueA.ADVAPI32(?,00000000,00000000,0046E238), ref: 0046E20F
RegCloseKey.ADVAPI32(?,?,00000000,00000000,0046E238), ref: 0046E218

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004462F4, Relevance: 12.1, APIs: 8, Instructions: 99windowthread

APIs

GetCapture.USER32 ref: 0044631A
GetParent.USER32(00000000), ref: 00446340
IsWindowUnicode.USER32(00000000), ref: 0044635D
SendMessageW.USER32(00000000,-0000BBEE,015B8130,?), ref: 00446378
SendMessageA.USER32(00000000,-0000BBEE,015B8130,?), ref: 00446397
GetWindowThreadProcessId.USER32(00000000), ref: 004463A6
GetWindowThreadProcessId.USER32(?,?), ref: 004463B4
SendMessageA.USER32(00000000,-0000BBEE,015B8130,?), ref: 004463D4

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0046E244, Relevance: 12.1, APIs: 8, Instructions: 95registry

APIs

RegOpenKeyExA.ADVAPI32(80000000,00000000,00000000,000F003F,?,00000000,0046E391), ref: 0046E2B7
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F,?,80000000,00000000,00000000,000F003F,?,00000000,0046E391), ref: 0046E2DA
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,?,80000001,00000000,00000000,000F003F,?,80000000,00000000,00000000,000F003F,?,00000000), ref: 0046E2FA
RegOpenKeyExA.ADVAPI32(80000003,00000000,00000000,000F003F,?,80000002,00000000,00000000,000F003F,?,80000001,00000000,00000000,000F003F,?,80000000), ref: 0046E31A
RegOpenKeyExA.ADVAPI32(80000005,00000000,00000000,000F003F,?,80000003,00000000,00000000,000F003F,?,80000002,00000000,00000000,000F003F,?,80000001), ref: 0046E33A
RegOpenKeyExA.ADVAPI32(80000006,00000000,00000000,000F003F,?,80000005,00000000,00000000,000F003F,?,80000003,00000000,00000000,000F003F,?,80000002), ref: 0046E35A
RegDeleteKeyA.ADVAPI32(?,0046E39C), ref: 0046E368
RegCloseKey.ADVAPI32(?,?,0046E39C,00000000,0046E391), ref: 0046E371

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00426060, Relevance: 12.1, APIs: 8, Instructions: 79window

APIs

GetDC.USER32(00000000), ref: 0042608E
GetDeviceCaps.GDI32(?,00000068), ref: 004260AA
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004260C9
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 004260ED
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 0042610B
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 0042611F
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0042613F
ReleaseDC.USER32(00000000,?), ref: 00426157

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00434550, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 177window

APIs

GetVersion.KERNEL32(00000000,004347A1), ref: 004345EC
InsertMenuItemA.USER32(?,000000FF,000000FF,0000002C), ref: 004346F5
InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 0043477E

Part of subcall function 00434A54: CreatePopupMenu.USER32 ref: 00434A6F
Part of subcall function 00434A54: CreateMenu.USER32 ref: 00434A79

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 00434765

Strings

?, xrefs: 00434607
,, xrefs: 00434600

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00488F80, Relevance: 10.7, APIs: 7, Instructions: 169

APIs

SetCursorPos.USER32(00000000,00000000), ref: 004890E0
mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 004890FB
mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 0048910A
mouse_event.USER32(00000008,00000000,00000000,00000000,00000000), ref: 0048911B
mouse_event.USER32(00000010,00000000,00000000,00000000,00000000), ref: 0048912A
mouse_event.USER32(00000020,00000000,00000000,00000000,00000000), ref: 0048913B
mouse_event.USER32(00000040,00000000,00000000,00000000,00000000), ref: 0048914A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00488D70, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139window

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00488DAA
CreateCompatibleDC.GDI32(?), ref: 00488DC4
CreateCompatibleBitmap.GDI32(?,00000000,00000000), ref: 00488DDC
SelectObject.GDI32(?,?), ref: 00488DEC
BitBlt.GDI32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,00CC0020), ref: 00488E15

Part of subcall function 0045FB1C: GdipCreateBitmapFromHBITMAP.GDIPLUS(?,?,?), ref: 0045FB43

Part of subcall function 0045FA24: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,0045FA7A), ref: 0045FA54

Strings

image/jpeg, xrefs: 00488E70

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00446834, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 138window

APIs

Part of subcall function 00447BE4: GetActiveWindow.USER32 ref: 00447C0B
Part of subcall function 00447BE4: GetLastActivePopup.USER32(?), ref: 00447C1D

GetWindowRect.USER32(?,?), ref: 004468B6
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 004468EE

Part of subcall function 0043B920: GetCurrentThreadId.KERNEL32(0043B8D0,00000000,00000000,0043B993,?,00000000,0043B9D1), ref: 0043B976
Part of subcall function 0043B920: EnumThreadWindows.USER32(00000000,0043B8D0,00000000), ref: 0043B97C

MessageBoxA.USER32(00000000,?,?,?), ref: 0044692D
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0044697D

Part of subcall function 0043B9E4: IsWindow.USER32(?), ref: 0043B9F2
Part of subcall function 0043B9E4: EnableWindow.USER32(?,000000FF), ref: 0043BA01

SetActiveWindow.USER32(00000000), ref: 0044698E

Strings

(, xrefs: 00446893

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00446524, Relevance: 10.6, APIs: 7, Instructions: 105window

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00446538
IsWindowUnicode.USER32 ref: 0044654C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0044656D
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00446583

Part of subcall function 00447DD0: GetCapture.USER32 ref: 00447DDA
Part of subcall function 00447DD0: GetParent.USER32(00000000), ref: 00447E08

Part of subcall function 004462A4: TranslateMDISysAccel.USER32(?), ref: 004462E3

Part of subcall function 004462F4: GetCapture.USER32 ref: 0044631A
Part of subcall function 004462F4: GetParent.USER32(00000000), ref: 00446340
Part of subcall function 004462F4: IsWindowUnicode.USER32(00000000), ref: 0044635D
Part of subcall function 004462F4: SendMessageW.USER32(00000000,-0000BBEE,015B8130,?), ref: 00446378
Part of subcall function 004462F4: SendMessageA.USER32(00000000,-0000BBEE,015B8130,?), ref: 00446397
Part of subcall function 004462F4: GetWindowThreadProcessId.USER32(00000000), ref: 004463A6
Part of subcall function 004462F4: GetWindowThreadProcessId.USER32(?,?), ref: 004463B4
Part of subcall function 004462F4: SendMessageA.USER32(00000000,-0000BBEE,015B8130,?), ref: 004463D4

Part of subcall function 0044625C: IsWindowUnicode.USER32(00000000), ref: 00446270
Part of subcall function 0044625C: IsDialogMessageW.USER32(?), ref: 00446281
Part of subcall function 0044625C: IsDialogMessageA.USER32(?,?,00000000,015B8130,00000001,00446607,?,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000), ref: 00446296

TranslateMessage.USER32 ref: 0044660C
DispatchMessageW.USER32 ref: 00446618
DispatchMessageA.USER32 ref: 00446620

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004282D0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 00428322
MulDiv.KERNEL32(?,?,000009EC), ref: 00428339
GetDC.USER32(00000000), ref: 00428350
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?), ref: 00428374
GetWinMetaFileBits.GDI32(?,?,?,00000008,?), ref: 004283A7

Part of subcall function 00425A70: GetLastError.KERNEL32(00000000,00425B0C), ref: 00425A90
Part of subcall function 00425A70: FormatMessageA.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,00425B0C), ref: 00425AB6

Strings

`, xrefs: 00428308

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00444344, Relevance: 10.6, APIs: 7, Instructions: 89

APIs

SystemParametersInfoA.USER32(0000001F,0000003C,?,00000000), ref: 00444399
CreateFontIndirectA.GDI32(?), ref: 004443A6
GetStockObject.GDI32(0000000D), ref: 004443BC
SystemParametersInfoA.USER32(00000029,00000000,00000154,00000000), ref: 004443E5
CreateFontIndirectA.GDI32(?), ref: 004443F5
CreateFontIndirectA.GDI32(?), ref: 0044440E

Part of subcall function 00424A5C: MulDiv.KERNEL32(00000000,?,00000048), ref: 00424A69

GetStockObject.GDI32(0000000D), ref: 00444434

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00482B34, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84threadsleepmemory

APIs

ExitThread.KERNEL32(00000000,00000000,00482BF9,?,00000000,00482C2E), ref: 00482BA4
LocalAlloc.KERNEL32(00000040,00000008,00000000,00482BF9,?,00000000,00482C2E), ref: 00482BAD
CreateThread.KERNEL32(00000000,00000000,Function_0008298C,00000000,00000000,?), ref: 00482BD6
Sleep.KERNEL32(00000064,00000000,00000000,Function_0008298C,00000000,00000000,?,00000040,00000008,00000000,00482BF9,?,00000000,00482C2E), ref: 00482BDD
ExitThread.KERNEL32(00000000,00000000,00482BF9,?,00000000,00482C2E), ref: 00482BEA

Strings

p)H, xrefs: 00482B48, 00482C1A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00428A00, Relevance: 10.6, APIs: 7, Instructions: 66

APIs

Part of subcall function 004262B4: GetObjectA.GDI32(?,00000004), ref: 004262CB
Part of subcall function 004262B4: GetPaletteEntries.GDI32(?,00000000,?,?), ref: 004262EE

GetDC.USER32(00000000), ref: 00428A3E
CreateCompatibleDC.GDI32(?), ref: 00428A4A
SelectObject.GDI32(?), ref: 00428A57
SetDIBColorTable.GDI32(?,00000000,00000000,?), ref: 00428A7B
SelectObject.GDI32(?,?), ref: 00428A95
DeleteDC.GDI32(?), ref: 00428A9E
ReleaseDC.USER32(00000000,?), ref: 00428AA9

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004442A8, Relevance: 10.6, APIs: 7, Instructions: 57threadwindow

APIs

GetCursorPos.USER32 ref: 004442C3
WindowFromPoint.USER32(?,?), ref: 004442D0
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004442DE
GetCurrentThreadId.KERNEL32(00000000,00000000,?,?), ref: 004442E5
SendMessageA.USER32(00000000,00000084,00000000,?), ref: 0044430E
SendMessageA.USER32(00000000,00000020,00000000,?), ref: 00444320
SetCursor.USER32(00000000), ref: 00444332

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00404448, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 49registry

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040446A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,&,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040449D
RegCloseKey.ADVAPI32(?,004044C0,00000000,?,00000004,00000000,&,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 004044B3

Strings

&, xrefs: 00404476
FPUMaskValue, xrefs: 00404494
SOFTWARE\Borland\Delphi\RTL, xrefs: 00404460

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00488B18, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00488B3D
GetDeviceCaps.GDI32(00000000,00000008), ref: 00488B47
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00488B54
EnumDisplayMonitors.USER32(00000000,00000000,004889F0,00000000), ref: 00488B85

Part of subcall function 00475E2C: send.WSOCK32(00000248,00000000,?,00000000,00000000,00475EBD), ref: 00475E9D

Strings

DISPLAY, xrefs: 00488B6E
MONSIZE0x0x0x0, xrefs: 00488B8C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040F3A4, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46

APIs

FindResourceA.KERNEL32(00400000,DVCLAL,0000000A), ref: 0040F3C1
LoadResource.KERNEL32(00400000,00000000,00400000,DVCLAL,0000000A), ref: 0040F3CF
FindResourceA.KERNEL32(00400000,DVCLAL,0000000A), ref: 0040F3F3
LoadResource.KERNEL32(00400000,00000000,00400000,DVCLAL,0000000A), ref: 0040F3FA

Strings

0PI, xrefs: 0040F3A8, 0040F3B9, 0040F3C7
DVCLAL, xrefs: 0040F3B4, 0040F3EA

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00484B30, Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 176sleep

APIs

Part of subcall function 0048485C: InternetOpenA.WININET(Mozilla,00000001,00000000,00000000,00000000), ref: 0048490C
Part of subcall function 0048485C: InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,04000000,00000000), ref: 00484944
Part of subcall function 0048485C: HttpQueryInfoA.WININET(00000000,00000013,?,00000200,?), ref: 0048497D
Part of subcall function 0048485C: InternetReadFile.WININET(00000000,?,00000400,?), ref: 00484A04
Part of subcall function 0048485C: ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 00484A75
Part of subcall function 0048485C: InternetCloseHandle.WININET(00000000), ref: 00484A95

Part of subcall function 0048CE74: GetUserNameA.ADVAPI32(?), ref: 0048CE8A

Part of subcall function 00475E2C: send.WSOCK32(00000248,00000000,?,00000000,00000000,00475EBD), ref: 00475E9D

Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,00000000,00484D9A,?,?,?,?,00000006,00000000), ref: 00484D38

Part of subcall function 00475BD8: closesocket.WSOCK32(00000248,00000000,00475D47,?,00000000,00475D76,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00475D2E
Part of subcall function 00475BD8: GetCurrentProcessId.KERNEL32(00000248,00000000,00475D47,?,00000000,00475D76,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00475D33

Strings

DownloadFail, xrefs: 00484CBC
BTRESULTMass Download|Downloading File...|, xrefs: 00484C52
BTERRORDownload File| Error on downloading file check if you type the correct url...|, xrefs: 00484D0C
BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|, xrefs: 00484CEA
DownloadSuccess, xrefs: 00484CA2

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0043EC18, Relevance: 9.2, APIs: 6, Instructions: 150

APIs

Part of subcall function 00424FEC: CreateBrushIndirect.GDI32(?), ref: 00425097

FillRect.USER32(?,?), ref: 0043EC91
GetClientRect.USER32(00000000,?), ref: 0043ECBC
FillRect.USER32(?,?,00000000), ref: 0043ECDB

Part of subcall function 0043EB8C: CallWindowProcA.USER32(?,?,?,?,?), ref: 0043EBC6

Part of subcall function 0043B78C: GetWindowLongA.USER32(?,000000EC), ref: 0043B799
Part of subcall function 0043B78C: SetWindowLongA.USER32(?,000000EC,00000000), ref: 0043B7BC
Part of subcall function 0043B78C: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 0043B7CE

BeginPaint.USER32(?,?), ref: 0043ED53
GetWindowRect.USER32(?,?), ref: 0043ED80

Part of subcall function 0044EEA0: GetWindowOrgEx.GDI32(?), ref: 0044EEAE
Part of subcall function 0044EEA0: SetWindowOrgEx.GDI32(?,?,?,00000000), ref: 0044EEC4

Part of subcall function 00455D50: BeginPaint.USER32(00000000,?), ref: 00455D7B
Part of subcall function 00455D50: SaveDC.GDI32(00000000), ref: 00455DB4
Part of subcall function 00455D50: ExcludeClipRect.GDI32(00000000,?,?,?,?), ref: 00455E36
Part of subcall function 00455D50: RestoreDC.GDI32(00000000,00000000), ref: 00455E6C
Part of subcall function 00455D50: EndPaint.USER32(00000000,?), ref: 00455EA9

EndPaint.USER32(?,?), ref: 0043EDE0

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00441160, Relevance: 9.1, APIs: 6, Instructions: 125

APIs

Part of subcall function 004253D0: EnterCriticalSection.KERNEL32(00499A30,00000000,00423D82,00000000,00423DE1), ref: 004253D8
Part of subcall function 004253D0: LeaveCriticalSection.KERNEL32(00499A30,00499A30,00000000,00423D82,00000000,00423DE1), ref: 004253E5
Part of subcall function 004253D0: EnterCriticalSection.KERNEL32(00000038,00499A30,00499A30,00000000,00423D82,00000000,00423DE1), ref: 004253EE

SaveDC.GDI32(?), ref: 004411AD
ExcludeClipRect.GDI32(?,?,?,?,?), ref: 00441234
GetStockObject.GDI32(00000004), ref: 00441256
FillRect.USER32(00000000,?,00000000), ref: 0044126F

Part of subcall function 00424230: GetSysColor.USER32(?), ref: 0042423A

SetBkColor.GDI32(00000000,00000000), ref: 004412BA

Part of subcall function 0042535C: FillRect.USER32(?,00000000,00000000), ref: 00425385

RestoreDC.GDI32(00000000,?), ref: 004412E5

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004556F4, Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 353

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000077), ref: 004557E5
DefWindowProcA.USER32(00000000,?,?,?), ref: 00455AEF

Part of subcall function 0044D640: GetCapture.USER32 ref: 0044D640

_TrackMouseEvent.COMCTL32(00000010), ref: 00455A9D

Part of subcall function 00455640: GetCapture.USER32 ref: 00455653

Part of subcall function 004554F4: GetMessagePos.USER32 ref: 00455503
Part of subcall function 004554F4: GetKeyboardState.USER32(?), ref: 00455600

GetCapture.USER32 ref: 00455B5A

Part of subcall function 00451C28: GetKeyboardState.USER32(?), ref: 00451E90

Strings

zC, xrefs: 0045594E, 0045596C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00446070, Relevance: 9.1, APIs: 6, Instructions: 99window

APIs

Part of subcall function 0043B75C: IsIconic.USER32(?), ref: 0043B773

SetActiveWindow.USER32(?), ref: 0044608F
ShowWindow.USER32(00000000,00000009), ref: 004460B4
IsWindowEnabled.USER32(00000000), ref: 004460D3
DefWindowProcA.USER32(?,00000112,0000F120,00000000), ref: 004460EC

Part of subcall function 00444C44: ShowWindow.USER32(?,00000006), ref: 00444C5F

SetWindowPos.USER32(?,00000000,00000000,?,?,00445ABE,00000000), ref: 00446132
SetFocus.USER32(00000000), ref: 00446180

Part of subcall function 0043FDB4: ShowWindow.USER32(00000000,?), ref: 0043FDEA

Part of subcall function 00445490: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000213), ref: 004454DE

Part of subcall function 004455EC: EnumWindows.USER32(00445518,00000000), ref: 00445620
Part of subcall function 004455EC: ShowWindow.USER32(?,00000000), ref: 00445655
Part of subcall function 004455EC: ShowOwnedPopups.USER32(00000000,?), ref: 00445684
Part of subcall function 004455EC: ShowWindow.USER32(?,00000005), ref: 004456EA
Part of subcall function 004455EC: ShowOwnedPopups.USER32(00000000,?), ref: 00445719

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00426564, Relevance: 9.1, APIs: 6, Instructions: 84

APIs

GetSystemMetrics.USER32(0000000B), ref: 004265B2
GetSystemMetrics.USER32(0000000C), ref: 004265BE
GetDC.USER32(00000000), ref: 004265DA
GetDeviceCaps.GDI32(00000000,0000000E), ref: 00426601
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0042660E
ReleaseDC.USER32(00000000,00000000), ref: 00426647

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004269DC, Relevance: 9.1, APIs: 6, Instructions: 65window

APIs

Part of subcall function 00426888: GetObjectA.GDI32(?,00000054), ref: 0042689C

CreateCompatibleDC.GDI32(00000000), ref: 004269FE
SelectPalette.GDI32(?,?,00000000), ref: 00426A1F
RealizePalette.GDI32(?), ref: 00426A2B
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 00426A42
SelectPalette.GDI32(?,00000000,00000000), ref: 00426A6A
DeleteDC.GDI32(?), ref: 00426A73

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00426210, Relevance: 9.1, APIs: 6, Instructions: 56window

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00426229
SelectObject.GDI32(00000000,00000000), ref: 00426232
GetDIBColorTable.GDI32(00000000,00000000,00000100,?), ref: 00426246
SelectObject.GDI32(00000000,00000000), ref: 00426252
DeleteDC.GDI32(00000000), ref: 00426258
CreatePalette.GDI32 ref: 0042629F

Part of subcall function 00426178: GetDC.USER32(00000000), ref: 00426190
Part of subcall function 00426178: GetDeviceCaps.GDI32(?,00000068), ref: 004261AC
Part of subcall function 00426178: GetPaletteEntries.GDI32(48080787,00000000,00000008,?), ref: 004261C4
Part of subcall function 00426178: GetPaletteEntries.GDI32(48080787,00000008,00000008,?), ref: 004261DC
Part of subcall function 00426178: ReleaseDC.USER32(00000000,?), ref: 004261F8

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00401A0C, Relevance: 9.0, APIs: 7, Instructions: 298sleepmemory

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,004019DA), ref: 004017D8

Part of subcall function 00401770: Sleep.KERNEL32(00000000,004017F3,00000000,?,00101000,00000004,?,?,?,?,004019DA), ref: 00401786
Part of subcall function 00401770: Sleep.KERNEL32(0000000A,00000000,004017F3,00000000,?,00101000,00000004,?,?,?,?,004019DA), ref: 0040179F

Sleep.KERNEL32(00000000,?,004019DA), ref: 00401AC3
Sleep.KERNEL32(0000000A,00000000,?,004019DA), ref: 00401AD9
Sleep.KERNEL32(00000000,?,?,?,004019DA), ref: 00401B07
Sleep.KERNEL32(0000000A,00000000,?,?,?,004019DA), ref: 00401B1D
Sleep.KERNEL32(00000000,?,004019DA), ref: 00401C4C
Sleep.KERNEL32(0000000A,00000000,?,004019DA), ref: 00401C62

Part of subcall function 004016F8: VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00401D07,?,004019DA), ref: 0040170E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004258EC, Relevance: 9.0, APIs: 6, Instructions: 43

APIs

Part of subcall function 00424FEC: CreateBrushIndirect.GDI32(?), ref: 00425097

UnrealizeObject.GDI32(00000000), ref: 004258F8
SelectObject.GDI32(?,00000000), ref: 0042590A
SetBkColor.GDI32(?,00000000), ref: 0042592D
SetBkMode.GDI32(?,00000002), ref: 00425938

Part of subcall function 00424230: GetSysColor.USER32(?), ref: 0042423A

SetBkColor.GDI32(?,00000000), ref: 00425953
SetBkMode.GDI32(?,00000001), ref: 0042595E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042A930, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112window

APIs

GetDC.USER32(00000000), ref: 0042A9EC
CreateHalftonePalette.GDI32(00000000), ref: 0042A9F9
ReleaseDC.USER32(00000000,00000000), ref: 0042AA08
DeleteObject.GDI32(00000000), ref: 0042AA76

Strings

(, xrefs: 0042A9A3

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048DA48, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 102

APIs

Netbios.NETAPI32(00000032), ref: 0048DA8A
Netbios.NETAPI32(00000033), ref: 0048DB01

Strings

3, xrefs: 0048DACB
memory allocation failed!, xrefs: 0048DAEB
%.2x-%.2x-%.2x-%.2x-%.2x-%.2x, xrefs: 0048DBA0

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00446EDC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98timethreadwindow

APIs

Part of subcall function 00446E50: GetCursorPos.USER32 ref: 00446E57

SetTimer.USER32(00000000,00000000,?,00446E74), ref: 00446FAB

Part of subcall function 00446DEC: IsWindowVisible.USER32(00000000), ref: 00446E24
Part of subcall function 00446DEC: IsWindowEnabled.USER32(00000000), ref: 00446E35

GetCurrentThreadId.KERNEL32(00000000,00447029,?,?,?,015B8130), ref: 00446FE5
WaitMessage.USER32 ref: 00447009

Part of subcall function 0041F7B4: GetCurrentThreadId.KERNEL32 ref: 0041F7BF
Part of subcall function 0041F7B4: GetCurrentThreadId.KERNEL32 ref: 0041F7CE
Part of subcall function 0041F7B4: EnterCriticalSection.KERNEL32(004999D0), ref: 0041F813
Part of subcall function 0041F7B4: InterlockedExchange.KERNEL32(00491B2C,?), ref: 0041F82F
Part of subcall function 0041F7B4: LeaveCriticalSection.KERNEL32(004999D0,00000000,0041F95A,?,00000000,0041F979,?,004999D0), ref: 0041F888
Part of subcall function 0041F7B4: EnterCriticalSection.KERNEL32(004999D0,0041F904,0041F95A,?,00000000,0041F979,?,004999D0), ref: 0041F8F7

Strings

TfD, xrefs: 00446EFE, 00446F08, 00446F59, 00446F81, 00446FBE, 00446F8E, 00446F69, 00446F6C, 00446F14, 00446F1D
4PI, xrefs: 00446FEA

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00482320, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85threadsleep

APIs

Sleep.KERNEL32(00000064,?,00000000,00482455), ref: 004823D3
CreateThread.KERNEL32(00000000,00000000,Function_000821A0,00000000,00000000,?), ref: 004823E8

Part of subcall function 0048CE74: GetUserNameA.ADVAPI32(?), ref: 0048CE8A

Part of subcall function 00475E2C: send.WSOCK32(00000248,00000000,?,00000000,00000000,00475EBD), ref: 00475E9D

ExitThread.KERNEL32(00000000,00000000,00000000,Function_000821A0,00000000,00000000,?,00000064,?,00000000,00482455), ref: 0048242B

Strings

@, xrefs: 004823BE
BTRESULTUDP Flood|UDP Flood task finished!|, xrefs: 00482417

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004827C4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85threadsleep

APIs

Sleep.KERNEL32(00000064,?,00000000,004828F9), ref: 00482877
CreateThread.KERNEL32(00000000,00000000,Function_00082630,00000000,00000000,?), ref: 0048288C

Part of subcall function 0048CE74: GetUserNameA.ADVAPI32(?), ref: 0048CE8A

Part of subcall function 00475E2C: send.WSOCK32(00000248,00000000,?,00000000,00000000,00475EBD), ref: 00475E9D

ExitThread.KERNEL32(00000000,00000000,00000000,Function_00082630,00000000,00000000,?,00000064,?,00000000,004828F9), ref: 004828CF

Strings

BTRESULTSyn Flood|Syn task finished!|, xrefs: 004828BB
@, xrefs: 00482862

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00483858, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85threadsleep

APIs

Sleep.KERNEL32(00000064,?,00000000,0048398D), ref: 0048390B
CreateThread.KERNEL32(00000000,00000000,Function_000836D8,00000000,00000000,?), ref: 00483920

Part of subcall function 0048CE74: GetUserNameA.ADVAPI32(?), ref: 0048CE8A

Part of subcall function 00475E2C: send.WSOCK32(00000248,00000000,?,00000000,00000000,00475EBD), ref: 00475E9D

ExitThread.KERNEL32(00000000,00000000,00000000,Function_000836D8,00000000,00000000,?,00000064,?,00000000,0048398D), ref: 00483963

Strings

@, xrefs: 004838F6
BTRESULTHTTP Flood|Http Flood task finished!|, xrefs: 0048394F

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00431630, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68clipboard

APIs

EnumClipboardFormats.USER32(00000000), ref: 00431657
GetClipboardData.USER32(00000000), ref: 00431677
GetClipboardData.USER32(00000009), ref: 00431680
EnumClipboardFormats.USER32(00000000), ref: 0043169F

Strings

84B, xrefs: 00431665

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042EA7C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50thread

APIs

Part of subcall function 00407688: TlsGetValue.KERNEL32(00000000,00000000,00403029), ref: 004076AD
Part of subcall function 00407688: TlsGetValue.KERNEL32(00000000,00403029), ref: 004076BE

IsWindow.USER32(?), ref: 0042EA99
FindWindowExA.USER32(00000000,00000000,OleMainThreadWndClass,00000000), ref: 0042EACA
GetWindowThreadProcessId.USER32(?,00000000), ref: 0042EB03
GetCurrentThreadId.KERNEL32(?,00000000,00000000,00000000,OleMainThreadWndClass,00000000,?,?,00000000,0042EB52), ref: 0042EB0A

Strings

OleMainThreadWndClass, xrefs: 0042EAC3

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0043D9A4, Relevance: 7.7, APIs: 5, Instructions: 183

APIs

MulDiv.KERNEL32(00000000,?,?), ref: 0043DA73

Part of subcall function 00450350: MulDiv.KERNEL32(?,00000000,00000000), ref: 00450365
Part of subcall function 00450350: MulDiv.KERNEL32(?,00000000,00000000), ref: 00450382
Part of subcall function 00450350: MulDiv.KERNEL32(?,00000000,00000000), ref: 0045039F
Part of subcall function 00450350: MulDiv.KERNEL32(?,00000000,00000000), ref: 004503BC

MulDiv.KERNEL32(?,00000000,00000000), ref: 0043DB05
MulDiv.KERNEL32(?,00000000,00000000), ref: 0043DB34
MulDiv.KERNEL32(?,00000000,00000000), ref: 0043DB63
MulDiv.KERNEL32(?,00000000,00000000), ref: 0043DB86

Part of subcall function 0043CF00: MulDiv.KERNEL32(?,00000001,00000001), ref: 0043CF5D
Part of subcall function 0043CF00: MulDiv.KERNEL32(?,00000001,00000001), ref: 0043CF7D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0043F914, Relevance: 7.7, APIs: 5, Instructions: 174window

APIs

Part of subcall function 00407550: LoadStringA.USER32(00000000,00010000,?,00001000), ref: 00407582

GetMenu.USER32(00000000), ref: 0043FA38
SetMenu.USER32(00000000,00000000), ref: 0043FA55
SetMenu.USER32(00000000,00000000), ref: 0043FA8A
SetMenu.USER32(00000000,00000000), ref: 0043FAA6

Part of subcall function 0043F84C: GetMenu.USER32(00000000), ref: 0043F892
Part of subcall function 0043F84C: SendMessageA.USER32(00000000,00000230,00000000,00000000), ref: 0043F8AA
Part of subcall function 0043F84C: DrawMenuBar.USER32(00000000), ref: 0043F8BB

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000037), ref: 0043FAED

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00434AE4, Relevance: 7.7, APIs: 5, Instructions: 168

APIs

DrawEdge.USER32(00000000,?,00000006,00000002), ref: 00434BB3
OffsetRect.USER32(?,00000001,00000001), ref: 00434C04
DrawTextA.USER32(00000000,00000000,?,?,?), ref: 00434C3D
OffsetRect.USER32(?,000000FF,000000FF), ref: 00434C4A

Part of subcall function 00424230: GetSysColor.USER32(?), ref: 0042423A

DrawTextA.USER32(00000000,00000000,?,?,?), ref: 00434CB5

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00473208, Relevance: 7.6, APIs: 5, Instructions: 114network

APIs

socket.WSOCK32(00000002,00000001,00000000,00000000,00473339), ref: 0047323B
WSAIoctl.WS2_32(000000FF,4004747F,00000000,00000000,?,00000400,?,00000000,00000000), ref: 0047327C
inet_ntoa.WSOCK32(?,000000FF,4004747F,00000000,00000000,?,00000400,?,00000000,00000000,00000000,0047330B,?,00000002,00000001,00000000), ref: 004732AC
inet_ntoa.WSOCK32(?,?,000000FF,4004747F,00000000,00000000,?,00000400,?,00000000,00000000,00000000,0047330B,?,00000002,00000001), ref: 004732E8
closesocket.WSOCK32(000000FF,00000000,?,00000400,?,00000000,00000000,00000000,0047330B,?,00000002,00000001,00000000,00000000,00473339), ref: 00473319

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004455EC, Relevance: 7.6, APIs: 5, Instructions: 109

APIs

EnumWindows.USER32(00445518,00000000), ref: 00445620
ShowWindow.USER32(?,00000000), ref: 00445655
ShowOwnedPopups.USER32(00000000,?), ref: 00445684
ShowWindow.USER32(?,00000005), ref: 004456EA
ShowOwnedPopups.USER32(00000000,?), ref: 00445719

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004878A4, Relevance: 7.6, APIs: 5, Instructions: 109memorythread

APIs

EnterCriticalSection.KERNEL32(0049C3A8,00000000,00487A08), ref: 004878F3

Part of subcall function 00487318: EnterCriticalSection.KERNEL32(0049C3A8,00000000,00487468,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00487347
Part of subcall function 00487318: LeaveCriticalSection.KERNEL32(0049C3A8,0048744D,00487468,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00487440

LocalAlloc.KERNEL32(00000040,00000010,?,0049C3A8,00000000,00487A08), ref: 0048795A
CreateThread.KERNEL32(00000000,00000000,Function_00086E2C,00000000,00000000,?), ref: 004879AE
CloseHandle.KERNEL32(00000000), ref: 004879B4
LeaveCriticalSection.KERNEL32(0049C3A8,004879D8,Function_00086E2C,00000000,00000000,?,00000040,00000010,?,0049C3A8,00000000,00487A08), ref: 004879CB

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042EB3C, Relevance: 7.6, APIs: 5, Instructions: 86window

APIs

Part of subcall function 0042EA7C: IsWindow.USER32(?), ref: 0042EA99
Part of subcall function 0042EA7C: FindWindowExA.USER32(00000000,00000000,OleMainThreadWndClass,00000000), ref: 0042EACA
Part of subcall function 0042EA7C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0042EB03
Part of subcall function 0042EA7C: GetCurrentThreadId.KERNEL32(?,00000000,00000000,00000000,OleMainThreadWndClass,00000000,?,?,00000000,0042EB52), ref: 0042EB0A

MsgWaitForMultipleObjectsEx.USER32(?,?,?,000000BF,?), ref: 0042EB6A
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0042EB85
TranslateMessage.USER32(?), ref: 0042EB92
DispatchMessageA.USER32(?), ref: 0042EB9B
WaitForMultipleObjectsEx.KERNEL32(?,?,?,?,00000000), ref: 0042EBC7

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00434924, Relevance: 7.6, APIs: 5, Instructions: 77window

APIs

Part of subcall function 00434A54: CreatePopupMenu.USER32 ref: 00434A6F
Part of subcall function 00434A54: CreateMenu.USER32 ref: 00434A79

GetMenuItemCount.USER32(00000000), ref: 0043495C
GetMenuState.USER32(00000000,-00000001,00000400), ref: 0043497D
RemoveMenu.USER32(00000000,-00000001,00000400), ref: 00434994
GetMenuItemCount.USER32(00000000), ref: 004349C4
DestroyMenu.USER32(00000000), ref: 004349D1

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00443430, Relevance: 7.6, APIs: 5, Instructions: 61

APIs

GetWindowLongA.USER32(00000000,000000EC), ref: 00443464
SetWindowLongA.USER32(00000000,000000EC,00000000), ref: 00443496
SetLayeredWindowAttributes.USER32(00000000,?,?,00000000), ref: 004434CF
SetWindowLongA.USER32(00000000,000000EC,00000000), ref: 004434E8
RedrawWindow.USER32(00000000,00000000,00000000,00000485), ref: 004434FE

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00426178, Relevance: 7.6, APIs: 5, Instructions: 55window

APIs

GetDC.USER32(00000000), ref: 00426190
GetDeviceCaps.GDI32(?,00000068), ref: 004261AC
GetPaletteEntries.GDI32(48080787,00000000,00000008,?), ref: 004261C4
GetPaletteEntries.GDI32(48080787,00000008,00000008,?), ref: 004261DC
ReleaseDC.USER32(00000000,?), ref: 004261F8

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040D5C0, Relevance: 7.6, APIs: 5, Instructions: 50thread

APIs

GetThreadLocale.KERNEL32(?,00000000,0040D657,?,?,00000000), ref: 0040D5D8

Part of subcall function 0040D334: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0040D352

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0040D657,?,?,00000000), ref: 0040D608
EnumCalendarInfoA.KERNEL32(Function_0000D50C,00000000,00000000,00000004), ref: 0040D613
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0040D657,?,?,00000000), ref: 0040D631
EnumCalendarInfoA.KERNEL32(Function_0000D548,00000000,00000000,00000003), ref: 0040D63C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00444B90, Relevance: 7.5, APIs: 5, Instructions: 25synchronizationthread

APIs

UnhookWindowsHookEx.USER32(00000000), ref: 00444B9F
SetEvent.KERNEL32(00000000,004474C2,?,00447333), ref: 00444BBA
GetCurrentThreadId.KERNEL32(00000000,004474C2,?,00447333), ref: 00444BBF
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00444BD4
CloseHandle.KERNEL32(00000000), ref: 00444BDF

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00487488, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 155

APIs

EnterCriticalSection.KERNEL32(0049C3A8,00000000,00487671,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00487016), ref: 004874B5
closesocket.WSOCK32(00000000,FpH,?,?,?,?,0049C3A8,00000000,00487671,?,?,00000000,?,00000000,00000000,00000000), ref: 0048761C
LeaveCriticalSection.KERNEL32(0049C3A8,00487656,00487671,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00487016), ref: 00487649

Strings

FpH, xrefs: 004875BE, 004875C1

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040D670, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148thread

APIs

GetThreadLocale.KERNEL32(?,00000000,0040D840,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040D69F

Part of subcall function 0040D334: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0040D352

Strings

eeee, xrefs: 0040D7AE
yyyy, xrefs: 0040D795
ggg, xrefs: 0040D785

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00448CDC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128

APIs

ImageList_GetImageCount.COMCTL32(?,?,?,00000000,00448E75), ref: 00448D9D

Part of subcall function 0042535C: FillRect.USER32(?,00000000,00000000), ref: 00425385

ImageList_Draw.COMCTL32(?,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00448E75), ref: 00448DDF
ImageList_Draw.COMCTL32(?,00000000,00000000,00000000,00000000,00000010,?,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00448E0E

Part of subcall function 004488AC: ImageList_Add.COMCTL32(?,00000000,00000000,00000000,0044893E,?,00000000,0044895B), ref: 00448920

Strings

6B, xrefs: 00448D1F, 00448D58

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00486094, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112window

APIs

Part of subcall function 00485EAC: shutdown.WSOCK32(00000000,00000002), ref: 00485F0E
Part of subcall function 00485EAC: closesocket.WSOCK32(00000000,00000000,00000002), ref: 00485F19

Part of subcall function 00485F40: socket.WSOCK32(00000002,00000001,00000000,00000000,00486072), ref: 00485F69
Part of subcall function 00485F40: ntohs.WSOCK32(00000774,00000002,00000001,00000000,00000000,00486072), ref: 00485F8F
Part of subcall function 00485F40: inet_addr.WSOCK32(015EAA88,00000774,00000002,00000001,00000000,00000000,00486072), ref: 00485FA0
Part of subcall function 00485F40: gethostbyname.WSOCK32(015EAA88,015EAA88,00000774,00000002,00000001,00000000,00000000,00486072), ref: 00485FB5
Part of subcall function 00485F40: connect.WSOCK32(00000000,00000002,00000010,015EAA88,00000774,00000002,00000001,00000000,00000000,00486072), ref: 00485FD8
Part of subcall function 00485F40: recv.WSOCK32(00000000,0049A3A0,00001FFF,00000000,00000000,00000002,00000010,015EAA88,00000774,00000002,00000001,00000000,00000000,00486072), ref: 00485FEF
Part of subcall function 00485F40: recv.WSOCK32(00000000,0049A3A0,00001FFF,00000000,00000000,0049A3A0,00001FFF,00000000,00000000,00000002,00000010,015EAA88,00000774,00000002,00000001,00000000), ref: 0048603F

Part of subcall function 00466AFC: waveInOpen.WINMM(00000094,00000000,?,?,00000000,00010004), ref: 00466B36
Part of subcall function 00466AFC: waveInStart.WINMM(?), ref: 00466B5B

TranslateMessage.USER32(?), ref: 004861CA
DispatchMessageA.USER32(?), ref: 004861D0
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004861DE

Strings

@^H, xrefs: 004860BE

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0046F5E4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72window

APIs

GetWindowTextA.USER32(?,00000000,?), ref: 0046F634
GetWindowPlacement.USER32(?,0000002C), ref: 0046F64F
IsWindowVisible.USER32(?), ref: 0046F655

Strings

,, xrefs: 0046F643

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00473448, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68network

APIs

InternetOpenA.WININET(DCSC,00000000,00000000,00000000,00000000), ref: 00473493
InternetConnectA.WININET(00000000,00000000,00000000,00000000,00000000,00000001,08000000,00000000), ref: 004734D9

Strings

DCSC, xrefs: 0047348E
84G, xrefs: 00473468, 0047350F, 004734AF

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00485150, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registry

APIs

RegOpenKeyA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 00485199
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,?,00000000,004851DE,?,00000000,0048520A), ref: 004851C6
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,?,00000000,004851DE,?,00000000,0048520A), ref: 004851CF

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0048518F

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004606CC, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59network

APIs

inet_addr.WSOCK32(00000000), ref: 004606F6
gethostbyname.WSOCK32(00000000), ref: 00460711

Strings

%d.%d.%d.%d, xrefs: 0046075E
0.0.0.0, xrefs: 0046076C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0043804C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58window

APIs

GetMenuItemInfoA.USER32(00000000,00000000,000000FF), ref: 0043809A
SetMenuItemInfoA.USER32(00000000,00000000,000000FF), ref: 004380EC
DrawMenuBar.USER32(00000000), ref: 004380F9

Strings

P, xrefs: 0043808C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00474E20, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51synchronizationthreadinjection

APIs

Part of subcall function 00474DF0: VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040,?,?,00475328,?,?,00474E3D,DCPERSFWBP,?,?), ref: 00474E06
Part of subcall function 00474DF0: WriteProcessMemory.KERNEL32(?,00000000,?,?,?,?,00000000,?,00003000,00000040,?,?,00475328,?,?,00474E3D), ref: 00474E12

CreateRemoteThread.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00474E5E
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00474E6E
ReadProcessMemory.KERNEL32(?,00000000,?,?,?,DCPERSFWBP,?,?), ref: 00474E81

Strings

DCPERSFWBP, xrefs: 00474E28

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0048C3E4, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47libraryloader

APIs

LoadLibraryA.KERNEL32(00000000), ref: 0048C431
GetProcAddress.KERNEL32(00000000,_DCEntryPoint,00000000,0048C473), ref: 0048C442
FreeLibrary.KERNEL32(00000000), ref: 0048C44A

Strings

_DCEntryPoint, xrefs: 0048C43C

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042E2E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43

APIs

GetSystemMetrics.USER32(00000000), ref: 0042E331
GetSystemMetrics.USER32(00000001), ref: 0042E33D

Part of subcall function 0042E174: GetProcAddress.KERNEL32(76C70000,00000000,00000000,0042E231), ref: 0042E1F3

Strings

MonitorFromRect, xrefs: 0042E2F5
B, xrefs: 0042E2FA, 0042E307, 0042E30E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00431584, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43clipboard

APIs

GetClipboardData.USER32(00000001), ref: 0043159A
GlobalLock.KERNEL32(00000000,00000000,004315F6), ref: 004315BA
GlobalUnlock.KERNEL32(00000000,004315FD), ref: 004315E8

Strings

3 H, xrefs: 00431590, 004315ED

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0046D36C, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36

APIs

ShellExecuteA.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 0046D3B9

Strings

/k , xrefs: 0046D39A
cmd.exe, xrefs: 0046D3AD
open, xrefs: 0046D3B2

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042F9E4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36libraryloader

APIs

LoadLibraryA.KERNEL32(DWMAPI.DLL), ref: 0042FA0E
GetProcAddress.KERNEL32(00000000,DwmExtendFrameIntoClientArea,?,?,?,00447F98), ref: 0042FA31

Strings

DWMAPI.DLL, xrefs: 0042FA09
DwmExtendFrameIntoClientArea, xrefs: 0042FA26

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042FA80, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31libraryloader

APIs

LoadLibraryA.KERNEL32(DWMAPI.DLL), ref: 0042FAA6
GetProcAddress.KERNEL32(00000000,DwmIsCompositionEnabled,?,?,0042FB22,?,00447EFB), ref: 0042FAC9

Strings

DwmIsCompositionEnabled, xrefs: 0042FABE
DWMAPI.DLL, xrefs: 0042FAA1

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040F4AC, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloader

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0048F10B,00000000,0048F11E), ref: 0040F4B2
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA,kernel32.dll,?,0048F10B,00000000,0048F11E), ref: 0040F4C3

Strings

GetDiskFreeSpaceExA, xrefs: 0040F4BD
kernel32.dll, xrefs: 0040F4AD

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042EC20, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloader

APIs

GetModuleHandleA.KERNEL32(ole32.dll,?,0042EC9A), ref: 0042EC26
GetProcAddress.KERNEL32(00000000,CoWaitForMultipleHandles,ole32.dll,?,0042EC9A), ref: 0042EC37

Strings

CoWaitForMultipleHandles, xrefs: 0042EC31
ole32.dll, xrefs: 0042EC21

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004538D4, Relevance: 6.3, APIs: 4, Instructions: 308

APIs

MulDiv.KERNEL32(?,00000000,00000000), ref: 004539AF
MulDiv.KERNEL32(?,?,?), ref: 00453A13
MulDiv.KERNEL32(?,00000000,00000000), ref: 00453A53
MulDiv.KERNEL32(?,?,?), ref: 00453A8E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0044E40C, Relevance: 6.2, APIs: 4, Instructions: 212

APIs

GetDesktopWindow.USER32 ref: 0044E481
GetDesktopWindow.USER32 ref: 0044E5B1

Part of subcall function 0045A27C: ImageList_DragMove.COMCTL32(?,?), ref: 0045A2AA

Part of subcall function 0045A2F0: ImageList_EndDrag.COMCTL32(?,00000000,0044EC23,00000000,0044ED3F,?,00000000,0044EDB1), ref: 0045A30C

SetCursor.USER32(00000000), ref: 0044E5F1
SetCursor.USER32(00000000), ref: 0044E606

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0046E724, Relevance: 6.2, APIs: 4, Instructions: 198

APIs

Part of subcall function 004032F8: GetCommandLineA.KERNEL32(00000000,00403349,?,?,?,00000000), ref: 0040330F

Part of subcall function 00403358: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,?,?,0046E763,00000000,0046E984,?,?,?,?,00000000,00000000), ref: 0040337C
Part of subcall function 00403358: GetCommandLineA.KERNEL32(?,?,?,0046E763,00000000,0046E984,?,?,?,?,00000000,00000000), ref: 0040338E

NetShareEnum.NETAPI32(?,00000000,?,000000FF,?,?,?,00000000,0046E984,?,?,?,?,00000000,00000000), ref: 0046E79C
NetShareGetInfo.NETAPI32(?,?,000001F6,?,00000000,0046E945,?,?,00000000,?,000000FF,?,?,?,00000000,0046E984), ref: 0046E7D5
NetApiBufferFree.NETAPI32(?,?,?,000001F6,?,00000000,0046E945,?,?,00000000,?,000000FF,?,?,?,00000000), ref: 0046E936
NetApiBufferFree.NETAPI32(?,?,00000000,?,000000FF,?,?,?,00000000,0046E984,?,?,?,?,00000000,00000000), ref: 0046E964

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00411444, Relevance: 6.1, APIs: 4, Instructions: 115

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 004114F3
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0041150F
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00411586
VariantClear.OLEAUT32(?), ref: 004115AF

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040D8AC, Relevance: 6.1, APIs: 4, Instructions: 102

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040D8C9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0040D8ED
GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 0040D908
LoadStringA.USER32(00000000,0000FFED,?,00000100), ref: 0040D99E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040D8AA, Relevance: 6.1, APIs: 4, Instructions: 101

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040D8C9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0040D8ED
GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 0040D908
LoadStringA.USER32(00000000,0000FFED,?,00000100), ref: 0040D99E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00428848, Relevance: 6.1, APIs: 4, Instructions: 83window

APIs

Part of subcall function 004253D0: EnterCriticalSection.KERNEL32(00499A30,00000000,00423D82,00000000,00423DE1), ref: 004253D8
Part of subcall function 004253D0: LeaveCriticalSection.KERNEL32(00499A30,00499A30,00000000,00423D82,00000000,00423DE1), ref: 004253E5
Part of subcall function 004253D0: EnterCriticalSection.KERNEL32(00000038,00499A30,00499A30,00000000,00423D82,00000000,00423DE1), ref: 004253EE

Part of subcall function 00429D5C: GetDC.USER32(00000000), ref: 00429DB2
Part of subcall function 00429D5C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00429DC7
Part of subcall function 00429D5C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 00429DD1
Part of subcall function 00429D5C: CreateHalftonePalette.GDI32(00000000), ref: 00429DF5
Part of subcall function 00429D5C: ReleaseDC.USER32(00000000,00000000), ref: 00429E00

CreateCompatibleDC.GDI32(00000000), ref: 0042889D
SelectObject.GDI32(00000000,?), ref: 004288B6
SelectPalette.GDI32(00000000,?,000000FF), ref: 004288DF
RealizePalette.GDI32(00000000), ref: 004288EB

Part of subcall function 00425608: LeaveCriticalSection.KERNEL32(00000038,00000000,00423DD2,00423DE8), ref: 0042560F
Part of subcall function 00425608: EnterCriticalSection.KERNEL32(00499A30,00000038,00000000,00423DD2,00423DE8), ref: 00425619
Part of subcall function 00425608: LeaveCriticalSection.KERNEL32(00499A30,00499A30,00000038,00000000,00423DD2,00423DE8), ref: 00425626

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00470B94, Relevance: 6.1, APIs: 4, Instructions: 73file

APIs

Part of subcall function 00431970: GetClipboardData.USER32(00000000), ref: 00431996

GlobalLock.KERNEL32(00000000,00000000,00470C74), ref: 00470BDE
DragQueryFileA.SHELL32(?,000000FF,00000000,00000000,00000000,00000000,00470C74), ref: 00470BF0
DragQueryFileA.SHELL32(?,00000000,?,00000105,?,000000FF,00000000,00000000,00000000,00000000,00470C74), ref: 00470C10
GlobalUnlock.KERNEL32(00000000,?,000000FF,00000000,00000000,00000000,00000000,00470C74), ref: 00470C56

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00438710, Relevance: 6.1, APIs: 4, Instructions: 72window

APIs

GetMenuState.USER32(?,?,?), ref: 00438733
GetSubMenu.USER32(?,?), ref: 0043873E
GetMenuItemID.USER32(?,?), ref: 00438757
GetMenuStringA.USER32(?,?,?,?,?), ref: 004387AA

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00445518, Relevance: 6.1, APIs: 4, Instructions: 71threadwindow

APIs

GetWindow.USER32(?,00000004), ref: 00445528
GetWindowThreadProcessId.USER32(?,?), ref: 00445542
GetCurrentProcessId.KERNEL32(?,00000004), ref: 0044554E
IsWindowVisible.USER32(?), ref: 0044559E

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00466888, Relevance: 6.1, APIs: 4, Instructions: 59registry

APIs

GetClassInfoA.USER32(00400000,004667A4,?), ref: 004668A9
UnregisterClassA.USER32(004667A4,00400000), ref: 004668D2
RegisterClassA.USER32(00492AC8), ref: 004668DC

Part of subcall function 0040857C: CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004085BB

Part of subcall function 004667DC: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 004667FA

SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 00466927

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042B29C, Relevance: 6.1, APIs: 4, Instructions: 58window

APIs

GetIconInfo.USER32(?,?), ref: 0042B2BD
GetObjectA.GDI32(?,00000018,?), ref: 0042B2DE
DeleteObject.GDI32(?), ref: 0042B30A
DeleteObject.GDI32(?), ref: 0042B313

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00450350, Relevance: 6.1, APIs: 4, Instructions: 56

APIs

MulDiv.KERNEL32(?,00000000,00000000), ref: 00450365
MulDiv.KERNEL32(?,00000000,00000000), ref: 00450382
MulDiv.KERNEL32(?,00000000,00000000), ref: 0045039F
MulDiv.KERNEL32(?,00000000,00000000), ref: 004503BC

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00445334, Relevance: 6.1, APIs: 4, Instructions: 56

APIs

EnumWindows.USER32(Function_000452BC), ref: 0044535E
GetWindow.USER32(?,00000003), ref: 00445376
GetWindowLongA.USER32(00000000,000000EC), ref: 00445383
SetWindowPos.USER32(00000000,000000EC,00000000,00000000,00000000,00000000,00000213), ref: 004453C2

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004314A0, Relevance: 6.1, APIs: 4, Instructions: 56memoryclipboard

APIs

GlobalAlloc.KERNEL32(00002002,?,00000000,00431572), ref: 004314CF
GlobalLock.KERNEL32(?,00000000,00431544,?,00002002,?,00000000,00431572), ref: 004314E9
SetClipboardData.USER32(?,?), ref: 00431517
GlobalUnlock.KERNEL32(?,0043153A,?,00000000,00431544,?,00002002,?,00000000,00431572), ref: 0043152D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040A404, Relevance: 6.1, APIs: 4, Instructions: 54timefile

APIs

FindNextFileA.KERNEL32(?,?), ref: 0040A415
GetLastError.KERNEL32(?,?), ref: 0040A41E
FileTimeToLocalFileTime.KERNEL32(?), ref: 0040A434
FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 0040A443

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0041C2D4, Relevance: 6.1, APIs: 4, Instructions: 51

APIs

FindResourceA.KERNEL32(?,?,?), ref: 0041C2EB
LoadResource.KERNEL32(?,0041C370,?,?,?,00417C88,?,00000001,00000000,?,0041C216,00000000,?), ref: 0041C305
SizeofResource.KERNEL32(?,0041C370,?,0041C370,?,?,?,00417C88,?,00000001,00000000,?,0041C216,00000000,?), ref: 0041C31F
LockResource.KERNEL32(0041BDF4,00000000,?,0041C370,?,0041C370,?,?,?,00417C88,?,00000001,00000000,?,0041C216,00000000), ref: 0041C329

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040A3AC, Relevance: 6.0, APIs: 4, Instructions: 40time

APIs

DosDateTimeToFileTime.KERNEL32(?,0048C37F,?), ref: 0040A3C9
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0040A3DA
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?), ref: 0040A3EC
GetLastError.KERNEL32(?,00000000,00000000,?,?,?), ref: 0040A3F5

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00484388, Relevance: 6.0, APIs: 4, Instructions: 39

APIs

OpenProcess.KERNEL32(00000001,00000000,00000000), ref: 00484393
GetExitCodeProcess.KERNEL32(00000000,?), ref: 004843B7
TerminateProcess.KERNEL32(00000000,?,00000000,004843E0,?,00000001,00000000,00000000), ref: 004843C4
CloseHandle.KERNEL32(00000000), ref: 004843DA

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0044E254, Relevance: 6.0, APIs: 4, Instructions: 37thread

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 0044E261
GetCurrentProcessId.KERNEL32(00000000,?,?,-00000010,00000000,0044E2CC,-000000F7,?,00000000,0044DE86,?,-00000010,?), ref: 0044E26A
GlobalFindAtomA.KERNEL32(00000000), ref: 0044E27F
GetPropA.USER32(00000000,00000000), ref: 0044E296

Part of subcall function 0044D2C0: GetWindowThreadProcessId.USER32(?), ref: 0044D2C6
Part of subcall function 0044D2C0: GetCurrentProcessId.KERNEL32(?,?,?,?,0044D346,?,00000000,?,004387ED,?,004378A9), ref: 0044D2CF
Part of subcall function 0044D2C0: SendMessageA.USER32(?,0000C1C7,00000000,00000000), ref: 0044D2E4

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0044D2F4, Relevance: 6.0, APIs: 4, Instructions: 35thread

APIs

GetWindowThreadProcessId.USER32(?), ref: 0044D301
GetCurrentProcessId.KERNEL32(?,00000000,?,004387ED,?,004378A9), ref: 0044D30A
GlobalFindAtomA.KERNEL32(00000000), ref: 0044D31F
GetPropA.USER32(?,00000000), ref: 0044D336

Part of subcall function 0044D2C0: GetWindowThreadProcessId.USER32(?), ref: 0044D2C6
Part of subcall function 0044D2C0: GetCurrentProcessId.KERNEL32(?,?,?,?,0044D346,?,00000000,?,004387ED,?,004378A9), ref: 0044D2CF
Part of subcall function 0044D2C0: SendMessageA.USER32(?,0000C1C7,00000000,00000000), ref: 0044D2E4

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00444B1C, Relevance: 6.0, APIs: 4, Instructions: 34thread

APIs

GetCurrentThreadId.KERNEL32(?,00447A69,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00444B34
SetWindowsHookExA.USER32(00000003,00444AD8,00000000,00000000), ref: 00444B44
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00447A69,?,?,?,?,?,?,?,?,?,?), ref: 00444B5F
CreateThread.KERNEL32(00000000,000003E8,00444A7C,00000000,00000000), ref: 00444B83

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042B438, Relevance: 6.0, APIs: 4, Instructions: 29

APIs

GetDC.USER32(00000000), ref: 0042B441
SelectObject.GDI32(00000000,018A002E), ref: 0042B453
GetTextMetricsA.GDI32(00000000), ref: 0042B45E
ReleaseDC.USER32(00000000,00000000), ref: 0042B46F

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042473C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 172

APIs

Part of subcall function 00423A1C: EnterCriticalSection.KERNEL32(?,00423A59), ref: 00423A20

CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000,Default,00000000,00424930,?,00000000,00424958), ref: 0042486B
CreateFontIndirectA.GDI32(?), ref: 0042490D

Part of subcall function 0042B438: GetDC.USER32(00000000), ref: 0042B441
Part of subcall function 0042B438: SelectObject.GDI32(00000000,018A002E), ref: 0042B453
Part of subcall function 0042B438: GetTextMetricsA.GDI32(00000000), ref: 0042B45E
Part of subcall function 0042B438: ReleaseDC.USER32(00000000,00000000), ref: 0042B46F

Part of subcall function 00423A28: LeaveCriticalSection.KERNEL32(-00000008,00423B07,00423B0F), ref: 00423A2C

Strings

Default, xrefs: 00424832, 00424840, 00424841

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00404C5A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 00404D2E
UnhandledExceptionFilter.KERNEL32(?), ref: 00404D62

Part of subcall function 00407688: TlsGetValue.KERNEL32(00000000,00000000,00403029), ref: 004076AD
Part of subcall function 00407688: TlsGetValue.KERNEL32(00000000,00403029), ref: 004076BE

Strings

@, xrefs: 00404D07

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00405028, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 00405047

Strings

@, xrefs: 00405080
@, xrefs: 004050A2

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0045E7B4, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108

APIs

GetActiveObject.OLEAUT32(?,00000000,00000000), ref: 0045E817

Part of subcall function 0042BE18: ProgIDFromCLSID.OLE32(?), ref: 0042BE21
Part of subcall function 0042BE18: CoTaskMemFree.OLE32(00000000), ref: 0042BE39

Part of subcall function 0042BD90: StringFromCLSID.OLE32(?), ref: 0042BD99
Part of subcall function 0042BD90: CoTaskMemFree.OLE32(00000000), ref: 0042BDB1

Part of subcall function 00407550: LoadStringA.USER32(00000000,00010000,?,00001000), ref: 00407582

GetActiveObject.OLEAUT32(?,00000000,00000000), ref: 0045E89E

Part of subcall function 0042BF5C: GetComputerNameA.KERNEL32(?,00000010), ref: 0042C00D
Part of subcall function 0042BF5C: CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000,?,00000000,0042C0FD), ref: 0042C07D
Part of subcall function 0042BF5C: CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 0042C0B6

Part of subcall function 00405D28: SysFreeString.OLEAUT32(7942540A), ref: 00405D36

Part of subcall function 0042BE44: CoCreateInstance.OLE32(?,00000000,00000005,0042BF34,00000000), ref: 0042BE8B

Strings

E, xrefs: 0045E85F

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004630C8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108com

APIs

CoCreateInstance.OLE32(00492A3C,00000000,00000003,0049299C,00000000), ref: 0046315A

Strings

<*I, xrefs: 00463154
L*I, xrefs: 0046317F

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0046E3F0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000010,?), ref: 0046E44B
SHGetPathFromIDListA.SHELL32(?,?,00000000,00000010,?,00000000,0046E55E), ref: 0046E463

Part of subcall function 0042BE44: CoCreateInstance.OLE32(?,00000000,00000005,0042BF34,00000000), ref: 0042BE8B

Strings

.LNK, xrefs: 0046E4DE

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00472C70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98

APIs

Part of subcall function 004719C8: GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 004719DF

SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00472DAB,?,00000000,00472DE7), ref: 00472D16

Strings

drivers\etc\hosts, xrefs: 00472CD3, 00472D00
I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!, xrefs: 00472D8D

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004629C0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 91com

APIs

CoCreateInstance.OLE32(00492A3C,00000000,00000001,0049299C,00000000), ref: 00462A3F

Strings

<*I, xrefs: 00462A39
L*I, xrefs: 00462A60

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004658F4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91memory

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 00465939
VirtualProtect.KERNEL32(?,?,00000000,?), ref: 004659A5

Strings

FinalizeSections: VirtualProtect failed, xrefs: 004659B3

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00404B2E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 00404B9A
UnhandledExceptionFilter.KERNEL32(?), ref: 00404BD7

Part of subcall function 00407688: TlsGetValue.KERNEL32(00000000,00000000,00403029), ref: 004076AD
Part of subcall function 00407688: TlsGetValue.KERNEL32(00000000,00403029), ref: 004076BE

Strings

@, xrefs: 00404B55

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0040C028, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79thread

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,0040C116), ref: 0040C0AE
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100), ref: 0040C0B4

Strings

yyyy, xrefs: 0040C089

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004889F0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72

APIs

GetMonitorInfoA.USER32(?,00000048), ref: 00488A28

Part of subcall function 00475E2C: send.WSOCK32(00000248,00000000,?,00000000,00000000,00475EBD), ref: 00475E9D

Strings

H, xrefs: 00488A19
MONSIZE, xrefs: 00488A65

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00486210, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66network

APIs

Part of subcall function 00466470: acmStreamConvert.MSACM32(?,00000108,00000000), ref: 004664AB
Part of subcall function 00466470: acmStreamReset.MSACM32(?,00000000,?,00000108,00000000), ref: 004664B9

send.WSOCK32(00000000,0049A3A0,00000000,00000000), ref: 004862AA
recv.WSOCK32(00000000,0049A3A0,00001FFF,00000000,00000000,0049A3A0,00000000,00000000), ref: 004862C1

Part of subcall function 00475F68: send.WSOCK32(?,00000000,?,00000000,00000000,00475FCA), ref: 00475FAF

Strings

EndReceive, xrefs: 004862CA

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004843EC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52

APIs

OpenProcess.KERNEL32(001F0FFF,00000000), ref: 0048440F
CloseHandle.KERNEL32(00000000), ref: 00484475

Strings

ACCESS DENIED (x64), xrefs: 004843FD

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042E408, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44

APIs

GetSystemMetrics.USER32(00000000), ref: 0042E456
GetSystemMetrics.USER32(00000001), ref: 0042E468

Part of subcall function 0042E174: GetProcAddress.KERNEL32(76C70000,00000000,00000000,0042E231), ref: 0042E1F3

Strings

MonitorFromPoint, xrefs: 0042E41A

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00405026, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 00405047

Strings

@, xrefs: 00405080
@, xrefs: 004050A2

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 004319C4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43clipboard

APIs

EnumClipboardFormats.USER32(00000000), ref: 004319E8
EnumClipboardFormats.USER32(00000000), ref: 00431A0E

Strings

84B, xrefs: 004319F6

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 00422188, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42registry

APIs

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000000,?,?,004724E0,00000000,004724E0), ref: 004221BA

Strings

NoControlPanel, xrefs: 00422188
tdA, xrefs: 004221D0

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Function 0042E258, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39

APIs

GetSystemMetrics.USER32(?), ref: 0042E2BA

Part of subcall function 0042E174: GetProcAddress.KERNEL32(76C70000,00000000,00000000,0042E231), ref: 0042E1F3

GetSystemMetrics.USER32(?), ref: 0042E280

Strings

GetSystemMetrics, xrefs: 0042E268

Memory Dump Source

Source File: 00000003.00000002.699224479.00400000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.699370060.00499000.00000040.sdmp
Associated: 00000003.00000002.699381691.0049C000.00000040.sdmp
Associated: 00000003.00000002.699397817.004A3000.00000040.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_regdrv.jbxd

Yara matches

Analysis Process: Regdriver.exe PID: 3484 Parent PID: 1464

Executed Functions

Function 002A7228, Relevance: 1.5, APIs: 1, Instructions: 29

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 002A7246

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B3D20, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 190

APIs

GetModuleFileNameA.KERNEL32(?,?,000000FF,00000000,002B402F), ref: 002B3F33

Part of subcall function 002B3CFC: CreateFileA.KERNEL32(002B3CEC,80000000,00000001,00000000,00000003,00000080,00000000), ref: 002B3D12

GetLastError.KERNEL32(00000000,002B3E64,?,00000000,002B402F), ref: 002B3E0D
GetLastError.KERNEL32(00000000,002B3E64,?,00000000,002B402F), ref: 002B3E25
GetLastError.KERNEL32(00000000,002B3E64,?,00000000,002B402F), ref: 002B3E3D

Strings

KHCB, xrefs: 002B3EB4
}_b, xrefs: 002B3D5B, 002B3D70
<+, xrefs: 002B3DFF
<+, xrefs: 002B3E17

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 0040D9E0, Relevance: 7.7, Strings: 6, Instructions: 201

Strings

:mm, xrefs: 0040DC49
mmmm d, yyyy, xrefs: 0040DB12
m/d/yy, xrefs: 0040DAE5
AMPM , xrefs: 0040DC39
AMPM, xrefs: 0040DC2A
:mm:ss, xrefs: 0040DC66

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 002AA580, Relevance: 3.1, APIs: 2, Instructions: 93registry

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,000F003F,?,00000000,002AA688), ref: 002AA5FC
RegCreateKeyExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,000F003F,00000000,?,?,00000000,002AA688), ref: 002AA631

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 00406554, Relevance: 2.7, Strings: 2, Instructions: 184

Strings

Software\Borland\Locales, xrefs: 00406584, 004065A2
Software\Borland\Delphi\Locales, xrefs: 004065C0

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 002B414C, Relevance: 2.6, Strings: 2, Instructions: 99

Strings

}_b, xrefs: 002B417D
Key, xrefs: 002B4205

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B2F64, Relevance: 2.5, Strings: 2, Instructions: 42

Strings

regfile, xrefs: 002B2FB5
.key, xrefs: 002B2FA8

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B2F31, Relevance: 2.5, Strings: 2, Instructions: 26

Strings

regfile, xrefs: 002B2FB5
.key, xrefs: 002B2FA8

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A729C, Relevance: 1.6, APIs: 1, Instructions: 99

APIs

GetSystemDefaultLCID.KERNEL32(00000000,002A73D2), ref: 002A72BB

Part of subcall function 002A653C: LoadStringA.USER32(002A1778,0000FF86,?,00000400), ref: 002A6559

Part of subcall function 002A7228: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 002A7246

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002AA57E, Relevance: 1.6, APIs: 1, Instructions: 75registry

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,000F003F,?,00000000,002AA688), ref: 002AA5FC
RegCreateKeyExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,000F003F,00000000,?,?,00000000,002AA688), ref: 002AA631

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002AA7C2, Relevance: 1.5, APIs: 1, Instructions: 43registry

APIs

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 002AA7F5

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002AA7C4, Relevance: 1.5, APIs: 1, Instructions: 42registry

APIs

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 002AA7F5

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002AA6A4, Relevance: 1.5, APIs: 1, Instructions: 37registry

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,002AA70C,?,?,?,?,?,002AA70C), ref: 002AA6DA

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002AA6A8, Relevance: 1.5, APIs: 1, Instructions: 36registry

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,002AA70C,?,?,?,?,?,002AA70C), ref: 002AA6DA

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A6574, Relevance: 1.5, APIs: 1, Instructions: 23file

APIs

CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000080,00000000), ref: 002A65AA

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A65D8, Relevance: 1.5, APIs: 1, Instructions: 23file

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 002A65EC

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B3CFC, Relevance: 1.5, APIs: 1, Instructions: 14file

APIs

CreateFileA.KERNEL32(002B3CEC,80000000,00000001,00000000,00000003,00000080,00000000), ref: 002B3D12

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B42DC, Relevance: 1.4, Strings: 1, Instructions: 163

Strings

t]*, xrefs: 002B43DD, 002B43E3, 002B4409

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B1F78, Relevance: 1.3, Strings: 1, Instructions: 61

Strings

Software\, xrefs: 002B1FCD

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 00418184, Relevance: 1.3, Strings: 1, Instructions: 52

Strings

hmA, xrefs: 004181A6

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0040706A, Relevance: 1.1, Instructions: 1111

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041D6FC, Relevance: .2, Instructions: 190

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041C7F0, Relevance: .2, Instructions: 176

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 002B3B7C, Relevance: .1, Instructions: 89

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 0040D1EE, Relevance: .1, Instructions: 78

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041CAA0, Relevance: .1, Instructions: 69

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0040D91C, Relevance: .1, Instructions: 56

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041801C, Relevance: .1, Instructions: 53

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041FCA0, Relevance: .1, Instructions: 52

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041822C, Relevance: .0, Instructions: 46

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 00407B64, Relevance: .0, Instructions: 44

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 00407BBC, Relevance: .0, Instructions: 43

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 00404BCC, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041CA30, Relevance: .0, Instructions: 40

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 00415110, Relevance: .0, Instructions: 39

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 004016E0, Relevance: .0, Instructions: 38

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 00406E30, Relevance: .0, Instructions: 32

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041AE48, Relevance: .0, Instructions: 29

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 002B2224, Relevance: .0, Instructions: 27

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 004062F0, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 00419CD4, Relevance: .0, Instructions: 25

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 002A8514, Relevance: .0, Instructions: 21

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002AA720, Relevance: .0, Instructions: 20

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 00404C35, Relevance: .0, Instructions: 19

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041FC76, Relevance: .0, Instructions: 15

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 00404C34, Relevance: .0, Instructions: 12

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041F058, Relevance: .0, Instructions: 3

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Non-executed Functions

Function 002A66A8, Relevance: 3.0, APIs: 2, Instructions: 33file

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,?,002B2B47,00000000,002B2B89), ref: 002A66C3
GetLastError.KERNEL32(00000000,?,?,?,?,002B2B47,00000000,002B2B89), ref: 002A66E6

Part of subcall function 002A6644: FindNextFileA.KERNEL32(?,?), ref: 002A6654
Part of subcall function 002A6644: GetLastError.KERNEL32(?,?), ref: 002A665D
Part of subcall function 002A6644: FileTimeToLocalFileTime.KERNEL32(?), ref: 002A6671
Part of subcall function 002A6644: FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 002A6680

Part of subcall function 002A66F4: FindClose.KERNEL32(?,002A66E4,00000000,?,?,?,?,002B2B47,00000000,002B2B89), ref: 002A66FD

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A7274, Relevance: 1.5, APIs: 1, Instructions: 23

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,002A7476,00000000,002A7628,?,?,?,?,00000000), ref: 002A7287

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002AE7C9, Relevance: 1.0, Instructions: 984

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002AB5CA, Relevance: .7, Instructions: 706

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002AAA00, Relevance: .3, Instructions: 253

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B13D8, Relevance: .2, Instructions: 219

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B4B31, Relevance: .2, Instructions: 209

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B087E, Relevance: .2, Instructions: 162

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B0A9E, Relevance: .2, Instructions: 161

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B11FC, Relevance: .1, Instructions: 143

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B0D66, Relevance: .1, Instructions: 125

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B0D68, Relevance: .1, Instructions: 124

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 004021D8, Relevance: .1, Instructions: 94

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 002B04D1, Relevance: .1, Instructions: 79

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B05D6, Relevance: .1, Instructions: 75

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B0CBC, Relevance: .1, Instructions: 66

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 0040EF78, Relevance: 28.9, Strings: 23, Instructions: 141

Strings

VarR8FromStr, xrefs: 0040F0D9
VarBstrFromCy, xrefs: 0040F131
oleaut32.dll, xrefs: 0040EF7C
VarOr, xrefs: 0040F06B
VarR4FromStr, xrefs: 0040F0C3
VarXor, xrefs: 0040F081
VarDateFromStr, xrefs: 0040F0EF
VarCyFromStr, xrefs: 0040F105
VarBstrFromBool, xrefs: 0040F15D
VarCmp, xrefs: 0040F097
VarAdd, xrefs: 0040EFD1
VarMod, xrefs: 0040F03F
VarDiv, xrefs: 0040F013
VarNeg, xrefs: 0040EFA5
VarIdiv, xrefs: 0040F029
VarMul, xrefs: 0040EFFD
VarSub, xrefs: 0040EFE7
VariantChangeTypeEx, xrefs: 0040EF8F
VarBstrFromDate, xrefs: 0040F147
VarI4FromStr, xrefs: 0040F0AD
VarBoolFromStr, xrefs: 0040F11B
VarNot, xrefs: 0040EFBB
VarAnd, xrefs: 0040F055

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 002B2570, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 71window

APIs

GetWindowTextA.USER32(?,?,00000100), ref: 002B258C
GetClassNameA.USER32(?,?,00000100), ref: 002B25A6
FindWindowExA.USER32(?,00000000,SysListView32,00000000), ref: 002B25F3
SendMessageA.USER32(?,00001009,00000000,00000000), ref: 002B2608
SendMessageA.USER32(?,0000000F,00000000,00000000), ref: 002B2617
SendMessageA.USER32(?,00000002,00000000,00000000), ref: 002B2623
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 002B262F

Strings

T%+, xrefs: 002B25B8
SysListView32, xrefs: 002B25EB

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A53BF, Relevance: 15.1, APIs: 10, Instructions: 122file

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 002A5446
GetFileSize.KERNEL32(?,00000000), ref: 002A546A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000), ref: 002A5486
ReadFile.KERNEL32(?,?,00000080,?,00000000), ref: 002A54A7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 002A54D0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 002A54DA
GetStdHandle.KERNEL32(000000F5), ref: 002A54FA
GetFileType.KERNEL32 ref: 002A5511
CloseHandle.KERNEL32 ref: 002A552C
GetLastError.KERNEL32(000000F5), ref: 002A5546

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B3578, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 112libraryloader

APIs

LoadLibraryA.KERNEL32(?), ref: 002B359B
GetProcAddress.KERNEL32(?,?,00000000,002B36DD), ref: 002B35AB
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,00000000,002B36DD), ref: 002B35CF

Strings

could not be located in the dynamic link library , xrefs: 002B362D, 002B368A
LOADER ERROR, xrefs: 002B3658, 002B36B5
The ordinal , xrefs: 002B3607
The procedure entry point , xrefs: 002B3664
KERNEL32.DLL, xrefs: 002B35CA

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A314C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 59

APIs

RtlEnterCriticalSection.NTDLL((&), ref: 002A3179
LocalFree.KERNEL32(002C4780,00000000,002A3224), ref: 002A318B
VirtualFree.KERNEL32(01410000,00000000,00008000,002C4780,00000000,002A3224), ref: 002A31AA
LocalFree.KERNEL32(002C5DD0,01410000,00000000,00008000,002C4780,00000000,002A3224), ref: 002A31E9
RtlLeaveCriticalSection.NTDLL((&), ref: 002A3214
RtlDeleteCriticalSection.NTDLL((&), ref: 002A321E

Strings

(&, xrefs: 002A3174, 002A320F, 002A3219
b,, xrefs: 002A31C3

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 0041016C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00410205
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00410221
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0041025A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004102D7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004102F0
VariantCopy.OLEAUT32(?), ref: 00410325

Strings

, xrefs: 00410186

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 00402644, Relevance: 11.5, Strings: 9, Instructions: 254

Strings

String, xrefs: 004028B5
Unknown, xrefs: 004028A0
An unexpected memory leak has occurred. , xrefs: 004027A4
, xrefs: 00402928
The unexpected small block leaks are:, xrefs: 0040281B
7, xrefs: 004027B5
The sizes of unexpected leaked medium and large blocks are: , xrefs: 0040295D
Unexpected Memory Leak, xrefs: 004029D4
bytes: , xrefs: 00402871

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 00403020, Relevance: 11.4, Strings: 9, Instructions: 110

Strings

", xrefs: 004030B3
, xrefs: 00403038
, xrefs: 0040310D
", xrefs: 0040303D
", xrefs: 00403042
, xrefs: 0040309C
", xrefs: 00403078
", xrefs: 004030E0
", xrefs: 00403054

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 002A73E0, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167

APIs

GetSystemDefaultLCID.KERNEL32(00000000,002A7628,?,?,?,?,00000000,00000000,00000000), ref: 002A73FA

Part of subcall function 002A7228: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 002A7246

Part of subcall function 002A7274: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,002A7476,00000000,002A7628,?,?,?,?,00000000), ref: 002A7287

Strings

m/d/yy, xrefs: 002A74C9
mmmm d, yyyy, xrefs: 002A74EB
:mm, xrefs: 002A75DC
AMPM, xrefs: 002A75C5
:mm:ss, xrefs: 002A75F6

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A492C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66memory

APIs

TlsAlloc.KERNEL32(0000001B,?,002B4DBF), ref: 002A48D0
TlsFree.KERNEL32(0000001B,?,002B4DBF), ref: 002A4924

Part of subcall function 002A48F0: TlsGetValue.KERNEL32(0000001B,002A4915,?,002B4DBF), ref: 002A48FF
Part of subcall function 002A48F0: LocalFree.KERNEL32(00000000,0000001B,002A4915,?,002B4DBF), ref: 002A4909

Part of subcall function 002A4844: LocalAlloc.KERNEL32(00000040,00000008,?,002A48AC,0000001B,002A5C4B,00000000,002A5CB2), ref: 002A485F
Part of subcall function 002A4844: TlsSetValue.KERNEL32(0000001B,00000000,00000040,00000008,?,002A48AC,0000001B,002A5C4B,00000000,002A5CB2), ref: 002A487D

Strings

p', xrefs: 002A493D

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A3088, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48memory

APIs

RtlInitializeCriticalSection.NTDLL((&), ref: 002A309E
RtlEnterCriticalSection.NTDLL((&), ref: 002A30B1
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,002A313E), ref: 002A30DB
RtlLeaveCriticalSection.NTDLL((&), ref: 002A3138

Strings

(&, xrefs: 002A3099, 002A30AC, 002A3133
b,, xrefs: 002A30C0

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A562A, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72window

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 002A56C5

Part of subcall function 002A314C: RtlEnterCriticalSection.NTDLL((&), ref: 002A3179
Part of subcall function 002A314C: LocalFree.KERNEL32(002C4780,00000000,002A3224), ref: 002A318B
Part of subcall function 002A314C: VirtualFree.KERNEL32(01410000,00000000,00008000,002C4780,00000000,002A3224), ref: 002A31AA
Part of subcall function 002A314C: LocalFree.KERNEL32(002C5DD0,01410000,00000000,00008000,002C4780,00000000,002A3224), ref: 002A31E9
Part of subcall function 002A314C: RtlLeaveCriticalSection.NTDLL((&), ref: 002A3214
Part of subcall function 002A314C: RtlDeleteCriticalSection.NTDLL((&), ref: 002A321E

ExitProcess.KERNEL32 ref: 002A570D

Strings

Runtime error at 00000000, xrefs: 002A56BE, 002A56D1
Error, xrefs: 002A56B9
p', xrefs: 002A572E

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A3744, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122

APIs

RtlEnterCriticalSection.NTDLL((&), ref: 002A3787
RtlLeaveCriticalSection.NTDLL((&), ref: 002A38B2

Part of subcall function 002A3088: RtlInitializeCriticalSection.NTDLL((&), ref: 002A309E
Part of subcall function 002A3088: RtlEnterCriticalSection.NTDLL((&), ref: 002A30B1
Part of subcall function 002A3088: LocalAlloc.KERNEL32(00000000,00000FF8,00000000,002A313E), ref: 002A30DB
Part of subcall function 002A3088: RtlLeaveCriticalSection.NTDLL((&), ref: 002A3138

Strings

(&, xrefs: 002A3782, 002A38AD
', xrefs: 002A376E

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 004146C0, Relevance: 6.3, Strings: 5, Instructions: 85

Strings

ByRef , xrefs: 004147C3
String, xrefs: 00414712
Array , xrefs: 004147B0
Any, xrefs: 0041472A
LH, xrefs: 00414798

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 00407C1D, Relevance: 6.3, Strings: 5, Instructions: 54

Strings

MouseZ, xrefs: 00407C27
Magellan MSWHEEL, xrefs: 00407C22
MSWHEEL_ROLLMSG, xrefs: 00407C33
MSH_WHEELSUPPORT_MSG, xrefs: 00407C42
MSH_SCROLL_LINES_MSG, xrefs: 00407C4E

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0040FECC, Relevance: 6.1, APIs: 4, Instructions: 115

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0040FF7B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0040FF97
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0041000E
VariantClear.OLEAUT32(?), ref: 00410037

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 002A2C14, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 45memory

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,b,,?,?,?,002A2F70), ref: 002A2C32
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,b,,?,?,?,002A2F70), ref: 002A2C57
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,b,,?,?,?,002A2F70), ref: 002A2C7D

Strings

b,, xrefs: 002A2C17

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A6644, Relevance: 6.0, APIs: 4, Instructions: 39timefile

APIs

FindNextFileA.KERNEL32(?,?), ref: 002A6654
GetLastError.KERNEL32(?,?), ref: 002A665D
FileTimeToLocalFileTime.KERNEL32(?), ref: 002A6671
FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 002A6680

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A38CC, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118

APIs

RtlEnterCriticalSection.NTDLL((&), ref: 002A3920
RtlLeaveCriticalSection.NTDLL((&), ref: 002A3A58

Part of subcall function 002A3088: RtlInitializeCriticalSection.NTDLL((&), ref: 002A309E
Part of subcall function 002A3088: RtlEnterCriticalSection.NTDLL((&), ref: 002A30B1
Part of subcall function 002A3088: LocalAlloc.KERNEL32(00000000,00000FF8,00000000,002A313E), ref: 002A30DB
Part of subcall function 002A3088: RtlLeaveCriticalSection.NTDLL((&), ref: 002A3138

Strings

(&, xrefs: 002A391B, 002A3A53

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002B2B9C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,002B2CB1), ref: 002B2BDF

Part of subcall function 002A71A4: GetLocalTime.KERNEL32(?), ref: 002A71AC

Strings

\user.dat, xrefs: 002B2C2A
\pagefile.sys, xrefs: 002B2C5E

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A3C40, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70

APIs

RtlEnterCriticalSection.NTDLL((&), ref: 002A3C83

Part of subcall function 002A3744: RtlEnterCriticalSection.NTDLL((&), ref: 002A3787
Part of subcall function 002A3744: RtlLeaveCriticalSection.NTDLL((&), ref: 002A38B2

RtlLeaveCriticalSection.NTDLL((&), ref: 002A3CEC

Part of subcall function 002A38CC: RtlEnterCriticalSection.NTDLL((&), ref: 002A3920
Part of subcall function 002A38CC: RtlLeaveCriticalSection.NTDLL((&), ref: 002A3A58

Part of subcall function 002A3088: RtlInitializeCriticalSection.NTDLL((&), ref: 002A309E
Part of subcall function 002A3088: RtlEnterCriticalSection.NTDLL((&), ref: 002A30B1
Part of subcall function 002A3088: LocalAlloc.KERNEL32(00000000,00000FF8,00000000,002A313E), ref: 002A30DB
Part of subcall function 002A3088: RtlLeaveCriticalSection.NTDLL((&), ref: 002A3138

Strings

(&, xrefs: 002A3C7E, 002A3CE7

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 002A3229, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 8

APIs

RtlLeaveCriticalSection.NTDLL((&), ref: 002A3214
RtlDeleteCriticalSection.NTDLL((&), ref: 002A321E

Strings

(&, xrefs: 002A320F, 002A3219

Memory Dump Source

Source File: 00000004.00000003.453105771.002A1000.00000004.sdmp, Offset: 002A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2a1000_Regdriver.jbxd

Function 0041AFB0, Relevance: 5.1, Strings: 4, Instructions: 105

Strings

ZA, xrefs: 0041B05F
@NA, xrefs: 0041B0BC
H[A, xrefs: 0041B0C4
8NA, xrefs: 0041B057

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041B788, Relevance: 5.1, Strings: 4, Instructions: 71

Strings

., xrefs: 0041B7FF
Owner, xrefs: 0041B7E8
>, xrefs: 0041B80B
-, xrefs: 0041B805

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Function 0041CCC4, Relevance: 5.0, Strings: 4, Instructions: 48

Strings

nil, xrefs: 0041CD61
Null, xrefs: 0041CD6F
True, xrefs: 0041CD53
False, xrefs: 0041CD45

Memory Dump Source

Source File: 00000004.00000002.461572288.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.461555529.00400000.00000002.sdmp
Associated: 00000004.00000002.461952454.00499000.00000008.sdmp
Associated: 00000004.00000002.461963366.004A4000.00000008.sdmp
Associated: 00000004.00000002.462030075.004C3000.00000008.sdmp
Associated: 00000004.00000002.463276082.00614000.00000004.sdmp
Associated: 00000004.00000002.463306188.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Regdriver.jbxd

Analysis Process: regdrv.exe PID: 3532 Parent PID: 3484

Executed Functions

Function 0040D9E0, Relevance: 7.7, Strings: 6, Instructions: 201

Strings

mmmm d, yyyy, xrefs: 0040DB12
:mm, xrefs: 0040DC49
AMPM, xrefs: 0040DC2A
m/d/yy, xrefs: 0040DAE5
:mm:ss, xrefs: 0040DC66
AMPM , xrefs: 0040DC39

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00406554, Relevance: 2.7, Strings: 2, Instructions: 184

Strings

Software\Borland\Locales, xrefs: 00406584, 004065A2
Software\Borland\Delphi\Locales, xrefs: 004065C0

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00418184, Relevance: 1.3, Strings: 1, Instructions: 52

Strings

hmA, xrefs: 004181A6

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0040706A, Relevance: 1.1, Instructions: 1111

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041D6FC, Relevance: .2, Instructions: 190

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041C7F0, Relevance: .2, Instructions: 176

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00401BA0, Relevance: .2, Instructions: 174

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0040D1EE, Relevance: .1, Instructions: 78

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041CAA0, Relevance: .1, Instructions: 69

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0040D91C, Relevance: .1, Instructions: 56

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041801C, Relevance: .1, Instructions: 53

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041FCA0, Relevance: .1, Instructions: 52

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041822C, Relevance: .0, Instructions: 46

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00407B64, Relevance: .0, Instructions: 44

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00407BBC, Relevance: .0, Instructions: 43

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00404BCC, Relevance: .0, Instructions: 41

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041CA30, Relevance: .0, Instructions: 40

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00415110, Relevance: .0, Instructions: 39

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 004016E0, Relevance: .0, Instructions: 38

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00406E30, Relevance: .0, Instructions: 32

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041AE48, Relevance: .0, Instructions: 29

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 004062F0, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 004017FA, Relevance: .0, Instructions: 26

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00419CD4, Relevance: .0, Instructions: 25

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00404C35, Relevance: .0, Instructions: 19

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041FC76, Relevance: .0, Instructions: 15

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00404C34, Relevance: .0, Instructions: 12

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041F058, Relevance: .0, Instructions: 3

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Non-executed Functions

Function 004021D8, Relevance: .1, Instructions: 94

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0040EF78, Relevance: 28.9, Strings: 23, Instructions: 141

Strings

VarR8FromStr, xrefs: 0040F0D9
VarCyFromStr, xrefs: 0040F105
VarDiv, xrefs: 0040F013
VarSub, xrefs: 0040EFE7
VarCmp, xrefs: 0040F097
VariantChangeTypeEx, xrefs: 0040EF8F
VarIdiv, xrefs: 0040F029
VarAdd, xrefs: 0040EFD1
VarBstrFromDate, xrefs: 0040F147
VarBstrFromBool, xrefs: 0040F15D
VarXor, xrefs: 0040F081
VarMul, xrefs: 0040EFFD
VarDateFromStr, xrefs: 0040F0EF
VarBoolFromStr, xrefs: 0040F11B
VarR4FromStr, xrefs: 0040F0C3
VarI4FromStr, xrefs: 0040F0AD
VarNot, xrefs: 0040EFBB
VarAnd, xrefs: 0040F055
VarMod, xrefs: 0040F03F
VarBstrFromCy, xrefs: 0040F131
VarNeg, xrefs: 0040EFA5
oleaut32.dll, xrefs: 0040EF7C
VarOr, xrefs: 0040F06B

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041016C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00410205
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00410221
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0041025A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004102D7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004102F0
VariantCopy.OLEAUT32(?), ref: 00410325

Strings

, xrefs: 00410186

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00402644, Relevance: 11.5, Strings: 9, Instructions: 254

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 0040295D
Unknown, xrefs: 004028A0
An unexpected memory leak has occurred. , xrefs: 004027A4
bytes: , xrefs: 00402871
String, xrefs: 004028B5
7, xrefs: 004027B5
, xrefs: 00402928
The unexpected small block leaks are:, xrefs: 0040281B
Unexpected Memory Leak, xrefs: 004029D4

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00403020, Relevance: 11.4, Strings: 9, Instructions: 110

Strings

, xrefs: 0040310D
", xrefs: 0040303D
", xrefs: 004030B3
", xrefs: 004030E0
, xrefs: 00403038
", xrefs: 00403042
", xrefs: 00403054
", xrefs: 00403078
, xrefs: 0040309C

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 004146C0, Relevance: 6.3, Strings: 5, Instructions: 85

Strings

ByRef , xrefs: 004147C3
Array , xrefs: 004147B0
String, xrefs: 00414712
LH, xrefs: 00414798
Any, xrefs: 0041472A

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 00407C1D, Relevance: 6.3, Strings: 5, Instructions: 54

Strings

MSH_WHEELSUPPORT_MSG, xrefs: 00407C42
Magellan MSWHEEL, xrefs: 00407C22
MouseZ, xrefs: 00407C27
MSWHEEL_ROLLMSG, xrefs: 00407C33
MSH_SCROLL_LINES_MSG, xrefs: 00407C4E

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0040FECC, Relevance: 6.1, APIs: 4, Instructions: 115

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0040FF7B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0040FF97
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0041000E
VariantClear.OLEAUT32(?), ref: 00410037

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041B788, Relevance: 5.1, Strings: 4, Instructions: 71

Strings

Owner, xrefs: 0041B7E8
-, xrefs: 0041B805
., xrefs: 0041B7FF
>, xrefs: 0041B80B

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Function 0041CCC4, Relevance: 5.0, Strings: 4, Instructions: 48

Strings

True, xrefs: 0041CD53
False, xrefs: 0041CD45
Null, xrefs: 0041CD6F
nil, xrefs: 0041CD61

Memory Dump Source

Source File: 00000005.00000002.487413976.00401000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.487404433.00400000.00000002.sdmp
Associated: 00000005.00000002.487557191.00499000.00000008.sdmp
Associated: 00000005.00000002.487566565.004A4000.00000008.sdmp
Associated: 00000005.00000002.487595103.004C3000.00000008.sdmp
Associated: 00000005.00000002.487868215.00614000.00000004.sdmp
Associated: 00000005.00000002.487895278.00616000.00000008.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_regdrv.jbxd

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report DOC000YUT600.scr

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

AV Detection:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshots

Startup

Created / dropped Files

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior